A GNN-based financial fraud detection method

Abstract

This invention provides a GNN-based financial fraud detection method, belonging to the field of data processing technology. Specifically, it includes: constructing and normalizing a heterogeneous financial transaction graph; calculating the PPR matrix for each relationship type and calculating a multi-scale prior weight vector for each node based on this matrix; inputting the multi-scale prior weight vector and node features into a multi-layer graph neural network model to generate a multi-scale fusion representation of each node under each relationship type; generating the output representation of the node at the current network layer based on a relationship attention mechanism; generating the final feature representation of each node based on a hierarchical attention mechanism; inputting the final feature representation into a classifier to obtain the probability prediction value of each node being an anomalous node; calculating the loss function using labeled real data and optimizing the parameters of the multi-layer graph neural network model and the classifier through backpropagation. This invention improves detection accuracy and robustness.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a financial fraud detection method based on GNN. Background Technology

[0002] Currently, fraud detection refers to the technology of identifying and preventing the acquisition of benefits through illegal or deceptive means. In today's highly digitalized and internet-connected world, fraud detection technology is closely related to people's daily lives. For individuals, fraud detection helps protect their identity information in banking and investment transactions from theft, thereby avoiding economic losses. For businesses, fraud detection helps create a secure trading environment, attracting more users and maintaining brand reputation. For the market, fraud detection can detect hidden market manipulation and insider trading, protecting investors' interests and maintaining market order. However, existing anomaly detection methods have significant shortcomings in information scale modeling, heterogeneous relationship modeling, and cross-level feature fusion, leading to problems such as high noise and poor robustness in node representations.

[0003] It is evident that there is an urgent need for a GNN-based financial fraud detection method with high accuracy and robustness. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a financial fraud detection method based on GNN, which at least partially solves the problems of poor detection accuracy and robustness in the prior art.

[0005] This invention provides a GNN-based financial fraud detection method, comprising:

[0006] Step 1: Construct a heterogeneous financial transaction graph and normalize its node features. The heterogeneous financial transaction graph contains nodes of various entity types and edges of various relationship types.

[0007] Step 2: For each type of relationship in the heterogeneous financial transaction graph, calculate its PPR matrix, and based on this matrix, calculate the multi-scale prior weight vector of each node with its neighboring nodes under different relationship types.

[0008] Step 3: Input the multi-scale prior weight vector and node features into the multi-layer graph neural network model to perform multi-scale information fusion within the relation and generate a multi-scale fused representation of each node under each relation type;

[0009] Step 4: Based on the relational attention mechanism, perform a weighted summation of the multi-scale fusion representation of each node under different relational types to generate the output representation of the node in the current network layer;

[0010] Step 5: Based on the hierarchical attention mechanism, the output representations of nodes in different network layers of the multi-layer graph neural network model are weighted and summed to generate the final feature representation of each node;

[0011] Step 6: Input the final feature representation into the classifier to obtain the probability prediction value of each node being an anomalous node;

[0012] Step 7: Calculate the loss function using labeled real data, and optimize the parameters of the multilayer graph neural network model and classifier through backpropagation to obtain the target model for detecting the financial data to be detected.

[0013] According to a specific implementation of an embodiment of the present invention, step 2 specifically includes:

[0014] Step 2.1, for each relation type r and its corresponding PPR matrix For each node v, extract node v in the matrix The corresponding row vector in the middle;

[0015] Step 2.2: Based on the non-zero PPR values ​​in the row vectors, use a clustering algorithm to divide the neighboring nodes of node v into at least three distance clusters, each corresponding to a different information scale;

[0016] Step 2.3: Calculate the proportion of the sum of the PPR values ​​of all neighboring nodes in each distance cluster to the total PPR value of node v, and use it as the prior weight corresponding to this information scale.

[0017] Step 2.4: Form a multi-scale prior weight vector from the prior weights of all nodes under all relation types.

[0018] According to a specific implementation of an embodiment of the present invention, step 3 specifically includes:

[0019] Step 3.1: For each node v, each relation type r, and the current network layer h, perform K-step neighbor feature aggregation to obtain K node feature representations at different scales. , ,in When =0, the feature is the result of a linear transformation of the node's own features. K-1 refers to the feature after aggregating the information of neighboring nodes with a distance of K-1 steps under this relation type r.

