Graph neural network fraud detection method and system based on attention mechanism

Abstract

The invention provides a graph neural network fraud detection method and system based on an attention mechanism, and the method comprises the steps: calculating the semantic similarity between a center node of a specific relation sub-graph in a multi-relation graph and a neighbor node of the center node based on a label perception mechanism; a reinforcement learning mechanism is utilized to adaptively adjust a selection filtering threshold value of a neighbor node; selecting neighbor node information, and aggregating the selected neighbor node information to form a first node representation of each specific relation sub-graph in the multi-relation graph; utilizing an attention mechanism to dynamically evaluate the importance of each specific relation sub-graph in the multi-relation graph to a center node, and distributing corresponding weights to form a comprehensive second node representation; fusing the first node representation, the second node representation and the node representation of the previous layer of the GNN to form a final embedded representation; and inputting the final embedded representation into a classifier for identifying and judging fraudulent behaviors. According to the method, efficient detection is realized through a sparse gating attention and reinforcement learning neighbor selection mechanism.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network information security, in particular to a fraud detection method and system based on a graph neural network with an attention mechanism. BACKGROUND

[0002] With the rapid development of the Internet, online reviews have become a key basis for consumers to evaluate product quality and make purchase decisions. Positive or negative reviews can have a significant impact on consumers' willingness to purchase, directly affecting product sales and reputation. Therefore, network fraud is becoming increasingly common in daily life. Fraudsters manipulate product reputation by posting fake reviews, leading to market unfairness, misleading consumers, and economic losses for users and platforms. Therefore, it is crucial to develop effective review fraud detection technology.

[0003] Existing fraud detection research has focused on the financial field, such as credit card fraud and financial statement fraud, while research on review fraud is relatively limited. Review fraud is difficult to record and has complex behavior patterns, making it difficult to extract abnormal features that effectively distinguish fraud from normal behavior. Current detection models generally face two major challenges: first, the severe class imbalance problem, with far fewer fraud samples than normal samples, leading to model bias towards the majority class and low fraud sample recognition rate; second, insufficient dynamic adaptive ability, making it difficult to quickly adapt to the continuous evolution of fraud methods.

[0004] In recent years, graph neural networks (GNN) have shown significant potential in fraud detection due to their strong relationship pattern capturing ability. GNN updates the target node representation by aggregating neighbor node information, effectively modeling the complex interactions between fraudsters and surrounding entities. However, existing GNN models have limitations when facing fraudster disguising behavior. To evade detection, fraudsters often deliberately make their immediate neighbors mostly normal users. The homogeneity aggregation mechanism of GNN fails in this context, and the aggregation of a large number of normal neighbor information can dilute or even mask the abnormal features of the fraud node itself, making it difficult for the model to identify carefully disguised fraudulent behavior. SUMMARY

[0005] The purpose of the present application is to provide a fraud detection method and system based on a graph neural network with an attention mechanism to solve the above technical problems.

[0006] In a first aspect, the present application proposes a fraud detection method based on a graph neural network with an attention mechanism, which comprises the following steps: S1, converting raw data into a structured multi-relation graph, wherein entities are modeled as nodes, and various interactions between entities are modeled as edges, and performing initial feature representation assignment for the nodes and edges; S2, based on a label perception mechanism, calculate the semantic similarity between the center node and its neighbor nodes in the specific relationship subgraph of the multi-relation graph; use a reinforcement learning mechanism to adaptively adjust the selection filtering threshold of the neighbor nodes; and aggregate the selected neighbor node information to form a first node representation of each specific relationship subgraph in the multi-relation graph; wherein the specific relationship subgraph refers to a single relationship type layer in the multi-relation graph; S3, using an attention mechanism, dynamically evaluate the importance of each specific relationship subgraph in the multi-relation graph to the center node, and assign corresponding weights to form a comprehensive second node representation; S4, fuse the first node representation, the second node representation, and the node representation of the previous layer of GNN to form a final embedding representation; input the final embedding representation into a classifier to identify and judge fraudulent behavior.

[0007] In the above technical solution, the original heterogeneous data is converted into a structured multi-relation graph, which fully captures the complex interaction information between entities and provides rich context for subsequent analysis, significantly making up for the defects of traditional fraud detection methods in insufficient use of data structure. By hierarchically and dynamically aggregating and fusing multi-relation information, combining label perception and attention mechanism, it can accurately identify and capture key fraud patterns from complex relationship networks, thereby significantly improving the recognition accuracy of fraudulent behavior and the generalization ability of the model. In addition, the introduction of label perception mechanism and reinforcement learning driven adaptive neighbor selection enables the model to effectively deal with the problem of fraudsters escaping detection by disguising their attributes or relationships, significantly enhancing the anti-fraud robustness of the fraud detection model.

[0008] Further, the S2 step includes: S21, use a multi-layer perception to obtain the label perception representation of the center node and its neighbor nodes, and calculate the cosine feature similarity between the center node and the neighbor nodes; S22, based on the cosine feature similarity, sort the neighbor nodes of the center node in descending order, and select the top-k neighbor nodes with the highest cosine feature similarity as the sampling neighbors of the center node in combination with the adaptive filtering threshold determined by reinforcement learning.

[0009] In the above technical solution, by utilizing a multilayer perceptron to obtain the label-aware representations of the central node and its neighbors, and calculating the cosine similarity between them, the semantic proximity between nodes can be accurately measured, effectively distinguishing between genuine associations and fraudulent spoofing. Combining reinforcement learning mechanisms to adaptively determine the neighbor selection filtering threshold and perform Top-k sampling allows the model to dynamically select the most informative and relevant neighbors based on data characteristics and learning objectives, avoiding the limitations of fixed sampling strategies and improving the quality and efficiency of information aggregation within relationships. Simultaneously, this step effectively filters out irrelevant or spoofed neighbor node information, reduces noise interference, and ensures that the information obtained from aggregation within relationships is purer and more discriminative, further enhancing the resistance to fraudulent spoofing.

