A method and system for dynamic detection of abnormal transactions integrating multi-scale analysis and information entropy

Abstract

This invention discloses a method and system for dynamic detection of abnormal transactions that integrates multi-scale analysis and information entropy. The method includes the following steps: Step S01. Constructing a dynamic heterogeneous graph, including account nodes, device nodes, and IP nodes; Step S02. Extracting node features of each node and the spectral feature matrix of the dynamic heterogeneous graph to form node feature vectors for each node; Step S03. Clustering the dynamic heterogeneous graph to select candidate detection subgraphs, and inputting the node feature vectors of each node in the candidate detection subgraphs into a pre-trained graph classification model to identify the set of abnormal account nodes; Step S04. Calculating the corresponding dynamic risk score in real time based on the memory state vector of each abnormal account node in the time-series graph network and the graph information entropy change rate to assess real-time risk and identify core abnormal accounts. This invention can quickly and accurately identify group-type abnormal transaction accounts and locate core abnormal accounts.

Description

Technical Field

[0001] This invention relates to the field of intelligent transaction monitoring technology, and in particular to a method and system for detecting abnormal transactions that integrates multi-scale analysis and information entropy. Background Technology

[0002] The scale and complexity of current financial transactions are growing exponentially. At the same time, abnormal transaction events such as financial fraud and telecommunications fraud are also on the rise. These abnormal transactions often exhibit characteristics such as large transaction networks and complex and concealed relationships. They evade monitoring by adopting decentralized or hierarchical division of labor models and various disguise strategies. Traditional rule-based risk monitoring systems find it difficult to monitor such complex abnormal transaction events, let alone accurately identify the abnormal transaction account groups involved and the corresponding core accounts.

[0003] For abnormal transaction detection, existing technologies typically employ the following three methods:

[0004] I. Topological Analysis Based on Graph Theory

[0005] This type of approach abstracts financial transactions into a network (accounts as nodes, transactions as edges) and uses graph theory to reveal hidden abnormal account structures and abnormal transaction patterns. For example, community detection algorithms can be used to discover closely connected accounts in a transaction network, and clusters of these accounts can be identified as potential anomalous account groups. However, most traditional graph analysis methods (such as one-time calculations of centrality, degree, and PPR coefficients) are essentially only analyzing static network structures, i.e., static models. Such static models cannot capture minute changes in real time, while current anomalous trading strategies are often dynamically evolving and evade detection by injecting noisy transactions and altering community structures. Static models cannot capture such dynamically evolving malicious behaviors, making it difficult to detect constantly changing malicious transactions such as "quick in and quick out" and "long-term transfers."

[0006] Traditional community detection algorithms often rely on tightly connected network structures. However, current malicious transactions carried out by groups have evolved to be linked through non-topological features such as shared devices and IP addresses. Furthermore, they employ deceptive methods, such as designing highly sparse connections within groups. This makes traditional community detection algorithms ineffective in identifying such activities, or prone to misidentifying normal clustered transactions (such as salary payments by companies or inter-family transfers) as suspicious malicious group activities, resulting in a high false positive rate. Heuristic algorithms, on the other hand, are prone to getting stuck in suboptimal solutions and struggle to detect smaller groups of anomalous transaction accounts.

[0007] II. Behavioral Pattern Analysis Based on Machine Learning

[0008] This type of approach primarily focuses on learning abnormal patterns from account attributes and transaction sequences, which can supplement the shortcomings of relying solely on topological structures to identify abnormal patterns. For example, based on time-series and behavioral analysis, by analyzing features such as timestamps of account activities, transaction amounts, transaction frequencies, linked devices, and IP addresses, potential abnormal transaction behaviors such as clustered account activities, periodic small-amount transfers, and explosive large-amount transfers can be identified.

[0009] However, such approaches often employ a decoupling method of "first calculating topological features, then analyzing behavioral features," which ignores the complex high-order transaction patterns between structure and behavior. For example, an account may have low topological importance indicators, but its behavioral patterns (such as periodic, multiple small transactions late at night) are highly similar to a known remote fraud node in the network structure. This type of risk information is difficult to capture by a simple weighted model, failing to achieve deep fusion of multimodal information such as IP address, device information, account transactions, and time series. Furthermore, the imbalance of abnormal transaction categories and the lack of labels significantly limit the generalization ability of supervised and semi-supervised learning models.

[0010] III. Detection Methods Based on Graph Structure and Graph Feature Learning from Graph Neural Networks (GNNs)

[0011] This type of approach possesses the powerful ability to simultaneously process network topology and node / edge features. GNNs can learn low-dimensional linear relationships in high-dimensional data, thereby identifying complex patterns in large-scale graph structures. This overcomes the cumbersome nature of extensive feature engineering and the inefficiency of structural feature separation in traditional methods. However, existing detection methods based on graph neural networks (GNNs) are typically limited to local network structures. In reality, abnormal group-based trading activities are often cross-platform and cross-institutional, making it impossible for local network structures to track multi-hop funding chains and obtain complete trading activities. Summary of the Invention

[0012] The technical problem to be solved by this invention is: In view of the technical problems existing in the prior art, this invention provides a method and system for dynamic detection of abnormal transactions that integrates multi-scale analysis and information entropy, which is simple to implement, has high recognition accuracy and efficiency, and is highly flexible. It can quickly and accurately identify group-type abnormal trading accounts and dynamically assess trading risks, while accurately locating the core abnormal accounts in the group-type abnormal trading accounts.