[0020] Step 3.2: Input the node feature representations at K scales into a scale attention network, and calculate the feature representations at each scale. Corresponding attention weights ;

[0021] Step 3.3: The node feature representations at K scales are weighted and summed according to their corresponding attention weights to obtain the multi-scale fusion representation of node v under relation type r. .

[0022] According to a specific implementation of an embodiment of the present invention, step 4 specifically includes:

[0023] Step 4.1: For each node v, perform a multi-scale fusion representation of it across all relation types r. The transformation features of the nodes themselves are input into the relation attention network to calculate the attention weights corresponding to each relation type. ;

[0024] Step 4.2: Based on the relational attention weights, perform a weighted summation of the multi-scale fusion representations for all relation types to obtain the output representation of node v at layer h after fusing all relation types r.

[0025] = ;

[0026] in, The input represents the total number of relation types, and self represents the transformation features of the node itself. This means that the input not only includes the multi-scale fusion representation of node v under all relation types r, but also the transformation features of the node itself.

[0027] According to a specific implementation of an embodiment of the present invention, step 5 specifically includes:

[0028] Step 5.1: For each node v, represent its output across all network layers in the multilayer graph neural network model. , ..., The original input features, after projection, are input into a hierarchical attention network, and the attention weights corresponding to each network layer are calculated. ;

[0029] Step 5.2: Based on the hierarchical attention weights, perform a weighted sum of the output representations of all network layers to obtain the final feature representation of node v:

[0030] = .

[0031] The financial fraud detection scheme based on GNN in this embodiment of the invention includes: Step 1, constructing a heterogeneous financial transaction graph and normalizing its node features, wherein the heterogeneous financial transaction graph contains nodes of multiple entity types and edges of multiple relation types; Step 2, for each relation type in the heterogeneous financial transaction graph, calculating its PPR matrix, and based on this matrix, calculating the multi-scale prior weight vector of each node with its neighboring nodes under different relation types; Step 3, inputting the multi-scale prior weight vector and node features into a multi-layer graph neural network model to perform multi-scale information fusion within the relation, generating multi-scale fusion of each node under each relation type. Step 4: Based on the relational attention mechanism, the multi-scale fusion representation of each node under different relation types is weighted and summed to generate the output representation of the node in the current network layer; Step 5: Based on the hierarchical attention mechanism, the output representations of nodes in different network layers of the multi-layer graph neural network model are weighted and summed to generate the final feature representation of each node; Step 6: The final feature representation is input into the classifier to obtain the probability prediction value of each node as an anomalous node; Step 7: The loss function is calculated using labeled real data, and the parameters of the multi-layer graph neural network model and the classifier are optimized through backpropagation to obtain the target model for detecting the financial data to be detected.

[0032] The beneficial effects of this invention are as follows: Through the solution of this invention, progressive information refinement is achieved in a three-layer architecture through a multi-scale discovery module. Each layer independently completes a specific information processing task: within a single relation, multi-step diffusion is used to capture features at different scales, from local fine features to macroscopic patterns, and these features are adaptively aggregated, thereby overcoming the limitation of the fixed receptive field of general GNNs; at the cross-relationship level, it is necessary to accurately filter and integrate cross-relationship information. Through the multi-scale relation representation generated in the previous steps, attention mechanisms are used to identify and fuse the relation information most important to the current node and task, and relation noise irrelevant to the current node and task is filtered out, thereby processing the complex semantics of cross-relationships in heterogeneous graphs; at the cross-network level, the abstract features from shallow to deep networks are fused again through attention mechanisms, and the advantages of features at different levels are used to generate the final task representation, improving detection accuracy and robustness. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1A flowchart illustrating a GNN-based financial fraud detection method provided in an embodiment of the present invention;

[0035] Figure 2 This is a schematic diagram illustrating the specific implementation process of a GNN-based financial fraud detection method provided in an embodiment of the present invention. Detailed Implementation

[0036] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0037] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0038] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this invention, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0039] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. The illustrations only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0040] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0041] Fraud detection refers to technologies that identify and prevent the acquisition of benefits through illegal or deceptive means. In today's highly digitalized and internet-connected world, fraud detection technology is closely related to people's daily lives. For individuals, fraud detection helps protect their identity information in banking and investment transactions from theft, thereby avoiding financial losses. For businesses, fraud detection helps create a secure trading environment, attracting more users and maintaining brand reputation. For the market, fraud detection can detect hidden market manipulation and insider trading, protecting investors' interests and maintaining market order.