[0010] Furthermore, in GNN's... Layers and Relationships Below, the cosine feature similarity The calculation formula is:

[0011] In the formula, The central node; These are the neighboring nodes of the central node; For activation functions; It is a multilayer perceptron; For the first time in GNN The central node of the layer output Label-aware representation; For the first time in GNN Neighbor nodes output by the layer Label-aware representation. Central node. and neighboring nodes Cosine distance between The smaller the value, the more central the node. and neighboring nodes The greater the similarity between them, the more likely they are to be found in each other. .

[0012] The aforementioned technical solution provides a clear mathematical basis for accurately quantifying the label-aware semantic similarity between nodes in graph neural networks at specific layers and relationships, enabling the calculation, comparison, and utilization of abstract semantic associations. This provides a reliable and operable similarity metric for subsequent descending sorting of candidate neighbor nodes and Top-k neighbor selection, ensuring the effectiveness and accuracy of the neighbor selection process based on semantic associations. Furthermore, this formula allows for flexible calculation of similarity at different layers and relationships within the graph neural network, enabling the model to capture multi-level, multi-dimensional, and finer-grained semantic association information, thereby enhancing the richness of node representations.

[0013] Furthermore, step S22 includes employing an Actor-Critic framework to model the process of each layer of the GNN selecting neighbors for a specific relationship as a Markov decision process, by defining the state space. Action space and reward function The system adaptively learns the optimal combination of neighbor selection filtering thresholds, wherein the reward function... Represented as:

[0014] In the formula, Candidate neighbor nodes Its current value , For GNN layer; For neighboring nodes In relationship Embedded representation below; For relationship The value function under; In relation Below, the average value of all neighboring nodes in previous training rounds; Tolerance parameters are used to avoid mistakenly discarding valuable neighbor nodes; actions Defined as the current relation Next specific candidate neighbors The choice decision, in which This indicates that the neighbor node is selected and retained. , This indicates that the neighboring node is discarded. .

[0015] In the above technical solution, by employing the Actor-Critic reinforcement learning framework, the neighbor selection process of the graph neural network is modeled as a Markov decision process. This allows the model to adaptively learn and optimize its neighbor selection strategy through interaction with the environment, thereby finding the optimal subset of neighbors most beneficial to the task in a complex graph. The designed reward function effectively incentivizes the model to prioritize retaining key neighbors with high value for fraud detection and suppresses the selection of irrelevant or harmful neighbors, thus significantly optimizing the quality and relevance of neighbor information aggregation. Simultaneously, a tolerance parameter is introduced. This allows the model to have a certain degree of flexibility in the neighbor selection process, avoiding the erroneous rejection of potentially valuable neighbors due to excessive penalties, and improving the robustness and generalization ability of the selection strategy.

[0016] Further, the attention mechanism includes a relation gating mechanism, based on the label-aware representation of the center node and the aggregated features of the specific relation, the relation gating weight is calculated using the relation gating mechanism :

[0017] wherein, is the relation gating weight of the GNN's i-th layer; and are learnable weight and bias parameters, respectively; is an activation function; is the label-aware representation of the center node at the i-th layer.

[0018] In the above technical solution, the relation gating mechanism can dynamically evaluate the importance of each relation in the multi-relation graph for the center node and assign corresponding gating weights, so that the model can intelligently focus on the most relevant relation type to fraudulent behavior. By assigning different weights to different relation types, the effectiveness of information fusion between relations is enhanced, ensuring that more important relations dominate in the final node representation, thereby significantly improving the model's discriminative ability and utilization efficiency of heterogeneous relations. In addition, the relation gating weight provides a certain degree of interpretability, which can intuitively indicate which types of relation connections the model focuses on more in a particular decision or node representation learning, helping to understand the basis for the model's decision.

[0019] Further, the attention mechanism includes a sparse attention mechanism, which calculates the attention score between the center node and different relation neighbor nodes, and generates a sparse attention weight distribution through a sparse Softmax function, wherein the calculation formula of the attention score is:

[0020] wherein, is the attention score between the center node and the neighbor node in the i-th layer; and are multi-layer perceptrons for transforming the features of the center node and the neighbor node , respectively; is the feature dimension; is a sparse Softmax function that generates a sparse attention weight distribution, so that most of the attention weights are 0, and only a few key neighbor nodes have non-zero weights. ​​​​

[0021] In the aforementioned technical solution, a sparse attention mechanism is employed, enabling the model to automatically identify and focus on a few of the most critical neighbors of the central node. This effectively filters out a large amount of irrelevant or redundant neighbor information, significantly improving the efficiency and accuracy of information aggregation. By generating a distribution with most attention weights being zero through a sparsified Softmax function, the computational and storage complexity of GNNs when processing large-scale neighbor nodes is significantly reduced, improving the model's operating efficiency on large-scale graph data. Simultaneously, the sparse non-zero attention weights can intuitively indicate which specific neighbor nodes are most critical to the central node's representation update, thereby enhancing the model's ability to trace key information and its interpretability in decision-making.

[0022] Furthermore, the attention mechanism employs a fusion-gated attention strategy, which includes: in the GNN's... Layer, for the central node The gating weight of each relation is calculated through a relation gating mechanism. The central node is calculated using a sparse attention mechanism. Neighbor nodes with different relationships Attention weights between The fusion representation of the fusion-gated attention strategy is as follows:

[0023] In the formula, As the central node In GNN's The final aggregated representation that integrates all relational information; For activation functions; The total number of relations; In the first Layers and Relationships Gating weights; As the central node In relation The set of neighboring nodes; For the first time in GNN A multilayer perceptron that performs value transformation on the features of neighboring nodes; Neighboring nodes In GNN's Layer embedding representation.

[0024] In the above technical solution, by organically integrating the relationship gating mechanism and the sparse attention mechanism, dual attention focusing is realized at the relationship type level and the intra-relationship neighbor node level, so that the model can consider the importance of different relationships and the influence of key neighbors within the relationship, forming a more comprehensive attention distribution. Through dynamic weighting and sparsification processing, the propagation and aggregation process of information in the graph neural network is optimized, ensuring that the model can more efficiently utilize heterogeneous relationship information and effectively avoid information redundancy or overload. The generated fusion representation can more comprehensively and accurately capture complex dependencies and key signals in multi-relationship graphs, providing more discriminative node embeddings for final fraud identification, thereby improving classification performance.