[0013] To solve the above-mentioned technical problems, the technical solution proposed by this invention is as follows:

[0014] A method for dynamic detection of abnormal transactions that integrates multi-scale analysis and information entropy, comprising the following steps:

[0015] Step S01. Obtain the original transaction data and construct a dynamic heterogeneous graph G. The nodes in graph G include account nodes, device nodes and IP nodes. The edges in graph G include transaction edges, shared device edges and shared IP edges. The timestamp is used as the attribute of the transaction edge, and the transaction information is used as the weight of the transaction edge. The transaction information includes the transaction amount.

[0016] Step S02. Extract the node features of each node, and extract the spectral feature matrix of the dynamic heterogeneous graph G as the global structural information of the nodes. Supplement the spectral feature matrix into the node features of each node to form the node feature vector of each node.

[0017] Step S03. Abnormal account node set identification: Cluster the dynamic heterogeneous graph G to filter out candidate detection subgraphs, and input the node feature vector of each node in the candidate detection subgraphs into a pre-trained graph classification model to identify the abnormal account node set;

[0018] Step S04. Calculate the real-time risk score of each abnormal account node based on the memory state vector and graph entropy change rate of each abnormal account node in the time-series graph network, in order to assess real-time risk and identify core abnormal account nodes. The time-series graph network is formed by maintaining a memory state vector that evolves over time for each account node. Whenever an account node makes a transaction, the memory state vector of the associated account node is updated, and the graph entropy change rate of the local network of the current account node before and after the current transaction is calculated. The memory state vector includes historical memory state vectors and information about the current transaction.

[0019] Further, in step S02, extracting the spectral feature matrix of the dynamic heterogeneous graph G includes: calculating the normalized Laplacian matrix of the dynamic heterogeneous graph G, decomposing the calculated normalized Laplacian matrix, and taking the eigenvectors corresponding to the first k smallest non-zero eigenvalues ​​to form the spectral feature matrix. .

[0020] Further, in step S02, the node features of each node are extracted, including the node features of account nodes, the node features of device nodes, and the node features of IP nodes. The node features of account nodes include any combination of total number of transactions, total transaction amount, average transaction amount per transaction, transaction frequency during abnormal periods, and number of transaction objects. The node features of device nodes are device node degree centrality, and the node features of IP nodes are IP node degree centrality.

[0021] Furthermore, after step S02 and before step S03, the method also includes: performing graph wavelet feature calculation on the transaction features of each node. During the calculation process, the specified transaction features in each node are used as signals on the graph, and the graph wavelet function is used to decompose the signals. The multi-scale wavelet coefficients decomposed from each node are concatenated with the corresponding node feature vectors to form the enhanced node feature vectors of each node.

[0022] Further, in step S03, inputting the node feature vectors of each node in the candidate detection subgraph into a pre-trained graph classification model to identify the abnormal account node set includes: obtaining the current candidate detection subgraph. For the currently acquired candidate detection subgraph Node representation learning is performed, and pooling operations are applied to the nodes to obtain graph-level vectors. The graph-level vector The input is fed into a pre-trained graph classification model to obtain the predicted candidate detection subgraph. The probability of anomalies is used to determine whether an account node is abnormal.

[0023] Furthermore, in step S04, updating the memory state vector of the associated account node whenever an account node makes a transaction includes:

[0024] The memory state vector of each node is updated using GRU units: =GRU( , (t)), where, It is a node In time The memory state vector, It is a node In the previous time The memory state vector, This represents the information generated by a transaction event that occurs at time t.

[0025] When account node Between in time When transaction m occurs, it is encoded according to the current time. Account Nodes Transaction edge characteristics between and account nodes The previous time node indicates the generation of a new message. ,Right now ,in, This is the message function.

[0026] Further, in step S04, the real-time risk score for each abnormal account node is calculated based on the memory state vector of each abnormal account node in the time-series graph network and the graph information entropy change rate, including:

[0027] The instantaneous embedding vector representation of the target suspicious and abnormal account node is calculated using the following expression: ,in, Indicates account node In time The instantaneous embedding vector representation, GAT For graph attention networks, Represents a node In time The memory state vector, Indicates account node The neighboring nodes;

[0028] The preliminary risk score of the target suspicious and abnormal account node is calculated based on the instantaneous embedding vector representation of the target suspicious and abnormal account node. The calculation expression is as follows: ,in, The weight vector for the risk scoring layer. Represents the predicted account node Real-time risk probability;

[0029] The real-time risk score of the target suspicious and abnormal account node is calculated based on the preliminary risk score and the graph information entropy change rate.

[0030] Furthermore, the calculation expression for the real-time risk score is as follows: ,in, Indicates account node In time Real-time risk score, For normalization function, For account nodes Preliminary risk assessment For account nodes In time The rate of change of graph information entropy in a local network is calculated using the following expression: , where S( ) indicates an account node In time Local subgraph Graph information entropy, Indicates account node In the previous time Local subgraph The graph information entropy.

[0031] Furthermore, the loss function used by the graph classification model during training is: , ,in, and Representing account nodes respectively and account nodes In time The instantaneous embedding vector representation, Indicates account node and account nodes In time The predicted probability of a transaction occurring. This indicates whether a transaction occurred between node i and node j at time t.

