Anti-fraud method and system

Abstract

The invention discloses an anti-fraud method and system, which is based on a feature importance distribution mechanism of a gradient boosting decision tree (GBDT), automatically learns an optimal weight combination of relation features and individual features, and identifies a high-order interaction effect of the relation features of gang and individual features of a single point by using a nonlinear fitting capability of a tree model. A graph algorithm captures a relation change relation and supplements the relation change relation to traditional individual change features, the problems that a traditional single-point model cannot capture an incidence relation and an independent graph algorithm ignores individual behaviors to cause misinformation are solved, and fusion of multi-dimensional fraud features is achieved. The individual features and the relation features are combined and input into a CatBoost algorithm for reasoning and judgment, and the higher accuracy rate and the higher recall rate compared with a single graph algorithm model and a single Boosting algorithm model are obtained.

Description

Technical Field

[0001] This invention relates to the field of risk control technology, specifically to an anti-fraud method and system. Background Technology

[0002] Anti-fraud is a risk identification and prevention service targeting transaction fraud, online fraud, and telephone fraud. It is an important component of internet finance, using technological means to identify potential fraudulent activities and protect users' assets and information security. Its core system comprises five modules: data collection, fraud detection, database, system management, and monitoring reports. It relies on rule engines, scoring engines, and user behavior analysis technologies for real-time judgment and utilizes credit scoring systems and blacklist systems to support risk decision-making. Typical application scenarios include real-time interception of telecom fraud, blocking stolen card transactions, and identifying AI-generated deepfake fraud.

[0003] With the development of financial digitalization, anti-fraud technology has been gradually embedded into the banking business architecture since the 2010s, adapting to the evolution of fraud methods through dynamic rule bases and machine learning models. The introduction of industry standards such as the "Measures for Anti-Insurance Fraud Work" in 2024 promoted the establishment of a full-process risk management system and cross-departmental collaboration mechanisms, marking the entry of anti-fraud services into a stage of institutionalized development. Current mainstream solutions combine big data, knowledge graphs, and multimodal AI to form a closed-loop prevention and control system from early warning to post-event tracing. Currently, there are two main technical approaches to bank anti-fraud technology:

[0004] Single-point machine learning models (such as GBDT, XGBoost, and CatBoost algorithms based on gradient boosting decision trees). Advantages: High accuracy and engineering maturity in modeling account-level features (such as transaction frequency and amount distribution). Disadvantages: Limited to local behavior analysis of a single account entity, unable to capture cross-account collaborative fraud patterns, such as network-like fund transfers in organized crime, money laundering paths involving multiple nodes, and covert connections through shared devices / IP addresses.

[0005] Independent graph algorithm model. Advantages: It mines group structure characteristics (such as abnormally dense subgraphs) and group behavior characteristics (such as closed funding loops) through graph topology analysis (e.g., community detection, path tracing). Disadvantages: It lacks collaborative decision-making capabilities with static account characteristics, and its failure to consider individual behavioral profiles leads to a higher false positive rate.

[0006] Existing solutions, such as graph algorithms (e.g., community detection and centrality calculation), while capable of uncovering group topological features, neglect individual behavioral baselines, leading to high false positive rates. The CatBoost model relies on static features of single accounts (e.g., transaction frequency and amount distribution), failing to capture coordinated fraudulent behavior across accounts. Overall, these technologies are ineffective in identifying fraud in the fintech sector, necessitating a solution that can effectively improve anti-fraud capabilities in this field. Summary of the Invention

[0007] The purpose of this invention is to provide an anti-fraud method and system that combines relational features extracted by graph algorithms with single-account features into a machine learning classifier to achieve deep coupling of multi-dimensional features, thereby solving the problems of high false alarm rate in the identification of single fraud features and inability to capture cross-account collaborative fraud behavior in the prior art.

[0008] To achieve the above objectives, embodiments of this application provide an anti-fraud method, including:

[0009] The account features are used to generate relation features using graph algorithms; a graph is constructed based on the graph algorithms, and threshold values ​​for node, edge, and edge attribute weights are set; based on the node, edge, and edge attribute weight thresholds, different types of relation features for nodes, edges, and edge attributes are generated using multiple graph algorithms.

[0010] The relationship features corresponding to accounts are filtered, and combined with the individual features of the accounts, binary classification reasoning is performed. The CatBoost algorithm is used to train the data and adjust the parameters to output a fraud model.

[0011] Fraudulent behavior is screened based on fraud models.

[0012] The step of generating relational features from account features using graph algorithms includes:

[0013] By utilizing multiple graph algorithms with multiple directions, the relationship features between fraudsters and between fraudsters and victims are mined on multiple graphs, generating multiple different types of relationship features; the multiple graphs include graphs that mine different relationships formed by fraudster accounts, victim accounts, associated devices, associated network addresses (IPs), and latitude and longitude nodes.