[0025] Further, the final loss function is:

[0026]

[0027]

[0028]

[0029] wherein, is the final loss function in the model training process; is the cross-entropy loss function in the node classification task; is the cross-entropy loss of label-aware similarity measurement of the entire network; and are weight parameters, respectively; is the L2 norm of all model parameters; is the true label information of the center node ; is an activation function; is a multi-layer perceptron applied to the final embedding of the node at the layer of the GNN; is the final embedding representation obtained after processing of the center node ; is the cross-entropy loss of label-aware similarity measurement calculated at the layer of the GNN; is the embedding representation of the center node at the layer of the GNN; is the final aggregated node feature within the three relationships; is the final aggregated representation of the center node at the layer that fuses all relationship information; Concat is a feature concatenation operation.

[0030] In the technical solution, the multi-objective loss function combining the node classification loss, the label-aware similarity measurement loss and the L2 regularization term is designed, which can optimize the fraud classification accuracy, the semantic similarity learning ability between nodes and the generalization ability of the model, thereby achieving more comprehensive performance improvement. The introduction of the label-aware similarity measurement loss forces the model to learn node representations with label distinguishing ability, especially in the fraud detection scenario with scarce labeled data, which effectively guides the model to distinguish between benign and fraudulent patterns and enhances the semantic recognition ability of the model. The L2 regularization term effectively suppresses the overfitting phenomenon of the model during training, enhances the generalization ability and stability of the model to new data, and makes the model more reliable in practical applications.

[0031] In a second aspect, the application provides a graph neural network model based on sparse gated attention and reinforcement learning, which comprises an intra-relation aggregation module, an inter-relation aggregation module and a relation fusion module, wherein, The intra-relation aggregation module is configured to calculate the semantic similarity between the center node and its neighbor nodes of a specific relation subgraph based on a label-aware mechanism, to adaptively adjust the filtering threshold of the neighbor nodes by reinforcement learning, and to aggregate the information of the selected intra-relation neighbor nodes to form the first node representation of each specific relation subgraph of the multi-relation graph. The inter-relation aggregation module is configured to dynamically evaluate the importance of each specific relation subgraph in the multi-relation graph to the center node by using the fusion gated attention strategy, to assign corresponding weights, and to realize the sparsification of attention weights by combining the sparse attention mechanism, so as to form the comprehensive second node representation. The relation fusion module is configured to generate the final embedding representation after the aggregation of the intra-relation module and the inter-relation module.

[0032] In the above technical solution, the model can realize effective intra-relation aggregation, dynamic inter-relation evaluation and information fusion through the cooperative work of the three modules, improve the quality of node representation, enhance the ability to capture complex relationships, and thereby improve the accuracy and efficiency of fraud detection In a third aspect, the application provides a graph neural network fraud detection system based on an attention mechanism, which comprises: A data processing and graph construction module is configured to convert raw data into a structured multi-relation graph, wherein entities are modeled as nodes, and various interactions between the entities are modeled as edges, and the nodes and edges are assigned initial feature representations. The first node representation obtaining module is configured to calculate semantic similarity between a center node of a specific relation subgraph in the multi-relation graph and neighbor nodes thereof based on a label-aware mechanism, to adaptively adjust a selection filtering threshold of the neighbor nodes using a reinforcement learning mechanism, and to aggregate information of the selected neighbor nodes to form a first node representation of each specific relation subgraph in the multi-relation graph, wherein the specific relation subgraph refers to a graph layer of a single relation type in the multi-relation graph. The second node representation obtaining module is configured to dynamically evaluate importance of each specific relation subgraph in the multi-relation graph to a center node and assign corresponding weights using an attention mechanism to form a comprehensive second node representation. The final embedding representation obtaining and classification module is configured to fuse the first node representation, the second node representation, and a node representation of a previous layer of the GNN to form a final embedding representation, and input the final embedding representation into a classifier to identify and judge fraudulent behavior.

[0033] Compared with the prior art, the beneficial results of the present application are as follows: (1) The present application can efficiently and accurately identify complex fraudulent behavior. Compared with the limitations of the prior art in processing large-scale, heterogeneous, and multi-relation data, the present application intelligently converts original heterogeneous data into a structured multi-relation graph and performs comprehensive initial feature representation, providing rich and accurate context information for subsequent deep learning analysis, and fundamentally improving data utilization efficiency and model understanding ability of complex data structures.

[0034] (2) The present application calculates semantic similarity between nodes by introducing a label-aware mechanism, and adaptively adjusts neighbor selection filtering thresholds for Top-k sampling in combination with reinforcement learning. This strategy ensures that the model can accurately identify and focus on the most relevant neighbor information for aggregation, effectively overcoming the limitations of fixed sampling strategies in traditional methods, and greatly enhancing the model's resistance to fraudsters' disguising behavior, thereby improving the quality of node representation and the accuracy of fraud identification.

[0035] (3) The attention mechanism aspect of the present application introduces a fusion gating attention strategy, which skillfully combines a relation gating mechanism and a sparse attention mechanism. Compared with a single or non-adaptive attention mechanism, this enables the model to dynamically evaluate the importance of different relations and focus on a small number of key neighbor information, effectively filtering out redundancy and noise. This multi-level, adaptive attention allocation significantly optimizes the propagation and fusion process of information in the graph neural network, not only improving the discriminability of the final node representation, but also greatly reducing the computational complexity in processing large-scale graph data, improving the running efficiency of the model.

[0036] (4) The application realizes the collaborative optimization of the model classification accuracy, semantic learning ability and generalization ability by designing a multi-objective loss function combining classification loss, label-aware similarity loss and L2 regularization, effectively avoids overfitting, and enhances the robustness of the model. The modular system constructed can automatically execute the entire fraud detection process, convert advanced theoretical research results into practical deployment solutions, provide an integrated, efficient and scalable fraud detection platform, and thus make up for the shortcomings of the prior art in actual application deployment and maintenance. BRIEF DESCRIPTION OF DRAWINGS

[0037] The accompanying drawings are included to provide a further understanding of embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and serve to explain principles of the present application. Many of the anticipated advantages of embodiments and other embodiments will be readily appreciated as the same become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale relative to each other. Like reference numerals designate corresponding similar parts.

