Fraud detection method of camouflage perception graph neural network based on feature and structure space decoupling

Abstract

The invention belongs to the technical field of financial fraud detection, and particularly relates to a fraud detection method of a camouflage perception graph neural network based on feature and structure space decoupling, which comprises the following steps: firstly, constructing an FS-DGAN model consisting of a feature camouflage detection module and a structure camouflage detection module; performing local subgraph motif analysis and global distribution comparison through a structure camouflage detection module, and outputting a structure camouflage score of the node; performing feature masking disturbance and sensitivity analysis through a feature camouflage detection module, and outputting a feature camouflage score of the node; and finally, fusing the two types of camouflage scores, and injecting a camouflage perception attention mechanism to dynamically adjust a neighbor weight so as to inhibit the interference of suspicious nodes on representation learning. On the basis, the camouflage detection modules are respectively constructed in the feature space and the structure space, so that the camouflage behaviors of the nodes under different information dimensions can be accurately described, and complex camouflage fraud nodes which not only counterfeit features but also manipulate a relation structure can be effectively identified.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of financial fraud detection, in particular to a fraud detection method based on a feature and structure space decoupling camouflage perception graph neural network. BACKGROUND

[0002] Fraud detection has important engineering and social value in financial risk control, e-commerce, social networks and other application scenarios. Its detection results are directly related to user property safety, platform reputation and regulatory compliance, so high requirements are placed on the accuracy, robustness and explainability of the detection method. However, the fraud detection task itself has multiple technical challenges: there is a serious class imbalance and label scarcity in the data, the observed data is noisy and dynamically evolving, the entity and interaction relationship types are complex and heterogeneous, and the fraudsters have concealment and adaptability. Existing research has explored these challenges from different angles, such as PC-GNN / CLFS-GNN for class imbalance, Semi-GNN for label scarcity, GraphConsis / PTDNet for noise and robustness, and GraphSAGE for large-scale graphs. However, in terms of dealing with cross-space camouflage behavior, a more complex attack paradigm, research is still relatively limited. Existing works such as CARE-GNN and RGTAN have proposed and focused on camouflage-related issues, but there are still several defects and blind spots that have not been fully addressed.

[0003] Cross-space camouflage refers to the fact that fraudsters both tamper with or mask the attributes of objects, making them closer to normal samples in feature distribution, and manipulate connection relationships in network structure to reduce topological-based abnormal signals. This dual camouflage brings two key technical problems: first, representation bias, which means that after multiple rounds of aggregation, the graph neural network (GNN) that integrates features and neighbor information may pull the representation of the camouflage node towards the normal class, reducing the discrimination ability; second, information pollution, which means that the neighbors and local subgraphs affected by the camouflage node will be misled, thereby propagating error signals and increasing the risk of false positives or false negatives.

[0004] Current research on camouflage detection or robust graph learning has several typical limitations:

[0005] (1) Single-space limitation: Many methods only focus on the feature space or the structure space, without systematically decoupling and jointly modeling the two types of signals.

[0006] (2) Consistency assumption: Some work implicitly or explicitly assumes consistency and reliability between features and topology, which is not true when there is cross-space camouflage.

[0007] (3) Lack of node-level suspiciousness metrics: Existing methods usually fail to quantify the suspiciousness of each node in both feature and structure spaces, thus failing to achieve targeted neighbor suppression or differential treatment.

[0008] (4) Lack of adaptability in fusion methods: Even a few works that attempt to fuse multi-source information rely on fixed rules or manual thresholds, lacking a learnable weight mechanism to adapt to different nodes' heterogeneous camouflage strategies.

[0009] Therefore, the invention provides a fraud detection method based on a camouflage-aware graph neural network decoupled in feature and structure spaces, which can measure and quantify node suspiciousness in both feature and structure paths, adaptively fuse cross-space signals in a learnable manner, and use the fusion results to modulate the neighbor information aggregation of the graph model to suppress the pollution effect. SUMMARY

[0010] To solve the above technical problems, the present application provides the following technical solutions:

[0011] A fraud detection method based on a camouflage-aware graph neural network decoupled in feature and structure spaces, comprising the following specific steps:

[0012] S1: Constructing an FS-DGAN (Feature-Structure Decoupled Graph Attention Network) model composed of a feature camouflage detection module (FCD) and a structure camouflage detection module (SCD);

[0013] S2: Performing local subgraph motif analysis and global distribution comparison through the structure camouflage detection module to output the structure camouflage score of the node;

[0014] S3: Performing feature masking perturbation and sensitivity analysis through the feature camouflage detection module to output the feature camouflage score of the node;

[0015] S4: Fusing the two types of camouflage scores and injecting a camouflage-aware attention mechanism (CAA) to dynamically adjust the neighbor weight, thereby suppressing the interference of suspicious nodes on representation learning and improving the robustness and generalization ability of the model in complex camouflage scenarios.