[0014] The nodes include: an account, the device associated with the account transaction, and the network address (IP) where the account transaction took place.

[0015] The edges include: inter-account transfers, shared devices, and shared network addresses (IP addresses);

[0016] The edge weights include indicators related to transaction amount, transaction frequency, device login frequency, and active duration of logged-in devices.

[0017] The graph algorithms include community detection algorithms, centrality classification algorithms, and similarity algorithms; community detection algorithms include the Leuven algorithm and the tag propagation algorithm; centrality classification algorithms include the PageRank algorithm, betweenness centrality algorithm, proximity centrality algorithm, degree centrality algorithm, and eigenvector centrality algorithm; similarity algorithms include node similarity algorithms and Euclidean similarity algorithms.

[0018] Multiple graph algorithms are used to output various graph features related to accounts; each graph algorithm outputs multiple corresponding graph features as relation features by adjusting edge weights and edge weight thresholds.

[0019] The relationship features corresponding to the filtered accounts, combined with the individual characteristics of the accounts, are used to perform binary classification reasoning operations, including:

[0020] The relationship characteristics of accounts include community discovery features, centrality features, and similarity features; individual account characteristics include: account transaction behavior features, account and customer attribute features, device, IP and other features, operational behavior features, and transaction time pattern features.

[0021] Calculate the feature IV value; select features with high feature IV values ​​that effectively distinguish between black and white samples for binary classification inference.

[0022] The training data and parameter adjustment using the CatBoost algorithm include:

[0023] The individual account features and relationship features are input into the CatBoost algorithm for training. During the training process, various feature combinations are tried, and the relationship features and individual account features are fully matched and measured to calculate multiple optimal combinations and optimal combination threshold classification paths, thus obtaining the optimal feature combination.

[0024] The dataset is divided by inputting individual account features and relationship features, along with corresponding account black and white labels. The model is then trained using the CatBoost algorithm, and the output model file serves as the fraud model.

[0025] During the training and parameter adjustment of the fraud model, the feature_crosses parameter of the CatBoost algorithm is used to force the combination of relationship features and account individual features, manually guide the cross-specification of high-value feature combinations and priority control, set weight values, and determine the priority of cross features in tree splitting.

[0026] Based on the relationship features and individual features of the account, the value of feature IV is selected. The relationship features and individual features with high feature IV values ​​are combined in pairs in the feature_crosses parameter, and the weights of the relationship features and individual features are set to optimize the CatBoost parameter.

[0027] On the other hand, this application provides an anti-fraud system, including: a graph algorithm unit, used to generate relation features from account features using graph algorithms; constructing a graph according to the graph algorithm and setting thresholds for node, edge, and edge attribute weights; and generating different types of relation features for nodes, edges, and edge attributes using multiple graph algorithms according to the thresholds for node, edge, and edge attribute weights.

[0028] The CatBoost algorithm unit is used to filter the relationship features corresponding to accounts, combine them with the individual features of accounts, perform binary classification inference operations, use the CatBoost algorithm to train data and adjust parameters, and output a fraud model.

[0029] The anti-fraud identification unit is used to screen account behavior for fraudulent activities based on fraud models.

[0030] The graph algorithm unit is also used to mine the relationship features between fraudsters and between fraudsters and victims on multiple graphs using multiple graph algorithms of various directions, and generate multiple different relationship features; using multiple graph algorithms, output various graph features related to the account; each graph algorithm outputs multiple corresponding graph features as relationship features by adjusting edge weights and edge weight thresholds;

[0031] The CatBoost algorithm unit is also used to input account individual features and relationship features into the CatBoost algorithm for training; during the training process, it tries various feature combinations, fully matches and calculates the relationship features with account individual features, calculates multiple optimal combinations and optimal combination threshold classification paths, and obtains the optimal feature combination; it divides the input account individual features, relationship features and corresponding account black and white labels into datasets, uses the CatBoost algorithm for training, and outputs a model file as a fraud model; during the training and parameter adjustment of the fraud model, it uses the feature_crosses parameter of the CatBoost algorithm to force the combination of relationship features and account individual features, performs manual guidance to specify high-value feature combinations and priority control, sets weight values, and determines the priority of cross features in tree splitting; it filters feature IV values ​​based on the relationship features and account individual features corresponding to the account, combines relationship features and account individual features with high feature IV values ​​in pairs in the feature_crosses parameter, sets the weights of relationship and individual features, and optimizes the CatBoost parameters.

