A telecommunications network fraud detection method and system based on dual supergraph neural network
By constructing a dense communication graph and local subgraphs using a dual hypergraph neural network and combining it with an adaptive edge selection module, the problems of sparse communication graphs and class imbalance in telecommunications network fraud detection are solved, achieving efficient fraud behavior identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- LANZHOU UNIV
- Filing Date
- 2026-01-22
- Publication Date
- 2026-07-31
AI Technical Summary
Existing technologies for detecting telecommunications network fraud suffer from problems such as sparse communication graph connections, high computational costs, low detection accuracy, and class imbalance, which limit the efficiency and accuracy of model training.
A method based on dual hypergraph neural networks is adopted. By constructing dense communication graphs, local subgraphs, balanced graph expansion and dual hypergraph transformation, combined with an adaptive edge selection module, high-order relation features are learned to achieve high-precision identification of fraudulent behavior.
It significantly improves the training efficiency and accuracy of the model, enhances the ability to identify fraudulent behavior, alleviates the class imbalance problem, and improves the robustness and generalization performance of the detection.
Smart Images
Figure CN121771037B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of network information security technology and artificial intelligence application technology, and more specifically to a method and system for detecting telecommunications network fraud based on dual hypergraph neural networks. Background Technology
[0002] With the rapid popularization of mobile communication networks and smart terminal devices, telecommunications networks have become the main carrier of information dissemination in human society. However, their openness and anonymity also facilitate fraudulent activities by criminals. Currently, most mainstream security defense mechanisms rely on static rule matching and manually labeled sample libraries, such as keyword filtering, number segment blacklists, and behavioral threshold warnings to achieve basic detection. While these methods are low-cost and quick to deploy, they have significant limitations: on the one hand, fraud methods evolve rapidly, and traditional rules struggle to cover new attacks in a timely manner; on the other hand, rule matching methods typically treat users as independent entities, ignoring potential connections within the communication network between users, resulting in shallow feature dimensions, weak correlation information, and limited detection accuracy.
[0003] In recent years, graph neural networks (GNNs) have been increasingly applied to telecommunications fraud detection tasks due to their superior performance in modeling complex relational data. By performing feature aggregation and information transfer between nodes and their neighbors, GNNs can capture high-order relationships and topological features, thereby uncovering potential group fraud patterns. Typical models include GCN, GAT, and GraphSAGE. They can achieve semi-supervised learning even in scenarios with partially missing labels and possess good generalization and structural representation capabilities.
[0004] However, directly applying GNNs to real-world telecommunications network scenarios still faces the following key challenges: A single operator can only obtain call / SMS logs within its own network, resulting in a sparse communication graph with insufficient edges, failing to fully represent the structure of real social interactions. City-level communication networks may contain millions of nodes and edges; directly calculating on the entire graph would not only be computationally expensive but could also introduce a large amount of noise from low-frequency calls, reducing model training efficiency and accuracy. In real data, the proportion of fraudulent users is extremely low, causing the model to heavily favor the majority class, i.e., normal users, during training, making it difficult to fully learn minority class features, leading to detection bias and missed detections. Most existing GNN models only focus on node feature aggregation, simplifying the rich semantics of communication behavior into unweighted edges or fixed adjacency relationships, resulting in the loss or insufficient representation of edge information.
[0005] Therefore, there is an urgent need for a new method for detecting telecommunications fraud that can effectively alleviate the class imbalance problem while enhancing the structural information of the communication graph, and explicitly capture the high-order semantics of edge features in communication behavior, thereby achieving high-precision identification of fraudulent behavior. Summary of the Invention
[0006] In view of this, the present invention provides a method and system for detecting telecommunications network fraud based on dual hypergraph neural networks, aiming to solve the problems existing in the prior art mentioned above.
[0007] To achieve the above objectives, the present invention adopts the following technical solution: A method for detecting telecommunications network fraud based on dual hypergraph neural networks includes: S1. Obtain detailed call records, extract user statistical features and pattern features, standardize and fuse them to form a user feature vector; construct an initial communication graph based on the communication behavior between users; calculate the feature similarity between nodes based on the user feature vector, establish a connection when the similarity exceeds a preset threshold, and expand the initial communication graph into a dense communication graph. S2, calculate the relationship strength between the target node and its neighboring nodes in the dense communication graph, and select the top-k strongest neighboring nodes to construct a local subgraph with the target node; S3, minority class nodes are generated in the original feature space by SMOTE interpolation for the local subgraph. In the GraphSMOTE method, an adjacency matrix is constructed for the minority class nodes by an inheritance connection strategy and a bilinear graph decoder, forming a balanced graph after structural and feature expansion. S4, the balanced graph is transformed into a dual hypergraph, and a hypergraph convolutional network is used to learn the high-order representation of the nodes of the dual hypergraph. The key connections are dynamically filtered by an adaptive edge selection module. The node representation is updated by the last round of message passing through the hypergraph convolutional network to obtain the final node embedding. The final node embedding is input into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.