[0016] As a preferred scheme of the fraud detection method based on a camouflage-aware graph neural network decoupled in feature and structure spaces, the specific steps of the structure camouflage detection module are as follows:

[0017] S21: For the adjacency matrix of the transaction graph, count the motif mode distribution of each node in the local subgraph;

[0018] S22: Calculate the deviation of the motif distribution of part of the nodes from the global average distribution using random sampling;

[0019] S23: Obtain the structure camouflage score of each sampled node based on the standardized Z-score;

[0020] S24: The unsampled nodes use neighbor approximation interpolation to obtain the camouflage score.

[0021] As a preferred scheme of the fraud detection method of the camouflage-aware graph neural network based on decoupling of feature and structure space, wherein the specific steps of the feature camouflage detection module are as follows:

[0022] In order to effectively identify the fraud behaviors that may lack connection patterns in the graph structure, but have extremely high suspicious consistency or non-essentiality in the attribute level, a feature space camouflage detection module (FCD) is designed to characterize the classification sensitivity of nodes under feature perturbation, and generate a camouflage score accordingly;

[0023] S31: Construct multiple sets of feature masking schemes to ensure that the influence of node features on prediction results is evaluated under different masking scenarios;

[0024] S32: Predict the probability distribution under perturbation, and use a lightweight built-in classifier to predict the original features and each set of masked features, respectively. The prediction probability reflects the influence degree of each feature missing on model decision;

[0025] S33: KL divergence measures perturbation sensitivity, and uses Kullback-Leibler (KL) divergence to measure the change degree of the prediction distribution before and after masking perturbation;

[0026] S34: Weighted fusion of sensitivity indicators under all masking strategies, considering the influence of masking proportion on perturbation amplitude, to calculate the final feature camouflage score (Feature Camouflage Score).

[0027] As a preferred scheme of the fraud detection method of the camouflage-aware graph neural network based on decoupling of feature and structure space, wherein the specific steps of S4 are as follows:

[0028] S41: Input the feature camouflage score and the structure camouflage score into the fusion layer to perform fusion through a weighted fusion function with trainable parameters;

[0029] S42: On the basis of a traditional graph attention network (GAT), a fusion camouflage score is introduced for attention modulation, realizing the suppression of suspicious neighbors, and for each pair of center nodes and neighbor nodes , an attention coefficient is calculated.

[0030] As a preferred scheme of the fraud detection method of the camouflage perception graph neural network based on feature and structure space decoupling, wherein: the weighted fusion function is:

[0031]

[0032] Wherein is the feature camouflage score, is the structure camouflage score, and is the node-level learnable weight; in the learning process, the model automatically adjusts the dependence ratio of different nodes on the two types of camouflage signals, thereby adaptively depicting various camouflage behavior patterns; the fusion camouflage score output by the function will be an important modulation factor for the subsequent graph attention mechanism.

[0033] As a preferred scheme of the fraud detection method of the camouflage perception graph neural network based on feature and structure space decoupling, wherein: the calculation formula of the attention coefficient is:

[0034]

[0035] Wherein is the fusion camouflage score of the neighbor node, is the modulation coefficient; is the original neighbor attention weight, and the camouflage perception attention weight obtained by softmax regularization is used for neighbor feature aggregation.

[0036] Compared with the prior art:

[0037] 1. Strong multi-space camouflage identification capability: the present application has the advantages of realizing accurate description of the camouflage behavior of nodes in different information dimensions by constructing a camouflage detection module in the feature space and the structure space, and being capable of effectively identifying complex camouflage fraud nodes that both fake features and manipulate relationship structures.

[0038] 2. Decoupled modeling of features and structures to reduce information interference: the present application has the advantages of realizing reduction of representation bias and feature pollution caused by cross-space camouflage through decoupled learning of the feature space and the structure space.

[0039] 3. Adaptive attention mechanism of fusion camouflage score: the application fuses feature camouflage score and structure camouflage score into attention mechanism, and realizes dynamic adjustment of weight through learnable weight factor, so as to suppress the interference of suspicious neighbor information and improve the model robustness.