[0032] A computer system includes a processor and a memory, the memory being used to store a computer program, and the processor being used to execute the computer program to perform the method described above.

[0033] Compared with the prior art, the advantages of the present invention are as follows:

[0034] 1. This invention constructs a dynamic heterogeneous graph, introducing nodes of various types such as transaction accounts, devices, and IP addresses. At the same time, it constructs edges of various types, including transaction behavior, shared devices, and IP addresses, forming heterogeneous graphs with multiple relationship types such as "account-transaction-account", "account-shared device-account", and "account-IP-account". The graph can be abstracted into a continuously evolving event flow, which is beneficial for capturing dynamically changing abnormal transaction patterns. Compared with homogeneous graphs that rely solely on "account-transaction-account", it can more realistically reflect transaction behavior.

[0035] 2. This invention employs a two-step strategy of "coarse-grained search" and "fine-grained pruning." First, the entire graph of the dynamic heterogeneous graph is clustered to quickly perform preliminary community screening, thereby narrowing the analysis scope by several orders of magnitude. Then, candidate detection subgraphs are treated as independent graph samples, and GNN classification tasks are learned based on graph classification models. This approach fully utilizes the advantages of traditional algorithms' strong scalability while combining the powerful high-dimensional representation learning capabilities of GNNs to analyze the topological structure and behavioral characteristics of subgraphs, thereby quickly and accurately identifying group-type abnormal account transaction patterns and achieving a balance between detection efficiency and accuracy.

[0036] 3. This invention employs a temporal graph network to calculate real-time risk scores, enabling dynamic risk assessment and core account identification. By maintaining a memory state vector that evolves over time for each node, when a transaction involving that account node occurs, the temporal graph network aggregates relevant transaction information and updates the memory state vectors of the involved nodes, achieving an event-driven model. This effectively adapts to the current complex and ever-changing trading environment, enabling real-time capture of potential risk changes caused by new transactions. It also more accurately identifies the risks of each node and subgraph, avoiding the problem of averaged abnormal features caused by the traditional "batch processing" method that relies on static centrality indicators.

[0037] 4. This invention further enhances multi-scale features by combining graph wavelet transforms, treating transaction behavior as signals on a graph. The initial features of nodes are decomposed into multi-scale wavelet coefficients using graph wavelet transforms. The original features and multi-scale wavelet coefficients are then concatenated to form an enhanced node feature vector, which can further improve the identification accuracy of abnormal account groups. Attached Figure Description

[0038] Figure 1 This is a schematic diagram illustrating the implementation process of the abnormal transaction dynamic detection method that integrates multi-scale analysis and information entropy in this embodiment. Detailed Implementation

[0039] The present invention will be further described below with reference to the accompanying drawings and specific preferred embodiments, but this does not limit the scope of protection of the present invention.

[0040] In the processing of financial transaction data, traditional data processing methods often treat the transaction network as a simple, homogeneous, and static graph, resulting in the loss of a large amount of key information and making it unable to adapt to the current dynamic and ever-changing abnormal transaction patterns. This invention constructs a dynamic heterogeneous graph, introducing nodes of various types such as transaction accounts, devices, and IP addresses. It also constructs edges of various types, including transactions, shared devices, and IP addresses, using timestamps as the core attribute of transaction edges and transaction information such as transaction amounts as feature information. In this way, the graph is abstracted as a continuously evolving event stream, rather than a static snapshot, which is beneficial for capturing dynamically changing abnormal transaction patterns. This results in heterogeneous graphs with various relationship types such as "account-transaction-account," "account-shared device-account," and "account-IP-account." Compared to homogeneous graphs that rely solely on "account-transaction-account," these heterogeneous graphs more accurately reflect transaction behavior.

[0041] Meanwhile, considering the computational difficulty of directly running complex GNN models for graph structure discovery and feature learning on large-scale graphs with tens of millions of nodes, and the fact that traditional community detection algorithms, while efficient, suffer from low accuracy and high false positive rates, this invention employs a two-step strategy of "coarse-grained search" and "fine-grained pruning." First, the entire dynamic heterogeneous graph is clustered to quickly perform preliminary community screening, thereby narrowing the analysis scope by several orders of magnitude. Then, each candidate community (candidate detection subgraph) is treated as an independent graph sample, and GNN (Graph Neural Network) classification task is learned based on a graph classification model. This model can learn the difference between group-type abnormal transaction patterns and normal clustered transaction patterns, fully utilizing the advantages of strong scalability of traditional algorithms while combining the powerful high-dimensional representation learning capabilities of GNNs to analyze the topological structure and behavioral characteristics of subgraphs. This allows for rapid and accurate identification of group-type abnormal account transaction patterns, achieving a balance between detection efficiency and accuracy.

[0042] Considering that traditional detection methods relying on static centrality indicators suffer from a lag in identifying core accounts and struggle to respond promptly to dynamic risks, this invention employs a Temporal Graph Network (TGN) to calculate real-time risk scores, enabling dynamic risk assessment and core account identification. The TGN design maintains a memory state vector for each node that evolves over time. This memory state vector stores historical memory state vectors and information about currently occurring transactions. When a transaction involving a node of that account occurs, the TGN aggregates the relevant transaction information and updates the memory state vectors of the involved nodes. This event-driven model effectively adapts to the complex and ever-changing trading environment, enabling real-time capture of potential risk changes caused by new transactions. The dynamic node embedding vectors output by the TGN allow for more accurate identification of the risk of each node and subgraph, avoiding the averaging of anomalous features caused by the "batch processing" approach of traditional methods relying on static centrality indicators.