[0008] Preferably, S1 specifically includes: S1.1 Extract the statistical and pattern features of each communication user node from the call details generated by the telecom operator, fuse them to obtain a comprehensive node feature vector, and form a user feature vector after standardization. S1.2, Based on the user feature vector, the behavioral similarity is measured by calculating the Euclidean distance between user features; when the similarity between any two nodes is higher than a set threshold, a potential edge connection is established between them to generate a dense communication graph.
[0009] Preferably, S2 specifically includes calculating the relationship strength between the target node and its neighboring nodes based on a weighted fusion of communication affinity and communication strength, and selecting the top-k strongest neighboring nodes to construct a local subgraph with the target node.
[0010] Preferably, S3 specifically includes: S3.1, Perform SMOTE interpolation on the local subgraph in the original feature space to generate minority class nodes; S3.2, an inheritance-based connection mechanism is used to construct adjacency relationships for the minority class nodes, forming an extended graph; S3.3, The extended graph nodes are input into the bilinear decoder to learn the reasonable topological structure between the generated nodes and the original nodes, thereby reconstructing the adjacency matrix and forming a balanced graph after structural and feature expansion.
[0011] Preferably, S4 specifically includes: S4.1, the balanced graph is transformed by the dual hypergraph, and the mapping relationship is as follows: the node set of the dual hypergraph is composed of the edge set of the balanced graph, each node of the balanced graph induces the generation of a hyperedge of the dual hypergraph, and the hyperedge contains all the nodes in the dual hypergraph corresponding to the edges associated with that node. S4.2 employs a hypergraph convolutional network, learning the high-order representation of dual hypergraph nodes through a two-stage message-passing paradigm. The first stage is node-to-hyperedge aggregation, which aggregates the features of all nodes associated with the hyperedge to generate the hyperedge representation. The second stage is hyperedge-to-node propagation, which transmits the hyperedge information back to its associated nodes to update the node representation. S4.3 uses an adaptive edge selection module to dynamically filter key connections. First, a hypergraph convolutional layer is used to calculate the task relevance score of each edge based on the edge feature vector using an edge scoring function. Then, key edges are selected from high to low scores and a preset proportion is retained. Finally, the weights of the retained edges are optimized by symmetric normalization to stabilize the message passing process. S4.4 Based on the optimized graph structure, the final message passing update node representation is completed through a hypergraph convolutional network to obtain the final node embedding; the final node embedding is input into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.
[0012] A telecommunications network fraud detection system based on dual hypergraph neural networks includes: The communication graph expansion unit acquires detailed call records, extracts user statistical features and pattern features, performs standardized processing and fusion to form a user feature vector; constructs an initial communication graph based on the communication behavior between users; calculates the feature similarity between nodes based on the user feature vector, establishes a connection when the similarity exceeds a preset threshold, and expands the initial communication graph into a dense communication graph. The local subgraph construction unit calculates the relationship strength between the target node and its neighboring nodes in the dense communication graph, and selects the top-k strongest neighboring nodes to construct a local subgraph with the target node; The balanced graph expansion unit generates minority class nodes in the original feature space of the local subgraph through SMOTE interpolation. In the GraphSMOTE method, an adjacency matrix is constructed for the minority class nodes through an inheritance connection strategy and a bilinear graph decoder, forming a balanced graph with expanded structure and features. The prediction unit transforms the balanced graph into a dual hypergraph, learns the high-order representation of the nodes in the dual hypergraph using a hypergraph convolutional network, and dynamically filters key connections using an adaptive edge selection module; it completes the final round of message passing to update the node representation through the hypergraph convolutional network to obtain the final node embedding; and it inputs the final node embedding into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.