[0032] The method and system provided in this application, based on the feature importance allocation mechanism of Gradient Boosting Decision Tree (GBDT), automatically learns the optimal weight combination of relationship features and individual features. Utilizing the nonlinear fitting capability of the tree model, it identifies high-order interaction effects between the relationship features of a group and the individual features of a single point. Graph algorithms capture dynamic relationship changes, while CatBoost models static behavioral patterns; the combination of both identifies spoofing behavior that is "statically normal but dynamically abnormal." This solves the problems of traditional single-point models failing to capture correlations and false positives caused by independent graph algorithms ignoring individual behavior, achieving the fusion of multi-dimensional fraud features. Compared to a single algorithm model, precision is improved by more than 5%, and recall by more than 7%. Attached Figure Description

[0033] Figure 1 A flowchart of an anti-fraud method provided according to an embodiment of this application;

[0034] Figure 2 This is a schematic diagram of the structure of an anti-fraud system provided according to an embodiment of this application;

[0035] Figure 3 This is a schematic diagram of the functional structure and message flow of an anti-fraud scheme according to a specific embodiment of this application. Detailed Implementation

[0036] To better understand the present invention, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of the present invention and are not intended to limit the embodiments of the present invention. Various modifications can be made to the embodiments as long as the effects of the present invention are achieved.

[0037] This invention proposes a heterogeneous feature fusion framework, which achieves deep coupling of multi-dimensional features by jointly inputting the relational feature vectors of gang behavior extracted by graph algorithms with the individual account features of a single account into a machine learning classifier (such as CatBoost). The technical breakthroughs include:

[0038] The combination of individual (single) and relational (group) characteristics of fraudulent behavior complements each other, creating blind spots in fraud characteristics.

[0039] In existing technologies, traditional CatBoost models rely on static features of single accounts (such as transaction frequency and amount distribution), which cannot capture cross-account collaborative fraud behaviors (such as closed-loop fund transactions, device sharing, and other gang-related crime patterns). Independent graph algorithms (such as community detection and centrality calculation) can uncover gang topology features, but they ignore individual behavioral baselines (such as the transaction time patterns of normal users), leading to a high false positive rate (such as misjudging corporate financial groups as money laundering gangs).

[0040] If the two feature spaces are complementary, the relational features such as community labels and PageRank values ​​generated by the graph algorithm are concatenated with the account-level features (such as historical transaction statistics) processed by CatBoost to form a wide-table feature space, which simultaneously covers risk signals of "individual anomalies" and "group collaboration". Dynamic and static integration: the graph algorithm captures dynamic relationship changes (such as fund flow paths), and CatBoost models static behavioral patterns (such as account activity). The combination of the two can identify disguised behaviors that are "statically normal but dynamically abnormal".

[0041] Among them, the feature importance allocation mechanism based on gradient boosting decision tree (GBDT) automatically learns the optimal weight combination of relational features and point features (e.g., capturing association rules of "sudden transactions of accounts within the same community" through split point selection). Utilizing the nonlinear fitting capability of the tree model, it identifies higher-order interaction effects between group features and single-point features (e.g., high centrality account + abnormal login time = high-risk fraud signal).

[0042] In this embodiment of the invention, the CatBoost algorithm (point-dimensional features) and the graph algorithm (relationship-dimensional features) complement each other at the architectural level. By using graph algorithms of multiple directions, the relationship features between fraudsters and between fraudsters and victims are mined on multiple graphs (including graphs that mine different relationships formed by nodes such as fraudster accounts, victim accounts, associated devices, associated IPs, and latitude and longitude), generating multiple types of effective features.

[0043] Next, these relational features are input into the CatBoost model. Combining the relational features with point features at the account level, binary classification inference is performed to predict risky accounts. Table 1 shows the decoupling and complementarity relationships in the feature space.

[0044] Table 1

[0045]

[0046] This invention proposes a heterogeneous feature fusion framework. By combining gang relationship features extracted by graph algorithms with individual account features, and inputting these features into a CatBoost gradient boosting decision tree model for training and prediction, it achieves high-precision identification of gang fraud and complex money laundering patterns in financial anti-fraud scenarios. This solution solves the problems of traditional single-point models failing to capture correlations and false positives caused by independent graph algorithms ignoring individual behaviors. It achieves the fusion of multi-dimensional fraud features, performs inference and judgment in the CatBoost algorithm, and obtains higher precision and recall compared to single graph algorithm models and single Boosting algorithm models.

[0047] The core process of this invention's technical embodiments includes three stages: generating fraud features using graph algorithms, feature selection and fusion, and CatBoost model training and optimization. The entire process achieves deep coupling of multi-dimensional information through feature engineering and model collaboration.

[0048] Figure 1 The flowchart of the anti-fraud method provided in the embodiments of this application is shown, wherein,

[0049] Step 101: Use graph algorithms to generate relational features from account features.

[0050] The concealment of transaction fraud stems from the disguise of "normal individual behavior, abnormal collective cooperation" (such as a single transaction being compliant, but the group cooperating to launder money).