[0042] Anomaly detection is typically used to identify objects or events in a dataset that deviate significantly from the majority of observations. It is a key technology in data mining and one of the most applicable techniques in fields such as financial fraud and risk control. In everyday life, these outliers often carry important information. For example, in financial risk control, network intrusion detection, and public safety early warning, outliers often indicate potential risks or critical failures. Graphs, as a data structure that accurately describes nodes and edges, provide precise and powerful mathematical representations for these complex anomaly detection tasks, and therefore have been widely used in the field. With the development of Graph Neural Networks (GNNs), graph-based anomaly detection techniques have become a crucial means of identifying suspicious entities in complex systems (such as financial risk control, social network bot detection, and network security intrusion detection). However, real-world data often exists in the form of heterogeneous graphs, with diverse node and edge types that carry rich semantic information. For example, in an e-commerce graph, a node can be a user, a merchant, or a product, and an edge can be a purchase or a review. This heterogeneity greatly enriches the semantics of the data. Therefore, how to make full use of this heterogeneous information and extract the behavioral patterns of nodes in a multi-scale neighborhood is the core challenge for improving anomaly detection performance.

[0043] Graph data has inherent multi-scale characteristics: node behavior is influenced by both direct neighbors (local microstructure) and distant neighbors or the patterns of the community to which it belongs (non-local macrostructure). Whether a node’s behavior is abnormal can be determined by the attributes and behaviors of its neighboring nodes. In this way, the analysis of each node can be placed under its neighborhood or even the entire network results for judgment and detection.

[0044] Graph anomaly detection problems are generally classified into three categories: node anomalies, edge anomalies, and subgraph anomalies. Node anomalies refer to a node whose attributes or connection patterns differ from most nodes in the graph, such as fraudulent accounts in financial risk control; edge anomalies refer to an abnormal connection between two nodes, such as two nodes in a social network that do not have any members in the same community suddenly interacting; subgraph anomalies refer to a local graph structure composed of a series of nodes and edges exhibiting abnormal patterns, such as an illegal trading group composed of multiple accounts in a financial network.

[0045] Existing mainstream GNN models (such as GCN and GAT) mostly adopt fixed neighbor aggregation methods, making it difficult to model both local and global features simultaneously. In addition, in heterogeneous graph scenarios, existing methods often treat different relations equally or simply aggregate them, ignoring the differences in the importance of different relations to the task.

[0046] Existing anomaly detection methods have significant shortcomings in information scale modeling, heterogeneous relationship modeling, and cross-level feature fusion, resulting in problems such as high noise and poor robustness in node representation.

[0047] Graph Convolutional Networks (GCNs) and Graph Attention Networks (GATs) are the mainstream architectures for graph processing. While GNNs have achieved significant success in many graph processing tasks, they struggle to achieve good performance in anomaly detection tasks such as financial fraud.

[0048] The root cause lies in the design flaws of the standard GNN architecture: oversmoothing and filter design issues.

[0049] Oversmoothing Problem: Since the core operation of graph neural networks is neighborhood gathering, it is mathematically equivalent to a smoothing operation. As the number of layers in the neural network increases, it continuously gathers information from more distant neighbors, easily causing the representations of all nodes in the entire network to converge to a similar value. Therefore, in anomaly detection tasks, oversmoothing is a fatal flaw. The key information that distinguishes anomaly nodes from their surrounding normal nodes is easily assimilated in this process, diluting their anomalous features and making it difficult to achieve good results in anomaly detection.

[0050] Filter design issue: In graph signal processing, the standard GCN operation can be viewed as a low-pass filter. The function of a low-pass filter is to retain the low-frequency components of the signal while filtering out the high-frequency components. The low-frequency signals in the graph represent a smooth feature distribution, meaning that the feature representations of adjacent nodes are similar (this is the homogeneity assumption). Most current GNN models are designed based on this assumption. This method of learning features by strengthening the similarity with neighboring nodes ignores the high-frequency signals in the graph, that is, these "non-smooth" entities in the graph.