[0038] Figure 1 is a flow framework diagram of a fraud detection method based on a graph neural network with an attention mechanism according to an embodiment of the application; Figure 2 is a structure diagram of a graph neural network model (Sparse Gated Attention with Reinforcement Learning Graph Neural Network, SGARL-GNN) based on sparse gated attention and reinforcement learning according to an embodiment of the application; Figure 3 is a comparison of model indicators of SGARL-GNN, SGARL-GNN / s and SGARL-GNN / g in the Amazon dataset according to an embodiment of the application; Figure 4 is a comparison of model indicators of SGARL-GNN, SGARL-GNN / s and SGARL-GNN / g in the Yelp dataset according to an embodiment of the application; Figure 5 is a framework diagram of a fraud detection system based on a graph neural network with an attention mechanism according to an embodiment of the application. DETAILED DESCRIPTION

[0039] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work belong to the protection scope of the present application.

[0040] Reference Figure 1 , Figure 1 The flow framework diagram of the fraud detection method of the attention mechanism-based graph neural network of the embodiments of the present application is shown in the figure, and the method comprises the following steps: S101, converting the original data into a structured multi-relation graph, wherein the entities are modeled as nodes, various interactions between the entities are modeled as edges, and the nodes and the edges are assigned with initial feature representations.

[0041] In some specific embodiments, the multi-relation graph is a heterogeneous graph composed of users and their multi-relation type interactions. The multi-relation graph is defined as , denotes a set of nodes , is the number of nodes in the multi-relation graph. Each node has a dimensional feature vector , and denotes a set of all node features, denotes a set of real numbers, denotes a dimensional real number space. denotes an edge between node and node under the relationship , and the relationship , where is the number of relationships. An edge can be associated with multiple relationships, and there are different types of relationships. is a set of labels of each node in , where 1 indicates that the node is a fraud. The fraud detection method based on the attention mechanism-based graph neural network of the present application is regarded as a semi-supervised classification task. Given a multi-relation graph and some nodes with labels , by utilizing the graph structure modeling capability and node feature learning capability of GNN, the labels of another part of unlabeled nodes are inferred by using these known labeled nodes as supervision information, i.e. determining whether the entities corresponding to these unknown nodes are frauds or non-frauds, thereby realizing effective detection of frauds in the graph.

[0042] In some specific embodiments, each multi-relation graph has three specific relation subgraphs, which are divided by the multi-relation graph according to relation type. Each specific relation subgraph is isomorphic, that is, it has only one type of node and relation.

[0043] S102. Calculate the semantic similarity between the central node of a specific relation subgraph and its neighboring nodes based on a label-aware mechanism, adaptively adjust the filtering threshold for selecting the neighboring nodes using reinforcement learning, and aggregate the information of the neighboring nodes within the selected relation to form the first node representation of each specific relation subgraph of the multi-relationship graph, wherein the specific relation subgraph is a layer of a specific relation of a single relation in the multi-relationship graph.

[0044] In some specific embodiments, step S102 includes: S1021. Use a multilayer perceptron to obtain the label perception representation of the central node and its neighboring nodes, and calculate the cosine feature similarity between the central node and the neighboring nodes. S1022. Based on the cosine feature similarity, sort the neighbor nodes of the center node in descending order, and select the top-k neighbor nodes with the highest cosine feature similarity as the sampling neighbors of the center node by combining the adaptive filtering threshold determined by reinforcement learning.

[0045] Specifically, a multilayer perceptron (MLP) is used as the node label predictor for the central node. Its neighboring nodes The cosine feature similarity calculation method is employed. The output of the hidden layer of the label predictor is used. As the central node Label-aware representation, in the GNN's... Layers and Relationships Below, the center node is calculated based on cosine feature similarity. and neighboring nodes The similarities are as follows: Formula (1) The cosine distance between two nodes is: Formula (2) in, The activation function used in this application is tanh. It is a multilayer perceptron. For the first time in GNN The central node of the layer output Label-aware representation, For the first time in GNN Neighbor nodes output by the layer label-aware representation, The smaller the value is, the greater the similarity between and is. By using node labels, the interference caused by node camouflage in the actual scene is effectively avoided, the complexity of similarity calculation is reduced, and a stable foundation is provided for subsequent neighborhood filtering.

[0046] To train the similarity measure using direct supervision signals from labels, where is an activation function, is the label information of the center node , is the center node output at the layer of the GNN, the label-aware representation, the cross-entropy loss of the MLP in the layer of the GNN is defined as: Equation (3) Equation (4) Top-k sampling is a dynamic neighbor selection method based on similarity scores, which can select the most relevant neighbor nodes for each target node. The present application uses Top-k sampling to filter dissimilar neighborhoods according to different relationships. In the layer of the GNN and under the relationship , the filtering threshold indicates the selection rate from all neighbors, for example, if it is 1, all neighbor nodes of the center node under the relationship are retained; if it is 0, all neighbor nodes of the center node under the relationship are filtered out and do not participate in the center node neighborhood information aggregation process. The remaining neighbor set after filtering is: Equation (5) First, for the center node , all candidate neighbor nodes are obtained from its neighbor list under the relationship . Second, for the center node and each neighbor node , the cosine feature similarity calculation method (Equation 1) is used to calculate a set of similarity scores . Next, the candidate neighbor nodes are sorted in descending order based on , the sorted neighbor node list is arranged from high to low in similarity, and the top neighbors are selected as the selected neighbors, i.e. The remaining nodes will be discarded in the current batch and will not participate in subsequent aggregation processes within the layer.