[0051] The blind spot of traditional models is that they only analyze the static characteristics of isolated accounts (such as transaction amount and frequency) and cannot identify collaborative fraud patterns across entities.

[0052] Graph algorithms elevate data from "points" to "relationship networks," capturing systemic vulnerabilities in fraud through "structural signals" (such as funding loops and community density). This is equivalent to adding spatial (node ​​location) and dynamic (path evolution) dimensions to the data. Table 2 shows the structural telecommunications fraud methods of the three major graph algorithm directions.

[0053] Table 2. Structure of Three Major Graph Algorithms in Telecommunications Fraud

[0054]

[0055] Graph algorithms offer advantages that traditional machine learning algorithms cannot replace. Their unique feature extraction mechanism extracts group behavioral patterns from relationships, rather than individual statistics. They also offer anti-fraud advantages, as fraudsters find it difficult to manipulate relationships across the entire network simultaneously (the cost is far higher than forging a single account).

[0056] In this application embodiment, fraudulent activities (especially organized fraud) are often characterized by complex and hidden networks of relationships between multiple entities. Visualizing and structuring these relationships allows concealed fraudulent groups (such as those involved in circular transfers or bulk account control) to emerge from the data. Fraudulent groups often use complex transaction networks to hide their true intentions, and visualization effectively reveals these hidden connections.

[0057] The graph model in transaction anti-fraud is the foundation of the algorithm. By transforming discrete transaction data into a relation-rich network, it greatly enhances the ability to identify complex fraud patterns.

[0058] The nodes, relationships (edges) between nodes, and edge weights used in each algorithm are as follows. Different algorithms may have different thresholds for selecting nodes, edges, and edge attribute weights.

[0059] Nodes: Accounts (including our bank's accounts and other banks' accounts, as well as personal WeChat accounts, Alipay accounts, and other third-party payment accounts with merchant IDs removed), the devices associated with the account transactions, and the IP addresses where the account transactions took place.

[0060] Edge: Inter-account transfers (with or without a transaction direction), shared devices (accounts logged in on the same device), shared IPs (accounts on the same IP address).

[0061] Edge weights: Relevant indicators such as transaction amount, transaction frequency, device login frequency, and active duration of logged-in devices (mean, sum, variance, etc.).

[0062] In this embodiment of the invention, various graph algorithms are used to generate different types of relation features. These graph algorithms can be those listed below, or other graph algorithms, but their basic principles are similar.

[0063] 1. Community detection algorithm (to identify fraud and money laundering groups)

[0064] The algorithm includes several options:

[0065] 1) Louvain Algorithm

[0066] Louvain is a community discovery algorithm based on modularity optimization. It maximizes the modularity of the entire network (an indicator that measures the tightness within a community and the sparsity between communities) by continuously iterating and merging nodes, thereby dividing accounts in the transaction network into multiple communities with tight internal connections and sparse external connections.

[0067] In transaction fraud prevention, its core function is to expose fraud gangs hidden in complex transaction networks: Since fraudulent activities (such as gang-related order brushing and illegal fund transfers) are usually carried out by multiple accounts in concert, these accounts form an unusually dense transaction association. The Leuven algorithm can automatically identify these hidden "communities" and target them as high-risk gangs for precise strikes.

[0068] 2) Label Propagation Algorithm

[0069] Label Propagation uses the principle of "one is influenced by one's surroundings" to combat fraud in transactions: First, a transaction relationship graph is constructed (nodes represent entities such as accounts / devices, edges represent transactions or relationships, and the weight of the edges usually reflects the strength of the relationship or similarity), and a "bad" label is assigned to a small number of known fraudulent nodes; then, through iterative propagation, each node updates its own label based on the labels of its neighboring nodes (voting according to weight) until the network stabilizes.

[0070] Its essential role in anti-fraud is to efficiently uncover potential fraud groups and risk associations—using known fraud points as "seeds" and spreading fraud labels to unknown risk nodes closely related to them and with similar behaviors through the relationship chain of the transaction network, thereby identifying collaborative fraud groups hidden in complex networks, rather than just focusing on single points of anomaly.

[0071] Composition:

[0072] Nodes: Transaction account, associated device, and IP address;

[0073] Edge: Fund transfer transactions, shared equipment, shared IP address;

[0074] Edge weights: transaction metrics, login device metrics, login IP metrics.

[0075] 2. Centrality classification algorithm

[0076] This includes the five types of centrality algorithms listed in Table 3.

[0077] Table 3

[0078]

[0079] Composition:

[0080] Node: Transaction account;

[0081] Side: Transfer transaction;

[0082] Edge weight: a trading indicator.