[0051] In summary, the poor performance of general-purpose GNN models on anomaly detection tasks ultimately stems from their design mechanism, which actively suppresses or filters these crucial high-frequency anomalous signals. Furthermore, while general-purpose GNNs achieve good performance with homogeneous graphs, they fail to perform well with highly heterogeneous graphs where anomalous nodes are often surrounded by numerous normal nodes.

[0052] Real-world graph data challenges extend beyond the design mechanisms of general GNNs. They also stem from heterogeneity and structural noise, creating a complex interplay that places higher demands on anomaly detection models. Real-world applications such as e-commerce, social media, and financial risk control systems typically involve diverse data structures, often composed of multiple types of entities and relationships. For instance, the classic Yelp dataset contains relationships like "merchant-user-merchant" and "merchant-rating-merchant." Treating all relationships equally leads to the loss of rich semantic information. Existing improvements often break down relationships into individual relationships, aggregate them, and then merge them using a fusion module to output anomaly detection results. However, this approach overlooks the potential connections between these relationships; a single anomalous behavior might be the result of multiple relationship patterns working together.

[0053] In anomaly detection tasks, aside from noise issues caused by data collection, anomalous nodes (such as fraudsters in financial systems or fake commenters on social media) actively establish connections with a large number of normal nodes. This method can mask their anomalous characteristics, thereby evading detection. These disguise behaviors introduce structurally misleading information, and general GNN processing is highly sensitive to this structural noise, easily aggregating this false information to neighboring nodes, causing the noise to propagate and amplify continuously as the network depth increases.

[0054] Finally, anomalous nodes and their anomalous patterns often exhibit scale dependence. Within a specific subgraph, some behaviors may appear perfectly normal, but anomalous patterns only become apparent when the scope is broadened to a wider range. For example, a single small transfer may seem normal, but when thousands of such small transfers occur and converge from multiple accounts to a single account, it constitutes a typical pattern of illegal transactions.

[0055] These issues are deeply intertwined, significantly increasing the complexity of anomaly detection tasks. Therefore, a robust graph anomaly detection framework needs to collaboratively address problems across different dimensions to improve the performance of anomaly detection tasks.

[0056] This invention provides a GNN-based financial fraud detection method that can be applied to financial fraud detection in internet scenarios.

[0057] See Figure 1 This is a flowchart illustrating a GNN-based financial fraud detection method provided in an embodiment of the present invention. Figure 1 and Figure 2 As shown, the method mainly includes the following steps:

[0058] Step 1: Construct a heterogeneous financial transaction graph and normalize its node features. The heterogeneous financial transaction graph contains nodes of various entity types and edges of various relationship types.

[0059] Step 2: For each type of relationship in the heterogeneous financial transaction graph, calculate its PPR matrix, and based on this matrix, calculate the multi-scale prior weight vector of each node with its neighboring nodes under different relationship types.

[0060] In practice, the first step is data preprocessing and multi-scale weight pre-computation. For the classic Yelp heterogeneous graph dataset, which contains various node and edge types (such as 'RU-R', 'RS-R', 'RT-R'), self-loops need to be added to the nodes to facilitate the incorporation of their own information during aggregation. After dividing the dataset into training, validation, and test sets, node features are normalized to avoid excessive weighting of certain feature values. Subsequently, parallel PPR calculation is performed, calculating the PPR matrix for each relation type in the graph. elements in This represents the probability of a random walk from node i to node j under relation type r; then, prior weights are calculated for each relation type r and its PPR matrix. For each node v, perform the following operations:

[0061] Extract node v in The corresponding row vector in the relation r reflects the closeness of node v with other nodes under relation r. Then, K-means clustering is used to cluster all neighbors of node v (determined by non-zero PPR values), dividing them into three clusters: near, medium, and far, corresponding to three different scales. Next, the weight of each cluster needs to be calculated, such as the proportion of the total PPR value of all neighbors within each cluster. This yields a scale-prior weight vector for node v and relation r, indicating which neighbor cluster the node is more closely associated with under that relation. In the specific implementation:

[0062] When = 0, the features at this scale are the node's own features after linear transformation. ( );

[0063] When =1, on the subgraph corresponding to relation r, for Perform 1-hop neighbor aggregation to obtain 1-hop neighbor aggregation features. ;

[0064] When =2, Based on this, perform another 1-hop neighbor aggregation to obtain 2-hop features. ;

[0065] …

[0066] When =K-1, we obtain the K-1 hop feature. .