[0013] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a method and system for detecting telecommunications network fraud based on dual hypergraph neural networks, with the following beneficial effects: Structural enhancement: Dense communication graphs are generated based on L2 similarity, which effectively alleviates the problem of sparsity in communication data and improves the connectivity of graph structure; Noise suppression: A relation strength subgraph sampling mechanism is adopted to screen high-quality edge connections, which significantly improves the model training efficiency and feature purity; Class-balanced optimization: Maintain topological consistency through an improved GraphSMOTE strategy to enhance the model's detection capability under imbalanced data; Edge semantic learning: Introducing a dual hypergraph transformation mechanism to explicitly model communication behavior features and achieve high-order relation capture; Structural Adaptability: The adaptive edge selection module enables self-learning of edge importance and dynamic topology updates, improving the robustness and generalization of the model; Significant performance improvement: On real communication datasets, the detection accuracy of this invention is significantly better than that of traditional GNN and GAT models. Attached Figure Description
[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0015] Figure 1 A flowchart of the method steps provided by the present invention; Detailed Implementation
[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0017] This invention discloses a method for detecting telecommunications network fraud based on a dual hypergraph neural network, such as... Figure 1 As shown, it includes: S1. Obtain detailed call records, extract user statistical features and pattern features, standardize and fuse them to form a user feature vector; construct an initial communication graph based on the communication behavior between users; calculate the feature similarity between nodes based on the user feature vector, establish a connection when the similarity exceeds a preset threshold, and expand the initial communication graph into a dense communication graph. S2, calculate the relationship strength between the target node and its neighboring nodes in the dense communication graph, and select the top-k strongest neighboring nodes to construct a local subgraph with the target node; S3, minority class nodes are generated in the original feature space by SMOTE interpolation for the local subgraph. In the GraphSMOTE method, an adjacency matrix is constructed for the minority class nodes by an inheritance connection strategy and a bilinear graph decoder, forming a balanced graph after structural and feature expansion. S4, the balanced graph is transformed into a dual hypergraph, and a hypergraph convolutional network is used to learn the high-order representation of the nodes of the dual hypergraph. The key connections are dynamically filtered by an adaptive edge selection module. The node representation is updated by the last round of message passing through the hypergraph convolutional network to obtain the final node embedding. The final node embedding is input into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.
[0018] Preferably, S1 specifically includes: S1.1 Extract the statistical and pattern features of each communication user node from the call details generated by the telecom operator, fuse them to obtain a comprehensive node feature vector, and form a user feature vector after standardization. Example 1: Communication Data Modeling and Feature Extraction This embodiment first extracts user communication behavior characteristics from the call detail records generated by the telecommunications operator. The call detail record data includes information such as user identifier, caller-caller relationship, call start and end time, SMS type and timestamp, but does not involve the communication content.
[0019] For ease of calculation and modeling, the original dataset is defined as follows:
[0020] in, Represents the set of all communicating user nodes. The number of feature dimensions for each node. Represents a node In the The original observations of the dimension.
[0021] For each node Using a set of statistical functions Statistical features were extracted, and the following results were obtained:
[0022] in Functions include mean, variance, range, quantile, maximum value, minimum value, frequency, and standard deviation.
[0023] In addition, by combining user behavior patterns to extract pattern features (such as active periods, call periodicity, caller-call ratio, call frequency distribution, etc.), a comprehensive node feature vector is formed:
[0024] in Indicates the first Each pattern feature The number of pattern features.
[0025] To eliminate differences in the dimensions of different features and improve model stability, cumulative distribution function normalization (CDFNormalization) is used for normalization. For any feature... Its standardized form is:
[0026] in For indicator functions, For the total number of samples, the standardized result This ensures that the contributions of each feature are balanced during model training.
[0027] S1.2, based on the user feature vector, behavioral similarity is measured by calculating the Euclidean distance between user features; when the similarity between any two nodes is higher than a set threshold, a potential edge connection is established between them to generate a dense communication graph, significantly alleviating the sparsity of the original communication graph. This mechanism can complete potential relationships across networks within the data scope of a single operator, making the graph structure more complete and enhancing the model's ability to identify hidden relationships such as those of fraud gangs.
[0028] Because carrier data only includes partial call records between users, the original communication graph... edge set The graph exhibits significant sparsity. To enhance potential connections between nodes, this invention proposes a method for constructing a dense communication graph based on the similarity of user behavior.