[0083] 3. Similarity Algorithm

[0084] The algorithm includes several options:

[0085] 1) Node Similarity Algorithm

[0086] Node similarity algorithms achieve anti-fraud by quantifying the structural or attribute similarity between nodes (such as accounts, devices, etc.) in a transaction network. The principle is based on the assumption of "birds of a feather flock together". Using methods such as Jaccard coefficient and cosine similarity, the algorithm calculates the proportion of shared neighbors or the closeness of attribute vectors between nodes, thereby identifying potential risk nodes that are highly similar to the behavior patterns of known fraudulent nodes.

[0087] Its essential role in anti-fraud is to detect hidden, coordinated fraudulent activities. Even if an unknown node has no direct transactional relationship with a known fraudulent node, it can be accurately identified through similarities in its network connection patterns (such as shared devices and IPs) or behavioral characteristics (such as transaction frequency and amount distribution), effectively identifying potential members of fraud gangs or those who have forged identities.

[0088] 2) Euclidean Similarity Algorithm

[0089] Euclidean similarity is used to combat fraud by calculating the linear distance between transaction feature vectors (such as amount, time, location, etc.) in a multidimensional space (the smaller the distance, the higher the similarity). Its core function is to accurately quantify the degree of abnormality in transaction behavior. By comparing the Euclidean distance with known normal transaction patterns, it can quickly identify abnormal transactions that deviate significantly from the normal distribution in the feature space (such as abnormal amount, abnormal time, etc.), thereby effectively detecting potential fraudulent behavior.

[0090] Composition:

[0091] Node: Device ID, IP address, and the region block containing its latitude and longitude;

[0092] Edge: Shared devices, shared IP addresses, and located in the same latitude and longitude region;

[0093] Edge weight: The number of transactions reaches a certain threshold, or the transaction amount reaches a certain threshold.

[0094] In this embodiment of the invention, a graph is constructed using a graph algorithm, and threshold values ​​for the weights of nodes, edges, and edge attributes are set. Based on these threshold values, multiple graph algorithms are used to generate different types of relational features for nodes, edges, and edge attributes.

[0095] Various graph algorithms are used to output various graph features related to accounts. An algorithm can output multiple graph features of a certain type by adjusting edge weights and edge weight thresholds. For example, the Louvain algorithm can output six features, including the sum, mean, and variance of the frequency of transactions with an amount of M or more in the N hours prior to the transaction, and the sum, mean, and variance of the transaction amount. These features, with the account as the dimension, will be used for feature evaluation and selection in the subsequent CatBoost algorithm.

[0096] Step 102: Filter the relationship features corresponding to the accounts, combine them with the individual features of the accounts, perform binary classification reasoning, use the CatBoost algorithm to train the data and adjust the parameters, and output the fraud model.

[0097] CatBoost follows the basic paradigm of gradient boosting decision trees, iteratively building weak learners (decision trees) and combining them into a strong learner to gradually optimize the loss function. Its core process includes:

[0098] Initialize the model: Set initial prediction values ​​(such as the target mean).

[0099] Gradient calculation: Calculate the negative gradient (pseudo residual) of the loss function as the new target value.

[0100] Tree structure generation: The training decision tree fits the pseudo residuals and adopts the symmetric tree (Oblivious Trees) structure, that is, all nodes in the same layer use the same features and thresholds for splitting, which improves computational efficiency and generalization ability.

[0101] Model update: Add the new tree to the ensemble model with a learning rate weighting:

[0102] (x)= (x)+ (x)

[0103] Where η is the learning rate. For new trees.

[0104] Iteration Termination: Stop when the preset number of trees is reached or the loss converges.

[0105] CatBoost's advantages lie in its preprocessing-free categorical features and ordered boosting to prevent overfitting. It directly supports string-type categorical features, eliminating the need for manual One-Hot encoding or label encoding; it dynamically calculates target statistics for each category value and introduces prior smoothing to avoid low-frequency category noise. Traditional GBDT uses all samples to calculate gradients, easily leading to prediction bias (overfitting on the training set and poor performance on the validation set); CatBoost randomly sorts samples, and when calculating the gradient of each sample, it only uses the data before the sorting to train the temporary model, significantly reducing overfitting.

[0106] In this embodiment of the invention, the first step is to filter the input features, filter the relationship features corresponding to the accounts, and combine them with the individual features of the accounts to perform binary classification reasoning operations.

[0107] The features input to the CatBoost algorithm fall into two main categories:

[0108] 1. Graph characteristics (relationship characteristics) of the account's transaction network and network including devices and IP addresses:

[0109] 1) Community detection features. For example:

[0110] Equipment networks bring together groups;

[0111] Groups that leverage IP and latitude / longitude coordinates for location integration;

[0112] Groups with frequent suspicious transactions are flagged.

[0113] 2) Centrality features, for example:

[0114] Nodes that facilitate the transfer of large amounts of suspicious funds;

[0115] Fund collection nodes in the network;

[0116] Nodes in the network that have close transaction relationships with nodes that have been marked as black nodes.