[0047] To avoid reliance on manually labeled data and to adaptively learn the optimal combination of neighbor selection filtering thresholds, this application introduces a reinforcement learning model based on the Actor-Critic framework. This model primarily models the process of selecting neighbors for a specific relation in each layer of the GNN as a Markov decision process. Specifically, the reinforcement learning module is defined as a tuple. , where: state space ,state In GNN's Layer, targeting the central node and relationships When selecting neighbors, the main components include the central node. In the current layer Embedded representation Candidate In the current layer Embedded representation Action space ,action Defined as the current relation Next specific candidate neighbors The decision-making process, specifically the set of actions, is as follows: , This indicates that the neighbor node is selected and retained. ; This indicates that the neighboring node is discarded. Reward function , indicating that an action is being performed (i.e., for a certain neighbor node) (Making a decision to keep or discard), the reward function is defined as: Formula (6) in, Candidate neighbor node The current value is calculated as follows: ,in For GNN layer, yes In relationship Embedded representation below, For relationship The value function under this framework, in the Actor-Critic framework, is typically estimated by the Critic network. In the relationship Below, the average value of all neighboring nodes in previous training rounds is used, and this value generally increases as training progresses. is a tolerance parameter to avoid falsely discarding valuable neighbor nodes. When action is taken, if the reward is greater than 0, it indicates that the action is worth encouraging, and the policy network parameters will be adjusted to increase the likelihood of this action; if the reward is less than 0, it indicates that the action can need to be suppressed. When action is taken, if the reward is greater than 0, it indicates that discarding the node is reasonable; if the reward is less than 0, it indicates that a valuable node can have been discarded by mistake. To address this issue, a tolerance parameter is set to provide a positive reward in this case, encouraging the retention of the node, and vice versa. Finally, if it is decided to keep the neighbor node by relation to the center node , it will be added to the selected set of neighbors .

[0048] S103, using an attention mechanism, dynamically assesses the importance of each specific relation subgraph in the multi-relation graph to the center node and assigns a corresponding weight to form a comprehensive second node representation.

[0049] In some specific embodiments, the contribution of neighborhood features of different relations to the center node representation varies significantly. In order to dynamically assign weights to each relation, an attention mechanism with a relation gating mechanism is introduced. In the first layer, based on the label-aware representation of the center node and the features of the neighbor nodes in the relation , a relation gating weight is calculated: Equation (7) where and are learnable weight and bias parameters, is an activation function (using the Sigmoid function), is the label-aware representation in the first layer. This gating weight reflects the importance of the relation to the center node representation, with a value range of 0 to 1. The closer the value of to 1, the more important the relation The more important the representation is, the more weight the neighbor feature will be given in the aggregation process; on the contrary, the closer the weight is to 0, the smaller the contribution of the relationship to the center node is, and the impact of the neighbor feature will be weakened. In this way, the relationship gating mechanism can dynamically adjust the contribution of different relationships in the aggregation process, so that the model pays more attention to the key relationships related to the center node, thereby improving the accuracy and robustness of the node representation.

[0050] In some specific embodiments, the attention mechanism is a sparse attention mechanism, which aims to focus on key neighbors and reduce computational complexity. The present application adopts a sparse attention mechanism to calculate the attention weights between the center node and the neighbor nodes of different relationships. In the first layer, for the center node and the neighbor nodes in the relationship , the attention score is calculated as: Equation (8) wherein, and are multi-layer perceptrons for transforming the features of the center node and the neighbor node respectively, is the feature dimension, is a sparse Soft max function that can generate a sparse attention weight distribution, so that most of the attention weights are 0, and only a few key neighbor nodes have non-zero weights. This not only reduces invalid calculations, but also enables the model to focus more on important neighbor nodes, improving the efficiency and performance of the model.

[0051] In some specific embodiments, the relationship gating mechanism and the sparse attention mechanism are combined to propose a fusion gating attention strategy. Specifically, in the first layer, for the center node , the gating weight of each relationship is first calculated by the relationship gating mechanism, and then the attention weight between the center node and the neighbor nodes of different relationships is calculated by the sparse attention mechanism. The final fusion representation is: Equation (9) wherein, is the final aggregated representation of the center node in the GNN in the first layer that fuses all relationship information; is an activation function; is the total number of relationships.​​ In the first Layers and Relationships Gating weights; As the central node In relationship The set of neighboring nodes; For the first time in GNN A multilayer perceptron that performs value transformation on the features of neighboring nodes; For neighboring nodes In GNN's Layered embedding representation. In this way, not only can weights be dynamically assigned to each relation, but key neighbors can also be effectively focused, reducing computational complexity and thus achieving efficient feature fusion between relations.

[0052] S104. The first node representation, the second node representation, and the node representation of the previous layer of GNN are fused to form the final embedded representation; the final embedded representation is input into the classifier to identify and judge fraudulent behavior.

[0053] In some specific embodiments, node representations generated under different relationships are fused: Formula (10) in, As the central node In GNN's Layer embedding representation; As the central node In GNN's Layer embedding representation; Features of the final aggregation node within the three relationships; As the central node In the The final aggregated representation integrates all relational information; Concat is the feature concatenation operation. This approach fully utilizes information from different relations to generate node representations with rich semantics, providing strong support for subsequent fraud detection tasks.

[0054] In some specific embodiments, the central node The final embedding is represented as , which is the output of the last layer of the attention-based graph neural network. The loss function of the GNN in the node classification task is defined as the cross-entropy loss function: Formula (11) Together with the loss function for node classification and the loss function for similarity measurement in formula (4), the final loss function of the attention-based graph neural network is defined as follows: Equation (12) wherein, and are weight parameters, and is the L2 norm of all model parameters.

[0055] With reference to Figure 2 , Figure 2 a structural diagram of a Sparse Gated Attention with Reinforcement Learning Graph Neural Network (SGARL-GNN) according to an embodiment of the present application is shown, as Figure 2 is shown, the neighbor nodes are distinguished, for each center node, its neighbor nodes are divided into three categories: fraudulent neighbors, benign neighbors and unlabeled neighbors. For unlabeled neighbor nodes, the SGARL-GNN architecture is used to determine whether the center node is a fraudulent node or a benign node. Figure 2 The overall architecture of the SGARL-GNN is described, including three key modules: intra-relation aggregation module, inter-relation aggregation module and relation fusion module. The intra-relation aggregation module calculates the semantic similarity according to the label-aware score of the node and the neighbor, and uses an adaptive threshold to sample the neighbors. The inter-relation aggregation module dynamically assigns weights to each relation by fusing sparse attention and gating mechanism, thereby enhancing the model's attention to important relations. The relation fusion module generates the final node representation after completing the intra-relation module and inter-relation module aggregation. Among them: The intra-relation aggregation module, the "data input" is a multi-relation graph, which includes a center node (yellow) and its different types of neighbor nodes (fraudulent neighbors red, benign neighbors blue, unlabeled neighbors green), and different colored relationships between them (fraudulent neighbors red, benign neighbors blue, unlabeled neighbors green). After data input, "label-aware" processing will be performed first, that is, the model will use the label information (or pseudo-label) of the node to guide similarity calculation, which helps to distinguish fraudulent and benign connections. The "reinforcement learning" process is used to adaptively learn how to select the most valuable neighbors. The diagram separates the subgraphs of different relationships (fraudulent neighbors red, benign neighbors blue, unlabeled neighbors green). For each specific relationship subgraph, the center node will aggregate the selected neighbor information from its neighbors under the current relationship based on the label-aware similarity and the filtering threshold determined by reinforcement learning, thereby generating the node representation under the corresponding relationship . That is, the "first node representation" of each specific relationship subgraph in the multi-relation graph captures the local information of the node under a single relationship.