[0043] In healthy financial transaction networks, behavioral patterns typically exhibit certain regularity and predictability. However, abnormal transactions often construct numerous disordered and complex transaction paths to evade detection, increasing the complexity and uncertainty of the local network structure. This characteristic can be quantified using information entropy theory. This invention, based on the construction of a temporal graph network and combined with the memory state vector maintained by nodes, uses the graph information entropy change rate of the local network (local subgraph entropy increase) as a key feature to calculate real-time risk scores. This allows for accurate assessment of real-time transaction risks and identification of core abnormal accounts within cluster-type abnormal transaction categories.

[0044] For example, Time Series Graph Networks (TGNs) can learn complex composite patterns of "time-structure-behavior". When an account receives funds from a suspicious cluster and then makes multiple small-amount transfers within a short period of time, this pattern can be accurately captured by TGNs. When TGNs update nodes, the above pattern will cause changes in the local network graph information entropy of the node, resulting in an increase in the rate of change of the comprehensive graph information entropy and the real-time risk score calculated from the memory state vector maintained by the node. Therefore, it is possible to accurately identify abnormal transaction groups and locate the core abnormal accounts within them.

[0045] In summary, this invention integrates multi-scale analysis and information entropy to dynamically detect abnormal transactions. It can uncover the characteristics of group-based abnormal transaction patterns from three dimensions: global structure, multi-scale behavior, and system instability. It effectively captures the constantly changing transaction patterns and organizational structures of group-based abnormal transaction groups, accurately identifies complex intelligent abnormal transaction patterns with "structure-behavior" interactions, quantifies potential risks, and ultimately accurately locates the core abnormal accounts hidden in the transaction network. This solves the problem of balancing detection accuracy and efficiency in traditional financial anti-fraud solutions when dealing with dynamically evolving, multi-scale, and highly concealed group-based abnormal transactions.

[0046] The present invention will be further described below with reference to specific embodiments.

[0047] like Figure 1 As shown, the steps of the abnormal transaction dynamic detection method integrating multi-scale analysis and information entropy in this embodiment include:

[0048] Step S01. Dynamic Heterogeneous Graph Construction: Obtain the original transaction data and construct a dynamic heterogeneous graph G. The nodes in graph G include account nodes, device nodes, and IP nodes. The edges in graph G include transaction edges, shared device edges, and shared IP edges. The timestamp is used as the weight of the transaction edge, and the transaction information is used as the weight of the transaction edge. The transaction information includes the transaction amount, etc.

[0049] This embodiment constructs a dynamic heterogeneous graph based on multi-source transaction data, unifying the scattered user (account, device information) and transaction flow data into a dynamic heterogeneous graph containing nodes such as "account", "IP", and "device" as well as edges such as "transaction", "shared IP", and "shared device". Timestamps and transaction amounts are used as edge weight information, which can effectively characterize the abnormal group transaction pattern of collaborative transactions using shared resources.

[0050] Specifically, after obtaining the raw transaction data, the tabular data is transformed into a graph structure. For the node set V:

[0051] V= ,in, Represents a set of account nodes. For a set of device nodes, Represents the set of IP nodes. For the edge set E: E = ,in The set of edges representing transaction relationships. The set of edges representing relationships between shared devices. For the set of edges representing shared IP relationships, when account When a transaction of amount m occurs at time t, a directed edge is created, i.e.: e = ( ), account and equipment Construct an undirected edge, i.e.: e = ( )

[0052] ; account Shared IP address Construct an undirected edge, i.e.: e = ( Finally, we can obtain a dynamic heterogeneous graph G=(V,E) that includes the relationships between account nodes, device nodes and IP nodes, transaction edges, shared device edges and shared IP edges.

[0053] Understandably, more node types and edge relationships can be introduced based on actual needs.

[0054] Step S02. Node feature extraction: Extract the node features of each node, and extract the spectral feature matrix of the dynamic heterogeneous graph G as the global structural information of the nodes. Supplement the spectral feature matrix into the node features of each node to form the node feature vector of each node.

[0055] In this embodiment, the spectral feature matrix of the dynamic heterogeneous graph G is extracted and used as a priori global structural information to supplement the initial features of the nodes. This allows each node to be given a "global perspective" before the GNN model starts learning, so that the GNN message passing mechanism is biased towards local information.

[0056] As an optional implementation, extracting the spectral feature matrix of the dynamic heterogeneous graph G includes:

[0057] Step S211. Calculate the normalized Laplacian matrix of the dynamic heterogeneous graph G, for example, the expression is:

[0058] (1)

[0059] Step S212. Decompose the calculated normalized Laplacian matrix and take the eigenvectors corresponding to the first k smallest non-zero eigenvalues ​​to form the spectral feature matrix. ,in This represents the total number of nodes in graph G.

[0060] In specific application embodiments, the node features extracted for each node include those for account nodes, device nodes, and IP nodes. Account node features include total transaction count, total transaction amount, average transaction amount per transaction, transaction frequency during abnormal periods, and number of transaction objects. Device node features are defined as device node degree centrality, and IP node features are defined as IP node degree centrality. Centrality measures can quantify the importance of an account in a multi-layered network, facilitating the identification of key nodes within the network.