[0029] For any two nodes Their eigenvectors are respectively The L2 distance is defined as:
[0030] The similarity between nodes is defined as:
[0031] in This is the distance attenuation coefficient. When... At that time, establish a potential connection between the two nodes:
[0032] Thus, a dense communication graph is obtained. Threshold Cross-validation can be adaptively configured to balance noise and connectivity.
[0033] when At that time, edges are established between nodes. This dense graph reconstruction mechanism can effectively improve the connectivity and structural expressiveness of communication networks, laying the foundation for subsequent model learning.
[0034] Preferably, S2 specifically includes calculating the relationship strength between the target node and its neighboring nodes based on a weighted fusion of communication affinity and communication strength, and selecting the top-k strongest neighboring nodes to construct a local subgraph with the target node.
[0035] To reduce the computational complexity of large-scale graphs and minimize noise interference, this invention proposes a high-quality subgraph extraction mechanism based on communication relationship strength. The communication relationship strength is obtained by a weighted combination of proximity and communication strength:
[0036] in, These are the weighting coefficients.
[0037] (1) Intimacy Modeling
[0038] When users In the cycle When communicating within memory, the intimacy level is updated as follows:
[0039] in Indicates satisfaction with communication. Historical decay factor These are the gain coefficient and the bias term, respectively. If continuous... If there is no communication for a given period, the intimacy level will decrease as follows:
[0040] (2) Communication strength modeling
[0041] Drawing inspiration from TF IDF principle defines communication strength:
[0042] in For users Number of calls, For users Total number of calls In order to connect with users The number of users communicating This represents the total number of calls made across the entire network.
[0043] For each target node Select the top-k neighbor nodes with the highest relationship strength to form a local subgraph. This is to improve the relevance and accuracy of model training.
[0044] Preferably, S3 specifically includes: S3.1, Perform SMOTE interpolation on the local subgraph in the original feature space to generate minority class nodes; To address the issue of an extremely low proportion of fraudulent nodes, this invention implements enhanced category balancing based on an improved GraphSMOTE framework.
[0045] First, SMOTE interpolation is performed in the original feature space to generate minority class nodes:
[0046] in For a minority of nodes, These are random interpolation coefficients.
[0047] S3.2, an inheritance-based connection mechanism is adopted to construct adjacency relationships for the minority class nodes, forming an extended graph; specifically, the composite node first inherits all the adjacency relationships of its derived source (seed node) in the original graph to ensure the consistency of the local topology; if there is a connection relationship between two seed nodes, then the corresponding newly generated nodes are also connected, thereby maintaining structural coherence and interpretability among the composite nodes.
[0048] To establish topological connections between composite nodes, an inheritance-based connection mechanism is used: if Then establish in the extended graph Additionally, if a connection exists between two seed nodes, an edge is also established between the corresponding composite nodes.
[0049] The adjacency matrix of the expanded graph can be represented as:
[0050] This inheritance-based connection mechanism maintains the local topological consistency and global connectivity of the original graph.
[0051] S3.3, the graph decoder module inputs the expanded graph nodes into a bilinear decoder to learn a reasonable topological structure between the generated nodes and the original nodes, thereby reconstructing the adjacency matrix and forming a balanced graph with expanded structure and features. Its formal expression is as follows:
[0052] in Embed the matrix for the node. These are the decoding parameters. The decoder reconstructs the graph structure by minimizing the reconstruction error. The reconstruction error is calculated using the mean squared error loss function (MSE Loss):
[0053] Through the above improvement strategies, the model can fully learn the feature distribution of the minority class (fraudulent users) while ensuring the rationality and consistency of the graph structure, thus alleviating the bias problem caused by class imbalance and significantly improving detection performance and model robustness.
[0054] Preferably, S4 specifically includes: S4.1, the balanced graph is transformed using a dual hypergraph, with the following mapping relationship: the node set of the dual hypergraph is composed of the edge set of the balanced graph, and each node in the balanced graph induces a hyperedge in the dual hypergraph. This hyperedge contains all the nodes in the dual hypergraph corresponding to the edges associated with that node. Through this node-edge role-swapping mechanism, the model can directly learn node-level features of communication behavior on the dual hypergraph, achieving explicit modeling of edge features. Simultaneously, through a two-stage message passing mechanism (node → hyperedge → node), the model can efficiently capture high-order semantic associations of communication behavior, significantly improving the accuracy of fraud relationship identification.
[0055] Communication network diagram In this graph, nodes represent users, and edges represent communication actions. The roles of nodes and edges are interchanged through Dual Hypergraph Transformation (DHT).