[0056] The relationship inter-aggregation module takes the node representations under each relationship output by the relationship intra-aggregation module as input, first passes through a relationship gating mechanism for judging the importance of different relationships (such as ) to the center node, and gives different gating weights, then calculates the attention scores between the center node and the aggregated representations from different relationships by using sparse attention, and adopts a sparse Softmax function, so that only a few most relevant relationships are given non-zero attention weights, thereby focusing on key relationships. Finally, through this fusion gating attention strategy, the information under all relationships is weighted and aggregated to form a more comprehensive "second node representation" , which integrates information in different relationship dimensions.

[0057] The relationship fusion module fuses the representations obtained in the previous two steps. The node representations under each relationship obtained from "Step 1 relationship intra-aggregation" , and the comprehensive inter-relationship representation obtained from "Step 2 relationship inter-aggregation" , and even the node representation of the previous layer of GNN are all pieced together to form the final node representation , which is the "final embedding representation" of the model. The final embedding representation is the final integration of multi-level and multi-dimensional information of the node, and has strong discriminability. It is then input into the classifier to identify and judge whether the user is a "benign user" or a "fraudulent user".

[0058] The SGARL-GNN model proposed in the present application realizes efficient detection through sparse gating attention and reinforcement learning neighbor selection mechanism. First, label-aware neighbor sampling is used to filter similar neighbors according to the semantic distance of node prediction distribution. Second, reinforcement learning is used to dynamically adjust the relationship neighbor sampling threshold, realizing adaptive neighbor selection. Finally, sparse gating attention is introduced to reduce computational complexity while enhancing key signal capture, accurately capturing fraudulent features and improving generalization ability. Experimental results show that in the task of social network fraud detection, SGARL-GNN significantly outperforms CARE-GNN model, with an AUC value improvement of 6.82% on the Amazon dataset and an AUC value improvement of 3.71% on the Yelp dataset, verifying the effectiveness of SGARL-GNN in multi-relation graph fraud detection.

[0059] Embodiment In this study, Python 3.11 and PyTorch 2.3 are used to implement the SGARL-GNN algorithm. In order to improve the training efficiency and avoid overfitting, small batch training and undersampling techniques are used to train the SGARL-GNN. Specifically, in each small batch, the number of negative instances is randomly selected to be the same as the number of positive instances. The same embedding size (64), batch size (Yelp: 1024, Amazon: 256), learning rate (0.01), similarity loss weight ( ), L2 regularization weight ( ) are used for all models. The training ratio of 40% is used in the experiment.

[0060] This application uses two public datasets commonly used in fraud detection. Table 1 lists various statistical information of the Yelp and Amazon datasets, including the number of nodes, edges, fraud rates, relationship categories, and relationship descriptions.

[0061] Table 1 Dataset Information

[0062] The Yelp dataset is collected from the internal dataset published by Yelp.com, the largest business review website in the United States. In addition to containing information about the relationship between users and products, the dataset also contains various metadata, including the text content of the review, timestamp, and star rating.

[0063] The Amazon dataset contains more than 34,000 consumer reviews, from which 11,949 product reviews under the musical instrument category are extracted as the Amazon dataset used in this application. In this application, users with a useful voting rate greater than 80% are labeled as benign users, and users with a useful voting rate less than 20% are labeled as fraudulent users.

[0064] In order to verify the effectiveness of the SGARL-GNN method proposed in this application, this application compares 7 graph neural network models and their improved methods: GCN, GraphSAGE, GAT, Graph-SAINT, GraphConsis, CARE-GNN, PC-GNN. Table 2 gives the detection performance of all comparison methods, from which it can be seen that the performance of the SGARL-GNN method is better than all comparison methods, proving its effectiveness.

[0065] Table 2 Fraud detection performance comparison of the models in this application and the existing 7 models

[0066] In Table 2, represents the recall rate, ; AUC (Area Under the ROC Curve) represents the area under the Receiver Operating Characteristic Curve (ROC), the higher the AUC value, the better the classification performance of the model, used to evaluate the overall performance of the binary classification model, the ROC curve is plotted with the false positive rate FPR as the x-axis and the true positive rate TPR as the y-axis, , wherein, represents the number of discrete points (or thresholds) used to draw the ROC curve, represents the false positive rate (FPR) corresponding to the th point on the ROC curve, The calculation formula is , represents the true positive rate (TPR) corresponding to the th point on the ROC curve, The calculation formula is . , wherein, , represents the sample predicted as positive by the positive example; represents the sample predicted as positive by the negative example; represents the sample predicted as negative by the positive example; The negative example is predicted as a negative example. Compared with the classic graph neural network models GCN, GAT and Graph-SAG, the detection performance of the SGARL-GNN method of the application is significantly improved, the main reason is that these classic graph neural network models are not specially designed for fraud scenarios, so the best detection effect cannot be obtained. In the Amazon dataset, the AUC index of the model of the application is improved by 13.8% compared with the GCN model; in the Yelp dataset, the AUC index of the model of the application is improved by 20.07% compared with the GCN model. The performance of the fraud detection model of the graph neural network based on class imbalance processing GraphSAINT and PC-GNN is better than that of the classic graph neural network model, but is weaker than the SGARL-GNN model of the application. In the Amazon dataset, the AUC index of the model of the application is improved by 1.86% compared with the PC-GNN model; in the YelpChi dataset, the AUC index of the model of the application is improved by 0.03% compared with the PC-GNN model. GraphConsis and CARE-GNN are models proposed for the possibility of disguising behavior or noise in the dataset. The SGARL-GNN model adds a sparse attention and a gating mechanism, which can better suppress the noise to identify the disguising behavior of the fraudster. In the Amazon dataset, the AUC index of the model of the application is improved by 6.82% compared with the CARE-GNN model; in the Yelp dataset, the AUC index of the model of the application is improved by 3.71% compared with the CARE-GNN model.