[0061] Specifically, the sum of all transactions in which account i participates as either the initiator or the recipient is f1 = The cumulative value of all transactions involving account i, f2 = Average transaction amount Nighttime trading frequency The number of trading partners f5 = |{j| The node feature vector of the account node is obtained by forming a feature vector composed of '>0' and '>0'. ,Right now: Based on the characteristics of devices and IP nodes, calculate the degree centrality of device nodes. =| |, IP node degree centrality =deg( )=| |. Among them This represents the transaction records between account i and account j, where count is the total number of transactions, amount is the total transaction amount, and time is the time value. "Night" refers to transactions whose timestamps fall during the night. >0 indicates that there is at least one transaction between account i and account j; deg represents degree centrality. This represents the k-th device node in the graph. This represents any account node in the graph. Indicates account With equipment There exists an edge between them, and the degree centrality of the device nodes is... Used to count how many different accounts used the same device. ; This represents the h-th IP node in the graph, and the degree centrality of the IP node. This is used to count how many different accounts logged in from the same IP address.

[0062] As an optional implementation, the node feature extraction process also includes: analyzing the transaction characteristics of each node (e.g., total transaction amount). Graph wavelet feature calculation is performed, where the transaction features of each node are treated as signals s on the graph, and graph wavelet functions are used. The signal s is decomposed into a "low-frequency" component reflecting long-term trends and a "high-frequency" component reflecting short-term abrupt changes, namely: ,in These are wavelet coefficients at different scales; the multi-scale wavelet coefficients decomposed from each node are concatenated with their corresponding node feature vectors to form the enhanced node feature vectors output for each node, i.e., the node feature vectors... Spectral feature matrix and multi-scale wavelet coefficients The final node feature vector is obtained by concatenating the features. =CONCAT( ).

[0063] Traditional graph analysis often focuses on the local connectivity of nodes, while spectral domain analysis can reveal the global and intrinsic structural features of a graph. Graph wavelet technology can decompose signals on a graph at different scales, enabling the capture of both macroscopic trading network patterns and locally abrupt trading patterns. This embodiment enhances features at multiple scales by combining graph wavelet transforms. Trading behavior is treated as signals on the graph. The initial features of nodes (such as trading frequency and amount) are decomposed into low-frequency coefficients (representing stable, long-term behavior patterns) and high-frequency coefficients (representing sudden, short-term behavior patterns) using graph wavelet transform. The original features are then concatenated with the multi-scale wavelet coefficients to form an enhanced node feature vector, which can further improve the accuracy of identifying clusters of abnormal accounts.

[0064] Step S03. Abnormal account node set identification: Cluster the dynamic heterogeneous graph G to filter out candidate detection subgraphs, input the node feature vectors of each node in the candidate detection subgraphs into the pre-trained graph classification model, and identify the abnormal account node set.

[0065] This embodiment uses a hierarchical filtering approach to identify abnormal account node sets. First, a clustering method is used to quickly scan the global dynamic heterogeneous graph to generate candidate detection subgraphs (communities). Then, according to step S02, spectral features are calculated on the candidate detection subgraphs to obtain global spectral information. The node feature vector formed by concatenating the global spectral information with the node representations of the initial node features and multi-scale wavelet features is input into a trained GNN graph classification model for fine-grained identification and pruning operations to fully analyze the internal operating patterns of the candidate detection subgraphs (such as pyramid structures or the cyclical flow of funds). Finally, a set of abnormal account nodes with high confidence (abnormal account groups) is selected.

[0066] As an alternative implementation, during the coarse-grained screening of the abnormal account node set, an efficient parallelized label propagation algorithm can be used to cluster the graph G:

[0067] (2)

[0068] in, This represents the label of node v at the (t+1)th iteration. These are the labels used to find the maximum weighted sum. This is calculated by summing the sums of all nodes u in the neighbor set N(v) of node v, and then multiplying the sum by the weight of the edge between nodes u and v. , It is an indicator function, meaning that the function value is 1 only when the label of the neighbor u in round t is c.

[0069] Furthermore, communities that are too small can be removed using custom rules, for example: |C|< At that time, community C was discarded; communities with edges that share devices and IPs need to be retained at all times, resulting in a series of candidate detection subgraph sets, namely { }

[0070] As an optional implementation, the enhanced node feature vectors of each node in the candidate detection subgraph are input into a pre-trained graph classification model to identify the set of abnormal account nodes, including: obtaining the current candidate detection subgraph. For the currently acquired candidate detection subgraph Node representation learning is performed, and pooling operations are applied to the nodes to obtain graph-level vectors. , graph-level vector The input is fed into a pre-trained graph classification model to obtain the predicted candidate detection subgraph. The probability of anomalies is used to determine whether an account node is abnormal.

[0071] Specifically, obtain the current candidate detection subgraph. First, a candidate detection subgraph sampling operation is performed, sampling all candidate detection subgraphs. Extract its corresponding induced subgraph A induced subgraph is a graph that retains all edges in the original graph within a subset. Using induced subgraphs for analysis can help analyze the topological features inside the subgraph and also remove noise from irrelevant external nodes.