[0056] After the transformation, the original edge information is mapped to node information, and edge feature learning can be achieved using node-level convolution.
[0057] S4.2 employs a hypergraph convolutional network, learning the high-order representation of dual hypergraph nodes through a two-stage message-passing paradigm. The first stage is node-to-hyperedge aggregation, which aggregates the features of all nodes associated with the hyperedge to generate the hyperedge representation. The second stage is hyperedge-to-node propagation, which transmits the hyperedge information back to its associated nodes to update the node representation. Message passing in hypergraph convolutional networks consists of two phases: (1) Node-to-hyperedge aggregation:
[0058] (2) Propagation from the superedge to the node:
[0059] in, For learnable parameters, It is a non-linear activation function.
[0060] This two-stage mechanism enables high-order semantic interaction between nodes, edges, and nodes.
[0061] S4.3 uses an adaptive edge selection module to dynamically filter key connections. First, it passes through a hypergraph convolutional layer and calculates the task relevance score of each edge based on the edge feature vector using an edge scoring function. Then, it filters and retains key edges in a preset proportion according to the scores from high to low. Finally, it optimizes the weights of the retained edges by symmetric normalization to stabilize the message passing process. This module can achieve self-optimization of the structural layer during training, dynamically adapt to different network environments, and significantly improve the generalization performance of the model.
[0062] Define the task relevance score for each edge as:
[0063] in For edge feature vectors, These are learnable parameters. The system retains the Top-K edges with the highest scores:
[0064] And normalize the weights of the retained edges:
[0065] in For nodes The weighting degree.
[0066] S4.4 Based on the optimized graph structure, the final message passing update node representation is completed through a hypergraph convolutional network to obtain the final node embedding; the final node embedding is input into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.
[0067] The model is optimized using a joint loss function, which includes classification loss, reconstruction loss, and a sparse regularization term:
[0068] in, Represents the node classification loss. Indicates the adjacency reconstruction error. This is the balancing coefficient. Through joint training, the model can simultaneously optimize feature representation and structural reconstruction, achieving accurate identification of fraudulent users.
[0069] A telecommunications network fraud detection system based on dual hypergraph neural networks includes: The communication graph expansion unit acquires detailed call records, extracts user statistical features and pattern features, performs standardized processing and fusion to form a user feature vector; constructs an initial communication graph based on the communication behavior between users; calculates the feature similarity between nodes based on the user feature vector, establishes a connection when the similarity exceeds a preset threshold, and expands the initial communication graph into a dense communication graph. The local subgraph construction unit calculates the relationship strength between the target node and its neighboring nodes in the dense communication graph, and selects the top-k strongest neighboring nodes to construct a local subgraph with the target node; The balanced graph expansion unit generates minority class nodes in the original feature space of the local subgraph through SMOTE interpolation. In the GraphSMOTE method, an adjacency matrix is constructed for the minority class nodes through an inheritance connection strategy and a bilinear graph decoder, forming a balanced graph with expanded structure and features. The prediction unit transforms the balanced graph into a dual hypergraph, learns the high-order representation of the nodes in the dual hypergraph using a hypergraph convolutional network, and dynamically filters key connections using an adaptive edge selection module; it completes the final round of message passing to update the node representation through the hypergraph convolutional network to obtain the final node embedding; and it inputs the final node embedding into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.
[0070] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The methods disclosed in the embodiments are described simply because they correspond to the methods disclosed in the embodiments; relevant parts can be found in the method section.
[0071] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for detecting telecommunications network fraud based on dual hypergraph neural networks, characterized in that, include: S1. Obtain detailed call records, extract user statistical features and pattern features, standardize and fuse them to form a user feature vector; construct an initial communication graph based on the communication behavior between users; calculate the feature similarity between nodes based on the user feature vector, establish a connection when the similarity exceeds a preset threshold, and expand the initial communication graph into a dense communication graph. S2, calculate the relationship strength between the target node and its neighboring nodes in the dense communication graph, and select the top-k strongest neighboring nodes to construct a local subgraph with the target node; S3, minority class nodes are generated in the original feature space by SMOTE interpolation for the local subgraph. In the GraphSMOTE method, an adjacency matrix is constructed for the minority class nodes by an inheritance connection strategy and a bilinear graph decoder, forming a balanced graph after structural and feature expansion. S4, the balanced graph is transformed into a dual hypergraph, and a hypergraph convolutional network is used to learn the high-order representation of the nodes of the dual hypergraph. The key connections are dynamically filtered by an adaptive edge selection module. The node representation is updated by the last round of message passing through the hypergraph convolutional network to obtain the final node embedding. The final node embedding is input into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.