[0117] 3) Similarity features, for example:

[0118] Nodes whose fund transfer behavior is similar to that of black nodes;

[0119] Nodes similar to black nodes in terms of the synchronization of various types of fund transactions;

[0120] The transaction characteristics of multiple nodes within the community are similar.

[0121] 2. Individual account characteristics. These include:

[0122] Account transaction behavior characteristics; account and customer attribute characteristics; device, IP, and other characteristics; operational behavior characteristics; transaction time pattern characteristics.

[0123] Calculate the Information Value (IV) value and select features with high IV values, indicating good performance in distinguishing between black and white samples. These selected features will then be input into the CatBoost algorithm for training and anti-fraud modeling.

[0124] In this embodiment of the invention, the CatBoost algorithm is used for training data and parameter tuning.

[0125] By inputting individual account features and various graph features (relationship features) into the CatBoost algorithm, CatBoost automatically tries multiple feature combinations during training. This helps to discover complex fraud patterns hidden in feature interactions. In this process, graph algorithm features are fully combined and measured with traditional individual features. The CatBoost algorithm calculates multiple optimal combinations and optimal combination thresholds for classification paths, thereby obtaining the optimal feature combination.

[0126] Generally, the more high-quality features a model has, the better it performs. Graph algorithms can effectively increase the number of high-quality features when inputting them. Furthermore, the greater the difference between features, the better, as different features may capture different dimensions of fraudulent behavior. Graph algorithms undoubtedly differ greatly from traditional individual feature algorithms, and their improvement in algorithm performance is significant.

[0127] Input sample features and account black and white labels, divide the dataset, train using the CatBoost algorithm, and output model file to complete the modeling.

[0128] During training and parameter tuning, the CatBoost feature_crosses parameter is used to force the combination of graph relationship features and account individual features, which can significantly improve the ability to identify complex fraud patterns.

[0129] Manually guided crossover: Breaking through the randomness of traditional GBRT automatic feature crossover, it explicitly specifies high-value feature combinations.

[0130] Priority control: Set weight values ​​to determine the priority of cross features in tree splitting (the higher the weight, the earlier the split).

[0131] The top 5 high-quality account relationship features and top 5 high-quality account individual features based on the previous IV values ​​are selected. In the `feature_crosses` parameter, relationship features and individual features are combined pairwise, and weights for relationship and individual features are set. The `CatBoost` parameter is then optimized in conjunction with other parameters.

[0132] Step 103: Filter account behavior for fraudulent behavior based on the fraud model.

[0133] In this embodiment of the invention, fraud models can be used to identify relevant behaviors of user accounts, thereby screening for fraudulent activities and achieving the purpose of anti-fraud.

[0134] This invention proposes a CatBoost financial risk control method based on multi-dimensional graph topology feature enhancement. By extracting rich graph algorithm features (such as centrality, community, path, etc.) from financial transaction, guarantee, social and other relationship data, and combining them with CatBoost's gradient boosting decision tree (GBDT) algorithm, the classification effect of the financial risk control model is significantly improved.

[0135] Extract sufficient graph topological features (such as node centrality, community structure, path features, etc.) to enhance the model's ability to model complex financial relationships; optimize the CatBoost feature fusion mechanism to enable graph features to work synergistically with traditional structured features to improve classification accuracy.

[0136] This approach is applicable to scenarios such as financial fraud prevention, credit scoring, and gang identification, effectively identifying implicit related risks that traditional risk control models struggle to capture. It achieves multi-dimensional graph relationship feature extraction, covering a more comprehensive range of risk dimensions. Traditional risk control models rely solely on individual account characteristics (such as age and income), while this method introduces relationship features, enabling the identification of complex patterns such as gang fraud and abnormal fund flows. Adapting to dynamic financial environments, individual account characteristics are relatively volatile, while graph relationship features are relatively more stable. Black market actors cannot easily alter the network topology, resulting in slower model performance decay and longer-lasting effectiveness. Utilizing the `feature_crosses` parameter of the CatBoost algorithm, it forces the integration of high-quality graph relationship features with key business account characteristics, generating more robust features and effectively enhancing the model's ability to model complex relationships.

[0137] This invention also provides a complete anti-fraud system, such as... Figure 2 As shown, it includes:

[0138] Graph algorithm unit 21 is used to generate relation features from account features using graph algorithms; construct a graph according to the graph algorithm, set the weight thresholds of nodes, edges, and edge attributes; and generate different types of relation features of nodes, edges, and edge attributes using multiple graph algorithms according to the weight thresholds of nodes, edges, and edge attributes.