[0067] After obtaining features at k scales, the neighbor node features were divided into three clusters based on the PPR values. Finally, the scale prior weight vector was calculated to reflect the "closeness" of the neighbors between nodes.

[0068] Repeat the above operation for all nodes and relation types, and finally generate an (N,3) tensor (N is the number of nodes), which stores the three prior scale weights of all nodes under a certain relation (such as 'RU-R'). This tensor will be fed into the model as input.

[0069] Step 3: Input the multi-scale prior weight vector and node features into the multi-layer graph neural network model to perform multi-scale information fusion within the relation and generate a multi-scale fused representation of each node under each relation type;

[0070] In practice, a multi-layered GNN model is first constructed. For example, the first layer has an input dimension of the original node features and an output dimension of 64, while the second layer has both an input and output dimension of 64. When a batch of graph data is input into the model, the information will sequentially traverse the intra-relation node layer, the cross-relation category layer, and the network layer. When performing intra-relation multi-scale diffusion, the node representations from the previous layer are received first. As input, K-step diffusion and adaptive attention aggregation are then performed to finally generate a multi-scale representation of the relation. In the specific implementation:

[0071] Since the optimal information scale varies for different nodes and different relationships (e.g., in a fraud ring, the information of a node's distant neighbors may be more important), a weight needs to be calculated for each scale k. ,Right now

[0072] [ ]=Softmax(ScaleAttnNet( )),

[0073] These weights are then summed using a weighted average to obtain the final representation of this relationship that incorporates multi-scale information:

[0074] .

[0075] Step 4: Based on the relational attention mechanism, perform a weighted summation of the multi-scale fusion representation of each node under different relational types to generate the output representation of the node in the current network layer;

[0076] In practice, after processing the multi-scale representations of all relation types, attention weights are calculated from these specific representations and the self-transformation features of the nodes themselves. These representations are then weighted and summed to obtain the output of the h-th layer. In the specific implementation:

[0077] The output of this layer is obtained by performing attention-weighted summation on all relation representations, i.e.

[0078] = .

[0079] Step 5: Based on the hierarchical attention mechanism, the output representations of nodes in different network layers of the multi-layer graph neural network model are weighted and summed to generate the final feature representation of each node;

[0080] In practical implementation, when the output of all layers represents ( , ..., After obtaining all the features, the hierarchical attention weights are calculated together with the original input features that have been projected, and the representations of all levels are weighted and summed to generate the final information representation that integrates multiple levels. In the specific implementation: the final feature is represented as

[0081] = .

[0082] Step 6: Input the final feature representation into the classifier to obtain the probability prediction value of each node being an anomalous node;

[0083] In practice, the final generated The vector is input into a linear classification layer, and a scalar value is obtained representing the probability that the node is an anomaly.

[0084] Step 7: Calculate the loss function using labeled real data, and optimize the parameters of the multilayer graph neural network model and classifier through backpropagation to obtain the target model for detecting the financial data to be detected.

[0085] In practice, the model is trained and optimized using existing labeled real fraud data and normal samples. The predicted fraud probability during the training phase is compared with the real label, and the cross-entropy loss is calculated. Finally, through backpropagation, all hyperparameters in the model are continuously updated and optimized based on the loss value to maximize its identification ability in financial fraud scenarios. Ultimately, a domain-specific financial fraud detection model is obtained to detect the financial data to be detected.

[0086] This invention addresses the shortcomings of existing financial fraud detection methods in terms of multi-scale, heterogeneous relationships, and hierarchical fusion through a three-level hierarchical information extraction architecture. First, it focuses on mining multi-scale signals at the lower level. Then, it selects the relationship channels that are best suited for information representation in the middle layer. Finally, it aggregates the optimal feature abstraction at the top level. This orderly and progressively refined mechanism can maximize the protection and amplification of these hidden abnormal signal features, ultimately improving the robustness of node representation and anomaly detection capabilities. This results in superior detection performance in various complex application scenarios such as financial fraud detection.