2. The telecommunications network fraud detection method based on dual hypergraph neural networks according to claim 1, characterized in that, S1 specifically includes: S1.1 Extract the statistical and pattern features of each communication user node from the call details generated by the telecom operator, fuse them to obtain a comprehensive node feature vector, and form a user feature vector after standardization. S1.2, Based on the user feature vector, the behavioral similarity is measured by calculating the Euclidean distance between user features; when the similarity between any two nodes is higher than a set threshold, a potential edge connection is established between them to generate a dense communication graph.
3. The telecommunications network fraud detection method based on dual hypergraph neural networks according to claim 1, characterized in that, S2 specifically includes calculating the relationship strength between the target node and its neighboring nodes based on a weighted fusion of communication affinity and communication strength, and selecting the top-k strongest neighboring nodes to construct a local subgraph with the target node.
4. The telecommunications network fraud detection method based on dual hypergraph neural networks according to claim 1, characterized in that, S3 specifically includes: S3.1, Perform SMOTE interpolation on the local subgraph in the original feature space to generate minority class nodes; S3.2, an inheritance-based connection mechanism is used to construct adjacency relationships for the minority class nodes, forming an extended graph; S3.3 Input the extended graph nodes into the bilinear decoder to learn the reasonable topological structure between the generated nodes and the original nodes, thereby reconstructing the adjacency matrix and forming a balanced graph after structural and feature expansion.
5. The telecommunications network fraud detection method based on dual hypergraph neural networks according to claim 1, characterized in that, S4 specifically includes: S4.1, the balanced graph is transformed by the dual hypergraph, and the mapping relationship is as follows: the node set of the dual hypergraph is composed of the edge set of the balanced graph, each node of the balanced graph induces the generation of a hyperedge of the dual hypergraph, and the hyperedge contains all the nodes in the dual hypergraph corresponding to the edges associated with that node. S4.2 employs a hypergraph convolutional network, learning the high-order representation of dual hypergraph nodes through a two-stage message-passing paradigm. The first stage is node-to-hyperedge aggregation, which aggregates the features of all nodes associated with the hyperedge to generate the hyperedge representation. The second stage is hyperedge-to-node propagation, which transmits the hyperedge information back to its associated nodes to update the node representation. S4.3 uses an adaptive edge selection module to dynamically filter key connections. First, a hypergraph convolutional layer is used to calculate the task relevance score of each edge based on the edge feature vector using an edge scoring function. Then, key edges are selected from high to low scores and a preset proportion is retained. Finally, the weights of the retained edges are optimized by symmetric normalization to stabilize the message passing process. S4.4 Based on the optimized graph structure, the final message passing update node representation is completed through a hypergraph convolutional network to obtain the final node embedding; the final node embedding is input into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.
6. A telecommunications network fraud detection system based on a dual hypergraph neural network, employing the telecommunications network fraud detection method based on a dual hypergraph neural network as described in any one of claims 1-5, characterized in that, include: The communication graph expansion unit acquires detailed call records, extracts user statistical features and pattern features, performs standardized processing and fusion to form a user feature vector; constructs an initial communication graph based on the communication behavior between users; calculates the feature similarity between nodes based on the user feature vector, establishes a connection when the similarity exceeds a preset threshold, and expands the initial communication graph into a dense communication graph. The local subgraph construction unit calculates the relationship strength between the target node and its neighboring nodes in the dense communication graph, and selects the top-k strongest neighboring nodes to construct a local subgraph with the target node; The balanced graph expansion unit generates minority class nodes in the original feature space of the local subgraph through SMOTE interpolation. In the GraphSMOTE method, an adjacency matrix is constructed for the minority class nodes through an inheritance connection strategy and a bilinear graph decoder, forming a balanced graph with expanded structure and features. The prediction unit transforms the balanced graph into a dual hypergraph, learns the high-order representation of the nodes in the dual hypergraph using a hypergraph convolutional network, and dynamically filters key connections using an adaptive edge selection module; it completes the final round of message passing to update the node representation through the hypergraph convolutional network to obtain the final node embedding; and it inputs the final node embedding into the Softmax activation function to calculate the predicted probability of the user being a fraudulent user or a normal user.