[0067] Further, the effectiveness of the two key modules of the SGARL-GNN model is verified by ablation experiments. The application constructs two variant models SGARL-GNN / s and SGARL-GNN / g. Among them, SGARL-GNN / s only uses the reinforcement learning module and the gating mechanism module in the complete method SGARL-GNN, and does not use the sparse attention module. SGARL-GNN / g only uses the reinforcement learning module and the sparse attention module in the complete method SGARL-GNN, and does not use the gating mechanism module. The experimental results are shown in Table 3.

[0068] Table 3 Fraud detection performance comparison of SGARL-GNN model and its two variants

[0069] As shown in Table 3, the experimental results clearly prove that the two modules play an important role in improving the performance of the model, and the complete model achieves the best performance in most indicators. It shows that the sparse attention module and the gating mechanism module work together to improve the fraud detection ability of the model. Combined with the analysis of the performance of the complete model and the two variants, it can be seen that the sparse attention module and the gating mechanism module can effectively improve the performance of the model. Figure 3 and Figure 4 , Figure 3 and Figure 4Amazon dataset model index comparison and Yelp dataset model index comparison according to embodiments of the present application are shown respectively. As shown in Figure 3 , Figure 4 The performance of SGARL-GNN / s on both datasets is significantly lower than that of the complete model. On the Amazon dataset, the AUC index of the complete model is 1.97% higher than that of the SGARL-GNN / s variant; on the Yelp dataset, the AUC index of the complete model is 4.41% higher than that of the SGARL-GNN / s variant. This fully demonstrates that the sparse attention module is crucial in focusing on key information and suppressing noise interference, and removing it leads to a decline in the model's ability to capture fraud patterns. Secondly, SGARL-GNN / g also shows performance degradation on both datasets. On the Amazon dataset, the AUC index of the complete model is 1.92% higher than that of the SGARL-GNN / g variant; on the Yelp dataset, the AUC index of the complete model is 4.62% higher than that of the SGARL-GNN / g variant. This shows that the gating mechanism module is indispensable in effectively fusing information and dynamically adjusting information flow, and removing it harms the model's performance in complex scenarios.

[0070] With reference to Figure 5 , as an implementation of the above method, in a second aspect, the present application provides an embodiment of a framework diagram 500 of a fraud detection system based on an attention mechanism graph neural network, which corresponds to the method embodiment shown in Figure 1 , and the system can be applied to various electronic devices. The system 500 includes a data processing and graph construction module 501, a first node representation acquisition module 502, a second node representation acquisition module 503, and a final embedding representation acquisition and classification module 504, which are connected in communication with each other, wherein: The data processing and graph construction module 501 is configured to convert raw data into a structured multi-relation graph, wherein entities are modeled as nodes, and various interactions between the entities are modeled as edges, and the nodes and edges are assigned initial feature representations; The first node representation acquisition module 502 is configured to calculate the semantic similarity between the center node and its neighbor nodes of a specific relationship subgraph in the multi-relation graph based on a label-aware mechanism; adaptively adjust the selection filtering threshold of the neighbor nodes using a reinforcement learning mechanism; and aggregate the selected neighbor node information to form a first node representation of each specific relationship subgraph in the multi-relation graph; wherein the specific relationship subgraph refers to a graph layer of a single relationship type in the multi-relation graph; The second node representation acquisition module 503 is configured to dynamically evaluate the importance of each specific relationship subgraph in the multi-relation graph to the center node using an attention mechanism, and assign corresponding weights to form a comprehensive second node representation; The final embedding representation obtaining and classifying module 504 is configured to fuse the first node representation, the second node representation, and the node representation of the previous layer of the GNN to form a final embedding representation; and input the final embedding representation into a classifier to identify and determine fraudulent behavior.

[0071] Although the principles of the present application have been described in detail above with reference to the preferred embodiments thereof, it is understood that the above embodiments are merely illustrative of the present application and are not intended to limit the scope of the present application. The details in the embodiments do not constitute a limitation on the scope of the present application. Any equivalent changes, simple replacements, and the like based on the technical solutions of the present application, without departing from the spirit and scope of the present application, all fall within the protection scope of the present application.

Claims

1. An attention mechanism-based graph neural network fraud detection method, characterized in that, The method comprises: S1, converting original data into a structured multi-relation graph, wherein entities are modeled as nodes, various interactions between the entities are modeled as edges, and initial feature representation of the nodes and the edges is assigned; S2, based on a label perception mechanism, calculating semantic similarity between a center node of a specific relationship subgraph in the multi-relation graph and neighbor nodes thereof; using a reinforcement learning mechanism to adaptively adjust a selection filtering threshold of the neighbor nodes; and aggregating information of the selected neighbor nodes to form a first node representation of each specific relationship subgraph in the multi-relation graph; wherein the specific relationship subgraph refers to a graph layer of a single relationship type in the multi-relation graph; S3, using an attention mechanism to dynamically evaluate importance of each specific relationship subgraph in the multi-relation graph to a center node and assign a corresponding weight to form a comprehensive second node representation; S4, fusing the first node representation, the second node representation, and a node representation of a previous layer of GNN to form a final embedding representation; inputting the final embedding representation into a classifier to identify and judge fraudulent behavior.