[0072] Specifically, for the currently acquired candidate detection subgraph The expression for learning node representations is:

[0073] (3)

[0074] Where v represents the currently focused node, i.e. the current index, and l is used to represent the layer number (from 1 to L). These are the initial input features. The representation (output vector) of node v at layer l. Let l be the output dimension of the l-th layer. N(v) is the output dimension of the previous layer, and N(v) is the set of neighbors of node v (separated according to relation type in heterogeneous graphs). It is a neighbor feature aggregation function. The function is used to concatenate the node's own features with the aggregated features of its neighbors to form a joint feature representation. Let be the learnable linear transformation matrix (weights) of the l-th layer. ReLU is used as the final nonlinear activation function.

[0075] Then, pooling is performed on the nodes within the subgraph, i.e. Where C represents the set of nodes (subgraph nodes) of the candidate group, POOL{ } Indicates all pairs within the subgraph Attention pooling is performed on all of them to obtain graph-level vectors. Finally, a classification operation is performed, whereby the graph-level embedding representation is input into a classifier:

[0076] (4)

[0077] in, Representation of a graph level (usually) = ), b As a bias term, Using sigmoid output activation transforms the linear relationship into a probability [0,1]. This indicates the probability that the set of nodes for this account is an anomaly.

[0078] Specifically, the loss function for graph classification models can be binary cross-entropy, i.e.:

[0079] (5)

[0080] Among them, the label [0,1], and finally output the anomaly probability of each candidate account node.

[0081] Step S04. Account Dynamic Risk Assessment: Calculate the real-time risk score of each abnormal account node based on the memory state vector and graph entropy change rate of each abnormal account node in the temporal graph network (TGN) to assess real-time risk and identify core abnormal account nodes. The temporal graph network is formed by maintaining a memory state vector that evolves over time for each account node. Whenever an account node makes a transaction, the memory state vector of the associated account node is updated, and the graph entropy change rate of the local network of the current account node before and after the current transaction is calculated. The memory state vector includes historical memory state vectors and information about the currently occurring transaction.

[0082] In this embodiment, a memory state vector that evolves over time is constructed for each account node. When a new transaction occurs, TGN can update the memory state vector of the relevant account node in a timely manner based on the node and edge information involved in the transaction. Simultaneously, it calculates the rate of change of graph entropy of the local network of the relevant account node before and after the transaction event. This rate of change represents the rate of change of the "disorder" or "uncertainty" of the local network structure. Combining the memory state vector with the rate of change of graph entropy of the local network, a real-time risk score is obtained to achieve dynamic risk assessment. By learning the temporal information in the transaction network and the rate of increase of entropy in the local network, subtle changes in account behavior patterns can be dynamically captured. The impact of these changes during network transmission can accurately identify core accounts that play the roles of "fund transfer hub" and "fund collection" in different patterns. By combining the dynamic risk assessment method of temporal graph networks and information entropy, the lag and "batch processing" problems of traditional solutions in dynamic risk capture can also be solved.

[0083] As an optional implementation, updating the memory state vector of the associated account node whenever an account node makes a transaction includes:

[0084] The memory state vector of each node is updated using GRU units: =GRU( , (t)), where, For nodes In time The memory state vector, It is a node In the previous time The memory state vector, This represents the information generated by a transaction event that occurs at time t.

[0085] When account node Between in time When transaction m occurs, it is encoded according to the current time. Account Nodes Transaction edge characteristics between and account nodes The previous time node indicates the generation of a new message. ,Right now:

[0086] (6)

[0087] in, The message function has a structure consisting of two fully connected layers and a ReLU layer. The input to this function is a concatenated vector.

[0088] Specifically, a memory module is constructed to maintain a memory state vector for each node. According to the GRU unit =GRU( , (t) is updated, and new information is generated whenever a transaction occurs, for example when A new message is generated when transaction m occurs at time t. Transaction edge characteristics Can be time-coded Edge features The edges are formed by splicing together, where the edge features are the normalized values ​​of the transaction amounts, i.e. =log(1+m), time encoding The following four-dimensional vector can be used:

[0089] (7)

[0090] Where t is the original timestamp, hour(t) is used to extract the hour (values ​​0, 1, 2, ..., 23), and weekday(t) is used to extract the day of the week (values ​​0, 1, ..., 6). The designed sine and cosine functions are used to generate two dimensions to encode a periodic quantity, mapping discrete values ​​to a continuous space, making it easier for the subsequent neural network to learn the final value obtained from time x. It is a four-dimensional vector.

[0091] As an optional implementation, the real-time risk score for each anomalous account node is calculated based on the memory state vector of each anomalous account node in the time-series graph network and the graph information entropy change rate, including:

[0092] Step S401. Calculate the instantaneous embedding vector representation of the target suspicious and abnormal account node. This can be calculated using the neighbor aggregation method, and the calculation expression is as follows:

[0093] (8)

[0094] in, Indicates account node In time The instantaneous embedding vector representation, GAT To create a graph attention network for weighted aggregation of neighbor information. For nodes In time The memory state vector, maintained by the GRU unit of the TGN, records the historical interaction trajectory of the nodes. Represents a node In time The memory state vector, Indicates account node The neighboring nodes;

[0095] Step S402. Calculate the preliminary risk score of the target suspicious and abnormal account node based on its instantaneous embedding vector representation. The calculation expression is as follows:

[0096] (9)

[0097] in, The weight vector for the risk scoring layer. Represents the predicted account node Real-time risk probability;

[0098] Step S403. Calculate the real-time risk score of the target suspicious and abnormal account node based on the preliminary risk score and the graph information entropy change rate.