[0040] 4. Generalization and robustness enhancement for complex fraud scenarios: the application can significantly improve the detection accuracy of complex camouflage nodes in different fraud scenarios, and shows excellent generalization ability and anti-camouflage ability. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 is the FS-DGAN model framework diagram of the application;

[0042] Figure 2 is the ablation experiment result diagram of the FS-DGAN of the application on the YelpChi (left), Amazon (middle) and FFSD (right) data sets;

[0043] Figure 3 is the hyperparameter analysis diagram of the FS-DGAN of the application on the YelpChi data set (left) and (right);

[0044] Figure 4 is the fraud detection performance comparison diagram of different methods of the application on the YelpChi, Amazon and FFSD data sets. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical scheme and advantages of the application clearer, the embodiments of the application will be further described in detail below with reference to the drawings.

[0046] The application provides a fraud detection method based on feature and structure space decoupled camouflage perception graph neural network, please refer to Figures 1-4 , including the specific steps as follows:

[0047] S1: constructing an FS-DGAN (Feature-Structure Decoupled Graph Attention Network, FS-DGAN) model composed of a feature camouflage detection module (Feature Camouflage Detection Module, FCD) and a structure camouflage detection module (Structure Camouflage Detection Module, SCD);

[0048] S2: Local subgraph motif analysis and global distribution comparison by structure camouflage detection module, output node structure camouflage score;

[0049] The specific steps of the structure camouflage detection module are as follows:

[0050] S21: For the adjacency matrix of the transaction graph, the motif mode distribution of each node in the local subgraph is counted;

[0051] S22: Calculate the deviation of the motif distribution of part of the nodes from the global average distribution using random sampling;

[0052] S23: Based on the standardized Z-score, obtain the structure camouflage score (StructureCamouflage Score) of each sampled node;

[0053] S24: The unsampled nodes use neighbor approximation interpolation to obtain the camouflage score.

[0054] Wherein, the implementation details of the structure camouflage detection module are as follows:

[0055] In the graph structure, the neighbor structure of normal nodes often presents stable distribution, such as highly clustered triangle structure, typical center-neighbor star structure, or chain propagation path structure. In contrast, fraudulent nodes often deliberately hide their association with other abnormal nodes, resulting in unnatural configuration in local motif mode. Accordingly, a structure camouflage detection module based on motif is designed, which measures the deviation of nodes and their neighbors in the same type of nodes in the motif statistics, to identify potential camouflage behavior.

[0056] A21: Subgraph analysis based on motif

[0057] For each node in the graph , enumerate the local subgraph composed of its neighbor nodes centered on it, and count the frequency of its occurrence in the pre-defined motif mode. Motif mode is the smallest structural unit in the graph, mainly focusing on three common structures:

[0058] First, the triangle structure (triangle), that is, the node and two mutually connected neighbors form a closed loop together. This structure is widely present in normal user groups, reflecting the high aggregation of real social or transaction circles. Its statistical formula is:

[0059]

[0060] Where represents the neighbor set of node , and Representative indicator function. To prevent duplicate statistics for symmetric structures, set .

[0061] Secondly, star, which represents a central node connecting multiple unconnected neighbors, is a typical behavior pattern of normal users in social or transaction graphs, representing the radiation of their information or transactions. The star structure statistics formula is:

[0062]

[0063] where, This formula includes all pairs of neighbor nodes that are not directly connected to node .

[0064] Finally, chain, which is a path-type connection formed by a node and two nodes that are not connected to each other, is common in information transfer or weak connection scenarios and has a certain intermediary nature. Its statistical formula is:

[0065]

[0066] This formula ensures that the end node is not a direct neighbor of to exclude the possibility of the three becoming a triangle structure.

[0067] Finally, the motif matrix is represented as:

[0068]

[0069] A22: Structure space anomaly measurement based on Z-score

[0070] Since calculating Z-score for all nodes is too costly, a hybrid strategy is adopted: sample a portion of nodes to calculate Z-score structure camouflage scores, and use the neighbor node scores to approximate for the unsampled nodes.

[0071] First, randomly sample a portion of nodes to form a sampling subset Then give the Z-score of the motif type of node ( , ):

[0072]

[0073] where represents the m-class motif matrix count of node , and respectively, are the mean and standard deviation of the global matrix. The larger the value of Z-score, the more the node structure deviates from the global distribution. Considering that the deviation of different motif types has different importance, the maximum deviation of the node on all motifs is finally taken as the structure camouflage score of the node:

[0074]

[0075] A23: For nodes not in the sampling subset , based on its neighbors, i.e. using the mean of the neighbor nodes belonging to the sampling subset, the structure camouflage score of the node is obtained:

[0076]

[0077] wherein represents at least one neighbor in the sampling subset.