2. The attention mechanism based graph neural network fraud detection method of claim 1, wherein, The S2 step comprises: S21, using a multi-layer perception to obtain label perception representation of the center node and the neighbor nodes, and calculating cosine feature similarity between the center node and the neighbor nodes; S22, based on the cosine feature similarity, performing descending order sorting on the neighbor nodes of the center node, and selecting Top-k neighbor nodes with the highest cosine feature similarity as sampling neighbors of the center node in combination with an adaptive filtering threshold determined by reinforcement learning.

3. The attention mechanism based graph neural network fraud detection method of claim 2, wherein, In the first layer of the GNN Layer and relationship The cosine feature similarity The calculation formula is: wherein is the center node; is a neighbor node of the center node; is an activation function; is a multi-layer perceptron; is a center node output at a layer of the GNN label-aware representation; is a neighbor node output at a layer of the GNN label-aware representation.

4. The attention mechanism based graph neural network fraud detection method of claim 2, wherein, The S22 step comprises modeling the process of selecting neighbors for each layer of the GNN for a specific relationship as a Markov decision process by defining a state space , an action space , and a reward function , to adaptively learn the optimal neighbor selection filter threshold combination, wherein the reward function is expressed as: In the formula, Candidate neighbor nodes Its current value , For GNN layer; Neighboring nodes In relationship Embedded representation below; For relationship The value function under; In relation Below, the average value of all neighboring nodes in previous training rounds; Tolerance parameters are used to avoid mistakenly discarding valuable neighbor nodes; actions Defined as the current relation Next specific candidate neighbors The choice decision, in which This indicates that the neighbor node is selected and retained. , This indicates that the neighboring node is discarded. .

5. The attention mechanism based graph neural network fraud detection method of claim 1, wherein, The attention mechanism comprises a relation gating mechanism, based on the label-aware representation of the center node and the features aggregated within a specific relation, the relation gating weight is calculated by using the relation gating mechanism : wherein is the GNN's relationship gating weight for layer l; and are learnable weight and bias parameters, respectively; is an activation function; is the central node the label-aware representation for layer the label-aware representation for layer 6. The attention mechanism based graph neural network fraud detection method of claim 1, wherein, The attention mechanism comprises a sparse attention mechanism, which calculates attention scores between a center node and different relationship neighbor nodes, and generates a sparse attention weight distribution through a sparse Softmax function, wherein the calculation formula of the attention scores is: wherein, is the attention score for the center node layer, for the center node and neighbor nodes in the relation ; and are multi-layer perceptrons transforming features of the center node and the neighbor nodes , respectively; is the feature dimension; is a sparse Soft max function.

7. The attention mechanism based graph neural network fraud detection method of claim 1, wherein, The attention mechanism adopts a fusion gate attention strategy, the fusion gate attention strategy comprising: calculating, at a GNN first layer, a gate weight of each relationship for a center node by a relationship gate mechanism calculating an attention weight between the center node and different relationship neighbor nodes by a sparse attention mechanism a fusion representation of the fusion gate attention strategy being: wherein is the center node at the i-th layer of the GNN fuses all relational information in the final aggregated representation; is an activation function; is the total number of relations; is the gating weight at the i-th layer of the GNN and the relation ; is the center node in the set of neighbor nodes under the relation ; is a multi-layer perceptron that performs value transformation on the neighbor node features at the i-th layer of the GNN ; is the embedding representation of the neighbor node at the i-th layer of the GNN .

8. The attention mechanism based graph neural network fraud detection method of claim 1, wherein, The final loss function is: wherein, is the final loss function in the model training process; is the cross-entropy loss function in the node classification task; is the cross-entropy loss of the label-aware similarity metric for the whole network; and are weight parameters, respectively; is the L2 norm of all model parameters; is the true label information of the center node ; is an activation function; is a multi-layer perceptron applied to the final embedding of the node at the layer of the GNN; is the final embedding representation of the center node after processing; is the cross-entropy loss of the label-aware similarity metric calculated at the layer of the GNN; is the embedding representation of the center node at the layer of the GNN; is the final aggregated node feature within the three kinds of relationships; is the final aggregated representation of the center node at the layer that fuses all relationship information; Concat is a feature concatenation operation.

9. A graph neural network model based on sparse gated attention and reinforcement learning, characterized in that, The attention mechanism-based graph neural network fraud detection method according to claim 7 is constructed, and the model comprises a relationship intra-aggregation module, a relationship inter-aggregation module, and a relationship fusion module, wherein The relationship intra-aggregation module is configured to calculate semantic similarity between a center node of a specific relationship subgraph and neighbor nodes thereof based on a label perception mechanism, adaptively adjust a filtering threshold of the neighbor nodes selected by reinforcement learning, and aggregate information of the selected relationship intra-neighbor nodes to form the first node representation of each specific relationship subgraph of the multi-relation graph; The relationship inter-aggregation module is configured to dynamically evaluate importance of each specific relationship subgraph in the multi-relation graph to a center node using the fusion gated attention strategy, assign a corresponding weight, and realize sparsification of the attention weight in combination with the sparse attention mechanism to form the comprehensive second node representation; The relationship fusion module is configured to generate the final embedding representation after completing aggregation of the relationship intra-module and the relationship inter-module.

10. An attention mechanism based graph neural network fraud detection system, characterized in that, The system comprises: A data processing and graph construction module is configured to convert raw data into a structured multi-relation graph, in which entities are modeled as nodes, and various interactions between the entities are modeled as edges, and initial feature representations are assigned to the nodes and the edges; A first node representation acquisition module is configured to calculate semantic similarity between a center node and its neighbor nodes in a specific relation subgraph in the multi-relation graph based on a label-aware mechanism, to adaptively adjust a selection filtering threshold of the neighbor nodes using a reinforcement learning mechanism, and to aggregate information of the selected neighbor nodes to form a first node representation of each specific relation subgraph in the multi-relation graph, wherein the specific relation subgraph refers to a graph layer of a single relation type in the multi-relation graph; A second node representation acquisition module is configured to dynamically evaluate the importance of each specific relation subgraph to a center node in the multi-relation graph using an attention mechanism, and to assign corresponding weights to form a comprehensive second node representation; A final embedding representation acquisition and classification module is configured to fuse the first node representation, the second node representation, and a node representation of a previous layer of GNN to form a final embedding representation, and to input the final embedding representation into a classifier to identify and judge fraudulent behavior.

Images