[0099] As an optional implementation method, the calculation expression for real-time risk scoring is:

[0100] (10)

[0101] in, Indicates account node In time Real-time risk score, This is a normalization function (for example, the Sigmoid function can be used). For account nodes Preliminary risk assessment For account nodes In time The rate of change of graph information entropy in a local network is calculated using the following expression:

[0102] (11)

[0103] Among them, S( ) indicates an account node In time Local subgraph Graph information entropy, Indicates account node In the previous time Local subgraph The graph information entropy.

[0104] As shown in Equation (10), the real-time risk score is composed of two weighted parts: one part is the risk probability generated by the TGN embedding vector (memory state vector), and the other part is proportional to the rate of change of graph information entropy of the local network caused by the current node.

[0105] As an optional implementation, the loss function used by the graph classification model during training is: , ,in, and Representing account nodes respectively and account nodes In time The instantaneous embedding vector representation, This represents the inner product operation between two vectors. Indicates account node and account nodes In time The predicted probability of a transaction occurring. Indicates the true label ( When =1, it indicates that a transaction occurred between node i and node j at time t. =0 indicates that no transaction occurred between node i and node j at time t, where i and j represent two account nodes in the transaction graph, i being the source node and j being the target node. The trained classification model can then generate real-time account node risk scores.

[0106] In a specific application embodiment, multiple shell accounts A1, A2, A3, A4, and A5 controlled by group X are all registered using the same device D1 and the same IP address P1. These accounts engage in frequent fund transfers, with the vast majority of amounts controlled between 9800-9900 yuan to evade large-amount monitoring. A4 also has normal transactions with four legitimate accounts B1, B2, B3, and B4. The method of this invention is applied to achieve dynamic detection of the aforementioned group-type abnormal transactions. To further illustrate this invention, the detailed steps are as follows:

[0107] Step S01. Construct a dynamic heterogeneous graph, with nodes V={A1,A2,A3,A4,A5,D1,P1,B1,B2,B3,B4}. Edges include transaction edges (e.g., A1->A2, amount=9800, time t is 12:00 AM), shared device edges, and shared IP edges (e.g., A1-D1, A2-D1, A1-P1, A2-P1), thus explicitly displaying the association information of "account-device-IP-transaction". This constructs a dynamic heterogeneous graph containing the above 11 nodes and all relationships.

[0108] Step S02. Feature Extraction for Enhancement: Calculate the Laplacian matrix L of the dynamic heterogeneous graph, and perform eigenvalue decomposition on L to extract the eigenvectors corresponding to the k smallest non-zero eigenvalues ​​(k=5), thus constructing the spectral feature matrix. And extract account node features: f1(A1) = 100 (i.e., number of transactions), f2(A1) = 9850 100 (total transaction amount), f3(A1) = 9850 (average transaction amount per transaction), f4(A1) = 0.8 (high proportion of nighttime transactions), f5(A1) = 8 (number of transaction partners); Edge characteristics: =log(9850) For timestamp conversion: sin and cosine encoding are used to determine that most transactions are concentrated between 2-4 AM, ensuring that all behavioral patterns within the group are quantified for input into subsequent models. Then, the total transaction amount of all account nodes is calculated. As a signal defined on graph G, by applying graph wavelet transform The signal is decomposed into coefficients of different scales, and finally the node feature vector representation of each node can be obtained. The "quick in and quick out" behavior between accounts A1-A5 is manifested as drastic, local, and rapid changes in the graph signal, so the corresponding graph wavelet high-frequency coefficients will be very significant, while the normal transactions between A4 and B1-B4 are more stable, and their high-frequency coefficients are relatively low.

[0109] Step S03. Identification of abnormal account node sets; application of parallel LPA computation. The results showed that {A1, A2, A3, A4, A5} clustered into a subgraph (community). Through rule filtering, |C|=5>θ=3, and the existence of shared devices / IPs, this community was retained as a set of potential anomalous account nodes. The subgraph was then input into a GNN model, and finally, classification values ​​were obtained. c. This step can filter out ordinary friend groups and family account groups, and can identify that the nodes of this subgraph generally have strong high-frequency signal components, showing strong fluctuations in funds, and finally accurately identify high-risk groups with abnormal structures.

[0110] Step S04. Dynamic risk scoring; update the time series network. Specifically, when A1->A2, m=9850, t=2:30AM, then calculate: , =GRU( , (t)), thereby dynamically capturing the latest transaction information of the account and discovering that A1 continues to engage in high-frequency trading at night; aggregated neighbor memory calculation: Then calculate the risk score, that is: Simultaneously, obtain the local network of A1 before the event occurs. And calculate its graph entropy S( When a new transaction A1->A2 occurs at 2:30 AM, this new directed edge is added to the local subgraph, forming a new subgraph. The graph entropy is recalculated, and the two signals are then weighted and fused to obtain a real-time risk score. The results show that the risk score of A1 will rise sharply, and the risk control system will be given a timely warning accordingly.

[0111] This embodiment also provides a computer system, including a processor and a memory. The memory is used to store computer programs, and the processor is used to execute the computer programs to perform the abnormal transaction dynamic detection method that integrates multi-scale analysis and information entropy as described above.

[0112] Those skilled in the art will understand that the above embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0113] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the invention. Therefore, any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention should fall within the protection scope of the present invention.