[0078] S3: feature camouflage detection module is used to perform feature camouflage disturbance and sensitivity analysis, and output the feature camouflage score of the node;

[0079] The specific steps of the feature camouflage detection module are as follows:

[0080] In order to effectively identify the fraud behaviors that may lack connection patterns in the graph structure, but have extremely high suspicious consistency or non-essentiality in the attribute level, a feature space camouflage detection module (FCD) is designed to characterize the classification sensitivity of the node under feature disturbance, and generate a camouflage score accordingly;

[0081] S31: A plurality of feature masking schemes are constructed to ensure that the influence of node features on prediction results is evaluated under different masking scenarios;

[0082] S32: The probability distribution under disturbance is predicted, and a lightweight built-in classifier is used to predict the original features and each set of masking features respectively. The prediction probability reflects the influence degree of each feature missing on the model decision;

[0083] S33: KL divergence is used to measure the disturbance sensitivity. Kullback-Leibler (KL) divergence is used to measure the change degree of the prediction distribution before and after the masking disturbance;

[0084] S34: The sensitivity indicators under all masking strategies are weighted and fused to consider the influence of the masking proportion on the disturbance amplitude, and the final feature camouflage score (Feature Camouflage Score) is calculated.

[0085] The implementation details of the feature camouflage detection module are as follows:

[0086] The identification of legitimate nodes typically relies on certain key attributes, while spoofed nodes are less sensitive to perturbations of these attributes. If a node is insensitive to masking of specific feature dimensions, its original features are likely imitations or generalizations, lacking crucial intrinsic attributes and exhibiting spoofing behavior. Therefore, multiple masking strategies are applied to node features in each training round, and the fluctuations in prediction probabilities are observed to construct its spoofing score in the feature space. The feature space process is as follows: Figure 1 As shown, the FCD module includes two sub-units: a Feature Occlusion Generator (FSM) for simulating occlusion perturbations, and a lightweight classifier for predicting offset metrics.

[0087] A31: Feature-Sensitive Masking Strategy

[0088] Given the original feature vector of a node To construct dimensional mask vector ,in Among them, in Figure 1 The lower right corner displays three masking strategies: sequential masking (masking each dimension sequentially), random masking (masking multiple dimensions randomly), and importance-based masking (masking the top p% of key features based on their importance ranking). The perturbation input is defined as:

[0089]

[0090] in, Indicates the first Feature vectors after masking in this way It is the corresponding masking code, symbol This indicates an element-wise multiplication operation.

[0091] A32: Feature Camouflage Assessment

[0092] To evaluate the predicted changes after occlusion, a lightweight graph neural network classifier is used. Where c is the number of categories; for each of the original features With each occluded variant Predict the probability:

[0093]

[0094] in, These represent the category prediction distributions under the original features and the masked features, respectively.

[0095] To measure the difference in distribution between the two, we directly calculate... Between logarithmic terms The divergence is then incorporated into the calculation of the feature masquerade score. That is, in the... The feature space camouflage score under the various occlusion methods is calculated as follows:

[0096]

[0097] in, Indicates the original prediction in the 1st... The probability of a class This represents the probability corresponding to the k-th type of occlusion. Represents the shading rate. It is an activation function used to constrain the divergence value to a stable range. As can be seen, the larger the divergence value, the higher the camouflage score, indicating that these nodes are less dependent on the masked key features and can reveal the degree of their camouflage.

[0098] A33: Ultimately, the feature space camouflage score for this node is the average of the scores under all occlusion schemes:

[0099]

[0100] Considering that the scoring scales may differ across nodes, normalization is performed to enable cross-node comparisons:

[0101]

[0102] in, Use extremely small positive numbers to prevent the denominator from being zero. Score after normalization. It can be used as an indicator of the degree of camouflage and will be used in the camouflage perception fusion mechanism in the future.

[0103] S4: The two types of camouflage scores are fused and a camouflage-aware attention (CAA) mechanism is injected to dynamically adjust the neighbor weights, thereby suppressing the interference of suspicious nodes on representation learning and improving the robustness and generalization ability of the model in complex camouflage scenarios.