[0139] CatBoost algorithm unit 22 is used to filter the relationship features corresponding to the account, combine them with the individual features of the account, perform binary classification reasoning, use the CatBoost algorithm to train data and adjust parameters, and output a fraud model.

[0140] The anti-fraud identification unit 23 is used to screen account behavior for fraudulent behavior based on the fraud model.

[0141] The graph algorithm unit 21 is also used to use multiple graph algorithms of multiple directions to mine the relationship features between fraudsters and between fraudsters and victims on multiple graphs, and generate multiple different relationship features; use multiple graph algorithms to output various graph features related to the account; each graph algorithm outputs multiple corresponding graph features as relationship features by adjusting the edge weights and edge weight thresholds;

[0142] The CatBoost algorithm unit 22 is also used to input account individual features and relationship features into the CatBoost algorithm for training; during the training process, it tries various feature combinations, fully matches and calculates the relationship features with account individual features, calculates multiple optimal combinations and optimal combination threshold classification paths, and obtains the optimal feature combination; it divides the dataset with the input account individual features, relationship features and corresponding account black and white labels, uses the CatBoost algorithm for training, and outputs a model file as a fraud model; during the training and parameter adjustment of the fraud model, it uses the feature_crosses parameter of the CatBoost algorithm to force the combination of relationship features and account individual features, performs manual guidance to specify high-value feature combinations and priority control, sets weight values, and determines the priority of cross features in tree splitting; it filters feature IV values ​​according to the relationship features and account individual features corresponding to the account, combines relationship features and account individual features with high feature IV values ​​in the feature_crosses parameter, sets the weights of relationship and individual features, and optimizes the CatBoost parameters.

[0143] like Figure 3The diagram illustrates a specific implementation scheme provided by an embodiment of the present invention. The centrality algorithm, community detection algorithm, and similarity algorithm each comprise multiple specific algorithms, collectively serving as a graph algorithm for identifying and filtering account relationship features. The filtered relationship features, combined with individual account features, are used to select high-quality features for model input based on the feature N value. The feature_crosses parameter of the CatBoost algorithm is then used to combine the highest-quality relationship features and individual features to train and output the model.

[0144] In various embodiments of the present invention, relational features correspond to graph features, and individual features correspond to point features. By combining graph features and point features, relational features of different dimensions can be captured.

[0145] This invention employs various graph algorithms to capture relational features across different dimensions, achieving a shift from isolated individual risk perception to networked risk perception in terms of feature information completeness. It identifies key nodes through centrality, discovers potential groups through community detection, and uncovers fraud chains through path algorithms.

[0146] At least some of the functions of any number of modules, submodules, units, and subunits according to embodiments of this application can be implemented in one module. Any one or more of the modules, submodules, units, and subunits according to embodiments of this application can be implemented by dividing them into multiple modules. Any one or more of the modules, submodules, units, and subunits according to embodiments of this application can be at least partially implemented as hardware circuits, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuits, or implemented in software, hardware, and firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, one or more of the modules, submodules, units, and subunits according to embodiments of this application can be at least partially implemented as computer program modules, which, when run, can perform corresponding functions.

[0147] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0148] This invention provides a storage medium storing a program that, when executed by a processor, implements the aforementioned anti-fraud method.

[0149] This invention provides a processor for running a program, wherein the program executes the anti-fraud method during runtime.

[0150] Specifically, the processor may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor may also include onboard memory for caching purposes. The processor may be a single processing unit or multiple processing units for performing different actions of the method flow according to embodiments of this application.

[0151] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0152] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0153] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0154] These computer program instructions can also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0155] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0156] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0157] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0158] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0159] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0160] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

[0161] The accompanying drawings illustrate several block diagrams and / or flowcharts. It should be understood that some blocks, or combinations thereof, in the block diagrams and / or flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when executed by the processor, these instructions can create means for implementing the functions / operations described in these block diagrams and / or flowcharts. The technology of this application can be implemented in hardware and / or software (including firmware, microcode, etc.). Alternatively, the technology of this application can take the form of a computer program product stored on a computer-readable storage medium, which can be used by or in conjunction with an instruction execution system.

Claims

1. An anti-fraud method, characterized in that, include: Use graph algorithms to generate relational features from account characteristics; Graphs are constructed using graph algorithms, and threshold values ​​for node, edge, and edge attribute weights are set. Based on these threshold values, multiple graph algorithms are used to generate different types of relationship features for nodes, edges, and edge attributes. The relationship features corresponding to accounts are filtered, and combined with the individual features of the accounts, binary classification reasoning is performed. The CatBoost algorithm is used to train the data and adjust the parameters to output a fraud model. Fraudulent behavior is screened based on fraud models.