Claims

1. A method of detecting abnormal transaction dynamics by fusing multiscale analysis and information entropy, characterized by the steps of Comprising: Step S01. Obtain original transaction data and construct a dynamic heterogeneous graph G, the nodes in the graph G including account nodes, device nodes and IP nodes, the edges in the graph G including transaction edges, shared device edges and shared IP edges, the timestamp being taken as the attribute of the transaction edge, and the transaction information being taken as the weight of the transaction edge, the transaction information including the transaction amount; Step S02. Extracting node features of each node, and extracting a spectral feature matrix of the dynamic heterogeneous graph G as global structure information of the nodes, and supplementing the spectral feature matrix to the node features of each node to form a node feature vector of each node, wherein the node features of each node include node features of an account node, node features of a device node, and node features of an IP node, the node features of the account node include any one or more of total transaction times, total transaction amount, average transaction amount per time, transaction frequency in an abnormal period, and transaction object quantity, the node features of the device node are device node degree centrality, and the node features of the IP node are IP node degree centrality, and the spectral feature matrix of the dynamic heterogeneous graph G includes: calculating a normalized Laplacian matrix of the dynamic heterogeneous graph G, decomposing the calculated normalized Laplacian matrix, and taking the eigenvectors corresponding to the first k minimum non-zero eigenvalues to form a spectral feature matrix ; Step S03. Abnormal account node set identification: clustering the dynamic heterogeneous graph G to screen out a candidate detection subgraph, inputting the node feature vector of each node in the candidate detection subgraph into a pre-trained graph classification model to identify an abnormal account node set; Step S04. Calculating the real-time risk score of each abnormal account node according to the memory state vector of each abnormal account node in the time sequence graph network and the graph information entropy change rate to evaluate the real-time risk and identify a core abnormal account node, the time sequence graph network being formed by maintaining a memory state vector evolving over time for each account node, wherein the memory state vector of the associated account node is updated each time a transaction occurs, and the graph information entropy change rate of the local network of the current account node before and after the current transaction is calculated, the memory state vector including the historical memory state vector and the information of the transaction currently occurring.

2. The method of claim 1, wherein the method comprises: After step S02 and before step S03, it further includes: performing graph wavelet feature calculation on the transaction features of each node, in the calculation process, taking the specified transaction features in each node as signals on the graph, and adopting a graph wavelet function to decompose the signals, and splicing the multi-scale wavelet coefficients decomposed from each node with the node feature vector respectively to form an enhanced node feature vector of each node.

3. The method of claim 1, wherein the method comprises: In step S03, the node feature vectors of the nodes in the candidate detection subgraph are input into the pre-trained graph classification model, and the abnormal account node set is identified by: acquiring the current candidate detection subgraph , performing node representation learning on the current candidate detection subgraph , performing a pooling operation on the nodes to obtain a graph-level vector , inputting the graph-level vector into the pre-trained graph classification model to obtain a predicted abnormal probability of the current candidate detection subgraph , so as to determine whether it is an abnormal account node.

4. The method according to any one of claims 1-3, wherein, In step S04, updating the memory state vector of the associated account node each time a transaction occurs includes: The memory state vector of each node is updated by a GRU unit: = GRU( , (t)), wherein is the memory state vector of node at time t, is the memory state vector of node at the previous time t-1, denotes the information representation generated by the transaction event occurring at time t;​ When a transaction m occurs between account nodes at time t, a new message is generated according to the current time encoding , the transaction edge features between account nodes , and the last time of the account nodes , i.e. where , is the message function. · is the message function.

5. The method of claim 4, wherein the method further comprises: In step S04, calculating the real-time risk score of each abnormal account node according to the memory state vector of each abnormal account node in the time sequence graph network and the graph information entropy change rate includes: computing a temporal embedding vector representation of a target suspicious abnormal account node, the expression is: wherein, represents an account node at time , a temporal embedding vector representation of, GAT is a graph attention network, represents a node at time , a memory state vector of, represents a neighbor node of an account node ; According to the instantaneous embedding vector representation of the target suspicious abnormal account node, a preliminary risk score of the target suspicious abnormal account node is calculated, and the calculation expression is: , wherein, is a weight vector of a risk score layer, represents a real-time risk probability of a predicted account node . According to the preliminary risk score and the graph information entropy change rate, the real-time risk score of the target suspicious abnormal account node is calculated.

6. The method of claim 5, wherein the method further comprises: The calculation expression of the real-time risk score is: wherein, represents the account node At time The real-time risk score of the account node, is a normalization function, is a preliminary risk score of the account node At time is a local network graph information entropy change rate of the account node At time The calculation expression is: wherein, S( ) represents the graph information entropy of the local subgraph of the account node At time is the graph information entropy of the local subgraph of the account node At the previous time is the graph information entropy of the local subgraph of the account node.

7. The method of claim 1-3, wherein the method further comprises: The loss function used by the graph classification model in the training process is: , , , , respectively, represent the instantaneous embedding vector representation of the account node and the account node at time , , respectively, represent the predicted probability of the account node and the account node occurring a transaction at time , , represents the true label of whether a transaction has occurred between the nodes i and j at time t.

8. A computer system comprising a processor and a memory for storing a computer program, characterised in that, The processor is configured to execute the computer program to perform the method according to any one of claims 1-7.

Images