[0104] The specific steps of S4 are as follows:

[0105] S41: Input the feature masquerading score and the structure masquerading score into the fusion layer for fusion through a weighted fusion function with trainable parameters;

[0106] The weighted fusion function is:

[0107]

[0108] in To score for feature masquerading, To score for structural camouflage, and These are node-level learnable weights; during the learning process, the model automatically adjusts the dependence ratio of different nodes on the two types of camouflage signals, thereby adaptively characterizing various camouflage behavior patterns; the function outputs a fused camouflage score. This will serve as an important modulation factor for subsequent graph attention mechanisms;

[0109] S42: Based on the traditional Graph Attention Network (GAT), an attention modulation method is introduced that fuses masquerade scores to suppress suspicious neighbors. For each pair of center nodes... with neighboring nodes Calculate the attention coefficient;

[0110] The formula for calculating the attention coefficient is:

[0111]

[0112] in The score is calculated by faking the fusion of neighboring nodes. The modulation coefficient; To obtain spoofing awareness attention weights from the original neighbor attention weights using softmax regularization. It is used for neighbor feature aggregation.

[0113] The implementation details of S4 are as follows:

[0114] A41: For each node Scoring by camouflaging the structural space (include and ) and feature space camouflage score The final dual-space camouflage score is obtained after weighted combination:

[0115]

[0116] in, These are learnable normalized weights. Reflects the nodes The overall degree of camouflage; the higher the value, the more likely camouflage behavior exists, and this value can guide the selection of which neighbors to aggregate.

[0117] Nodes were introduced into the original attention weight coefficients. and his neighbors Attention is adjusted based on the fusion masquerade score, and new weight coefficients are given. :

[0118]

[0119] A42: After obtaining the updated weight coefficients, the neighbor representation is reconstructed and fed into an L-layer gated residual network for training to enhance information propagation. Finally, an MLP classifier is used to obtain the final fraud probability.

[0120]

[0121] The loss function for this process is:

[0122]

[0123] in , Representing the true label of a transaction, this gated residual network is optimized using stochastic gradient descent.

[0124] Based on the above, the accompanying drawings of this invention are analyzed as follows:

[0125] Figure 4 This invention, along with 10 representative methods, was evaluated on three publicly available supervised fraud detection datasets and semi-supervised datasets: YelpChi, Amazon, and the Financial Fraud Semi-supervised Dataset (FFSD). The YelpChi dataset contains hotel and restaurant reviews that have been filtered (for fraudulent content) or allowed (for legitimate content). After preprocessing, the dataset contains 45,954 reviews (14.5% of which are fraudulent). The Amazon dataset contains user reviews of instrument products. This dataset categorizes user behavior into normal and fraudulent categories. FFSD contains genuine credit card transactions over a ten-month period. These transactions are labeled based on consumer reports and verification by financial experts; transactions confirmed as fraudulent are marked with 1, and the rest are marked with 0.

[0126] The performance metrics used for credit card and opinion fraud detection include the area under the ROC curve (AUC), the macro-mean of the F1 score (F1-macro), and the average precision (AP). As can be seen, this invention outperforms existing methods in all metrics. For example, compared to the RGTAN method, on the YelpChi dataset, this method achieves improvements of 2.14%, 1.63%, and 2.49% respectively; on the Amazon dataset, improvements of 1.03%, 0.79%, and 3.54% respectively; and on the FFSD dataset, improvements of 2.45%, 2.67%, and 3.08% respectively.

[0127] To verify the effectiveness of the model, attached Figure 2 The results are shown in ablation experiments on three datasets: removing the FCD module, removing the SCD module, or removing both modules simultaneously. Taking the YelpChi dataset as an example, removing the FCD module alone reduces AUC by 0.6%, F1 score by 1.2%, and mean precision by 2.3%; while removing the SCD module results in performance degradation of 1.1%, 1.7%, and 3.1%, respectively. Furthermore, removing both modules simultaneously leads to further performance degradation.

[0128] Appendix Figure 3 Demonstrates masquerading weights based on the YelpChi dataset. and learning rate Sensitivity analysis of two hyperparameters. When The model performs best when the value is between 0.2 and 0.3. The AUC value reaches its highest value when the value is 0.3; if Above 0.6, model performance begins to decline. Regarding... The model remained stable within the range of 0.001 to 0.003, with the optimal result obtained at 0.001: the AUC value reached 0.9712 and the F1 score reached 0.8655.