[0087] The GNN-based financial fraud detection method provided in this embodiment generates multi-scale node representations based on multi-step diffusion (PPR) and achieves adaptive weighting through a scale attention mechanism. This allows for flexible capture of pattern differences between different nodes at local and non-local scales, enhancing the model's expressive power. The introduction of a relational attention mechanism adaptively identifies the importance of different relations, amplifying the information contribution of key relations and suppressing noise from irrelevant relations, thus improving information utilization efficiency. A hierarchical attention mechanism is designed to weightedly fuse features at different levels of abstraction. This approach balances local details and global patterns, achieving optimal integration of features at multiple levels of abstraction. Information expansion and compression are progressively implemented at three levels. By filtering redundant information layer by layer, the method approximates the "minimum sufficient representation." The learned final information representation not only includes node attribute information and local graph structure information but also embeds the far-end propagation manifestation of information, the importance of relation types, and the importance weights of features at different levels. This fine-grained and comprehensive capture of information enables the model to discover more complex, detailed, and comprehensive node states, ultimately improving the discriminative power of financial fraud detection.

[0088] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof.

[0089] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A GNN-based financial fraud detection method, characterized in that, The method comprises the following steps: Step 1, constructing a financial heterogeneous transaction graph and normalizing the node features of the financial heterogeneous transaction graph, wherein the financial heterogeneous transaction graph comprises nodes of multiple entity types and edges of multiple relationship types; Step 2, for each relationship type in the financial heterogeneous transaction graph, calculating a PPR matrix thereof, and based on the matrix, calculating a multi-scale prior weight vector of each node under different relationship types and neighbor nodes thereof; The step 2 specifically comprises: Step 2.

1. For each relation type r and its corresponding PPR matrix , for each node v, extract the row vector of node v in the matrix ; Step 2.2, based on the PPR values of the non-zero row vectors, using a clustering algorithm to divide the neighbor nodes of the node v into at least three distance clusters corresponding to different information scales; Step 2.3, calculating the proportion of the sum of the PPR values of all neighbor nodes in each distance cluster to the total PPR value of the node v as the prior weight corresponding to the information scale; Step 2.4, forming a multi-scale prior weight vector of all nodes under all relationship types; Step 3, inputting the multi-scale prior weight vector and the node features into a multi-layer graph neural network model to perform multi-scale information fusion within the relationship, and generating a multi-scale fusion representation of each node under each relationship type; The step 3 specifically comprises: Step 3.

1. For each node v, each relation type r and the current network layer h, perform K-step neighbor feature aggregation to obtain node feature representation at K different scales , wherein = 0 is a linear transformation result of the node's own feature, and K-1 indicates the feature after aggregating neighbor node information at a distance of K-1 steps under the relation type r. Step 3.2, input the node feature representation of K scales into a scale attention network, calculate the attention weight of each scale corresponding attention weight ; Step 3.3, the node feature representation of K scales is weighted and summed according to the corresponding attention weight, to obtain a multi-scale fusion representation of node v after fusion of K different scales under the relationship type r ; Step 4, based on a relationship attention mechanism, performing weighted summation on the multi-scale fusion representations of each node under different relationship types to generate an output representation of the node at a current network layer; Step 5, based on a hierarchical attention mechanism, performing weighted summation on the node output representations of different network layers in the multi-layer graph neural network model to generate a final feature representation of each node; Step 6, inputting the final feature representation into a classifier to obtain a probability prediction value of each node being an abnormal node; Step 7, calculating a loss function using labeled real data, and optimizing the parameters of the multi-layer graph neural network model and the classifier through back propagation to obtain a target model for detecting the to-be-detected financial data.

2. The method of claim 1, wherein, The step 4 specifically comprises: Step 4.1, for each node v, input its multi-scale fused representation with K different scales under all relation types r and the transformed features of the node itself into the relation attention network to calculate the attention weight corresponding to each relation type ; Step 4.2, according to the relationship attention weight, performing weighted summation on the multi-scale fusion representations under all relationship types to obtain an output representation of the node v at the hth layer after fusing all relationship types r = ； wherein, represents the total amount of relationship types, self represents the transformation characteristics of the node itself, which means that the input not only contains the multi-scale fusion representation of node v under all relationship types r, but also includes the transformation characteristics of the node itself.

3. The method of claim 2, wherein, The step 5 specifically comprises: Step 5.1, for each node v, input its output representation at all network layers of the multi-layer graph neural network model , …, , and the projected original input features into the input layer of the attention network, compute the attention weights corresponding to each network layer ; Step 5.2, according to the hierarchical attention weight, performing weighted summation on the output representations of all network layers to obtain the final feature representation of the node v = 。

Images