2. The method according to claim 1, characterized in that, The step of generating relational features from account features using graph algorithms includes: By utilizing multiple graph algorithms with multiple directions, the relationship features between fraudsters and between fraudsters and victims are mined on multiple graphs, generating multiple different types of relationship features; the multiple graphs include graphs that mine different relationships formed by fraudster accounts, victim accounts, associated devices, associated network addresses (IPs), and latitude and longitude nodes.

3. The method according to claim 1, characterized in that, The nodes include: an account, the device associated with the account transaction, and the network address (IP) where the account transaction took place. The edges include: inter-account transfers, shared devices, and shared network addresses (IP addresses); The edge weights include indicators related to transaction amount, transaction frequency, device login frequency, and active duration of logged-in devices.

4. The method according to claim 1, characterized in that, The graph algorithms include community detection algorithms, centrality classification algorithms, and similarity algorithms; community detection algorithms include the Leuven algorithm and the tag propagation algorithm; centrality classification algorithms include the PageRank algorithm, betweenness centrality algorithm, proximity centrality algorithm, degree centrality algorithm, and eigenvector centrality algorithm; similarity algorithms include node similarity algorithms and Euclidean similarity algorithms.

5. The method according to claim 1, characterized in that, The method further includes: Multiple graph algorithms are used to output various graph features related to accounts; each graph algorithm outputs multiple corresponding graph features as relation features by adjusting edge weights and edge weight thresholds.

6. The method according to claim 1, characterized in that, The relationship features corresponding to the filtered accounts, combined with the individual characteristics of the accounts, are used to perform binary classification reasoning operations, including: The relationship characteristics of accounts include community discovery features, centrality features, and similarity features; individual account characteristics include: account transaction behavior features, account and customer attribute features, device, IP and other features, operational behavior features, and transaction time pattern features. Calculate the feature IV value; select features with high feature IV values ​​that effectively distinguish between black and white samples for binary classification inference.

7. The method according to claim 1, characterized in that, The training data and parameter adjustment using the CatBoost algorithm include: The individual account features and relationship features are input into the CatBoost algorithm for training. During the training process, various feature combinations are tried, and the relationship features and individual account features are fully matched and measured to calculate multiple optimal combinations and optimal combination threshold classification paths, thus obtaining the optimal feature combination. The dataset is divided by inputting individual account features and relationship features, along with corresponding account black and white labels. The model is then trained using the CatBoost algorithm, and the output model file serves as the fraud model.

8. The method according to claim 7, characterized in that, The method further includes: During the training and parameter adjustment of the fraud model, the feature_crosses parameter of the CatBoost algorithm is used to force the combination of relationship features and account individual features, manually guide the cross-specification of high-value feature combinations and priority control, set weight values, and determine the priority of cross features in tree splitting. Based on the relationship features and individual features of the account, the value of feature IV is selected. The relationship features and individual features with high feature IV values ​​are combined in pairs in the feature_crosses parameter, and the weights of the relationship features and individual features are set to optimize the CatBoost parameter.

9. An anti-fraud system, characterized in that, include: The graph algorithm unit is used to generate relational features from account features using graph algorithms; Graphs are constructed using graph algorithms, and threshold values ​​for node, edge, and edge attribute weights are set. Based on these threshold values, multiple graph algorithms are used to generate different types of relationship features for nodes, edges, and edge attributes. The CatBoost algorithm unit is used to filter the relationship features corresponding to accounts, combine them with the individual features of accounts, perform binary classification inference operations, use the CatBoost algorithm to train data and adjust parameters, and output a fraud model. The anti-fraud identification unit is used to screen account behavior for fraudulent activities based on fraud models.

10. The system according to claim 9, characterized in that, include: The graph algorithm unit is also used to mine the relationship features between fraudsters and between fraudsters and victims on multiple graphs using multiple graph algorithms of various directions, and generate multiple different relationship features; using multiple graph algorithms, output various graph features related to the account; each graph algorithm outputs multiple corresponding graph features as relationship features by adjusting edge weights and edge weight thresholds; The CatBoost algorithm unit is also used to input account individual features and relationship features into the CatBoost algorithm for training; during the training process, it tries various feature combinations, fully matches and calculates the relationship features with account individual features, calculates multiple optimal combinations and optimal combination threshold classification paths, and obtains the optimal feature combination; it divides the input account individual features, relationship features and corresponding account black and white labels into datasets, uses the CatBoost algorithm for training, and outputs a model file as a fraud model; during the training and parameter adjustment of the fraud model, it uses the feature_crosses parameter of the CatBoost algorithm to force the combination of relationship features and account individual features, performs manual guidance to specify high-value feature combinations and priority control, sets weight values, and determines the priority of cross features in tree splitting; it filters feature IV values ​​based on the relationship features and account individual features corresponding to the account, combines relationship features and account individual features with high feature IV values ​​in pairs in the feature_crosses parameter, sets the weights of relationship and individual features, and optimizes the CatBoost parameters.

Images