[0129] The above is a fraud detection method based on a decoupled feature and structure space spoofing perceptual graph neural network proposed in this invention, which addresses the difficulty in identifying complex spoofing nodes in financial fraud detection. This method models the transaction graph in both feature and structure spaces, quantifies the degree of spoofing of nodes in different spaces through feature spoofing detection modules and structure spoofing detection modules, and introduces learnable weight factors to achieve adaptive fusion of spoofing scores. The fused comprehensive spoofing score is injected into the graph attention layer to adjust the weights of neighboring nodes, thereby suppressing the interference of suspicious neighbors on representation learning. This method can effectively identify complex spoofing nodes that simultaneously forge features and manipulate relational structures, significantly improving the robustness and generalization ability of fraud detection models, and is applicable to scenarios such as financial risk control, e-commerce security, and social network anti-fraud.

[0130] Although the present invention has been described above with reference to embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of the invention. In particular, as long as there is no structural conflict, the features in the disclosed embodiments can be combined with each other in any manner. The lack of an exhaustive description of these combinations in this specification is merely for the sake of brevity and resource conservation. Therefore, the present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A fraud detection method based on a spoofing-aware graph neural network with decoupling of feature and structural space, characterized in that, The specific steps are as follows: S1: Construct an FS-DGAN model consisting of a feature camouflage detection module and a structure camouflage detection module; S2: Perform local subgraph motif analysis and global distribution comparison through the structure camouflage detection module, and output the structure camouflage score of the node; S3: Perform feature masquerading perturbation and sensitivity analysis through the feature masquerading detection module, and output the feature masquerading score of the node; S4: The two types of camouflage scores are fused and a camouflage-aware attention mechanism is injected to dynamically adjust the neighbor weights, thereby suppressing the interference of suspicious nodes on representation learning and improving the robustness and generalization ability of the model in complex camouflage scenarios.

2. The fraud detection method based on a decoupling of feature and structural space in a spoofing-aware graph neural network according to claim 1, characterized in that, The specific steps of the structure camouflage detection module are as follows: S21: For the adjacency matrix of the transaction graph, calculate the distribution of motif patterns for each node in the local subgraph; S22: Use random sampling to calculate the degree of deviation of the motif distribution of some nodes from the global average distribution; S23: Obtain the structure camouflage score for each sampling node based on the standardized Z-score; S24: Unsampled nodes use neighbor approximation interpolation to obtain spoofing scores.

3. The fraud detection method based on a decoupling of feature and structural space in a spoofing-aware graph neural network according to claim 1, characterized in that, The specific steps of the feature camouflage detection module are as follows: S31: Construct multiple feature masking schemes to ensure that the impact of node features on prediction results is evaluated under different masking scenarios; S32: Predict the probability distribution under perturbation. A lightweight built-in classifier is used to predict the original features and each group of masked features respectively. The predicted probability reflects the degree of influence of the missing features on the model's decision. S33: KL divergence measures sensitivity to perturbations. Kullback-Leibler divergence is used to predict the degree of change in the distribution before and after the shading perturbation. S34: Perform weighted fusion of sensitivity indices under all occlusion strategies, consider the impact of occlusion ratio on perturbation amplitude, and calculate the final feature camouflage score.

4. The fraud detection method based on a decoupling of feature and structural space in a spoofing-aware graph neural network according to claim 1, characterized in that, The specific steps of S4 are as follows: S41: Input the feature masquerading score and the structure masquerading score into the fusion layer for fusion through a weighted fusion function with trainable parameters; S42: Based on the traditional graph attention network, a fusion of masquerade scores is introduced for attention modulation to suppress suspicious neighbors. For each pair of central nodes... with neighboring nodes Calculate the attention coefficient.

5. The fraud detection method based on a decoupling of feature and structural space in a spoofing-aware graph neural network according to claim 4, characterized in that, The weighted fusion function is: ； in To score for feature masquerading, To score for structural camouflage, and These are node-level learnable weights. During the learning process, the model automatically adjusts the dependence ratio of different nodes on the two types of camouflage signals, thereby adaptively characterizing various camouflage behavior patterns; the function outputs a fused camouflage score. This will serve as an important modulation factor for subsequent graph attention mechanisms.

6. The fraud detection method based on a decoupling of feature and structural space in a spoofing-aware graph neural network according to claim 4, characterized in that, The formula for calculating the attention coefficient is: ； in The score is calculated by faking the fusion of neighboring nodes. The modulation coefficient; To obtain spoofing awareness attention weights from the original neighbor attention weights using softmax regularization. It is used for neighbor feature aggregation.

Images