A method and system for graph neural network adversarial attack oriented to financial transaction graph

Abstract

The application provides a kind of graph neural network attack method and system for financial transaction graph, it is related to the field of financial technology and graph neural network security technology, including: obtaining financial transaction graph data and candidate risk user node subset;Build reinforcement learning attack agent, interact with target GNN financial risk control model through the agent, select the optimal target risk user node and its corresponding neighbor user node in the financial transaction graph, and add false transaction edge between the selected two nodes, so as to execute multiple rounds of attack on the risk control model, until the preset stop condition is met;Output the financial transaction graph after adding the false transaction edge as the adversarial sample, for testing the security of the risk control model;The application generates attack samples conforming to the real transaction distribution within a limited number of operations by combining the edge attribute constraints and attack concealment optimization of financial transaction graph, which is of great significance for evaluating and improving the security of GNN financial risk control model.

Description

Technical Field

[0001] This invention relates to the fields of financial technology and graph neural network security technology, specifically to a graph neural network adversarial attack method and system for financial transaction graphs. Background Technology

[0002] With the rapid development of mobile payment and internet finance, the methods of abnormal financial transactions are becoming increasingly complex. Graph Neural Networks (GNNs), with their powerful modeling capabilities for graph-structured data, are widely used in scenarios involving the detection of abnormal financial transactions. By constructing a financial transaction graph with users as nodes and transactions as edges, GNNs can effectively identify risky behaviors such as abnormal transactions.

[0003] However, the security of GNN models in financial risk control scenarios has not been fully verified. Existing research shows that attackers can induce GNNs to identify abnormal users as normal users by adding a small number of fake transaction edges to the transaction graph. For example, an attacker can establish fake transaction relationships with multiple high-credit users, causing GNNs to mistakenly believe that the user has a high credit rating.

[0004] Existing adversarial attack methods suffer from several drawbacks. First, the attack scenarios are disconnected from reality. Most methods assume that attackers can arbitrarily modify edges at any position in the graph, but in financial trading scenarios, attackers can only establish trading relationships with a limited number of users, and attributes such as transaction amount and time must conform to the actual distribution. Second, the attacks lack stealth. Existing methods only focus on the success rate of the attack and do not consider whether the attack behavior will be detected by the risk control system. For example, adding a large number of fake transaction edges or abnormal transaction amounts in a short period of time can easily trigger abnormal transaction warnings. Third, the transaction attribute information is not fully utilized: existing methods mainly focus on modifying the graph structure and ignore the impact of edge attribute information such as transaction amount and transaction time on the attack effect.

[0005] Therefore, existing adversarial attack methods suffer from problems such as disconnect from attack scenarios, poor concealment, and failure to utilize edge attribute information, resulting in generated adversarial samples that are not suitable for evaluating real financial risk control models. Summary of the Invention

[0006] To address the aforementioned problems, this invention proposes a graph neural network adversarial attack method and system for financial transaction graphs. By combining edge attribute constraints and attack concealment optimization of financial transaction graphs, it generates attack samples that conform to the real transaction distribution within a limited number of operations, which is of great significance for evaluating and improving the security of GNN financial risk control models.

[0007] According to some embodiments, the present invention adopts the following technical solution: An adversarial attack method for graph neural networks targeting financial transaction graphs includes: Obtain financial transaction graph data and a subset of candidate risky user nodes; the financial transaction graph data includes a set of user nodes, a set of transaction edges, and attribute information of the transaction edges; the subset of candidate risky user nodes is a number of candidate risky user nodes pre-specified from the set of user nodes by the attack task. A reinforcement learning attack agent is constructed. The agent interacts with the target GNN financial risk control model. Under the condition of global graph embedding, the optimal target risk user node is selected from the subset of candidate risk user nodes. Under the condition of optimal target risk user node embedding, the optimal neighbor user node is selected from the set of user nodes. A fake transaction edge that conforms to the historical transaction distribution and has concealment is added between the two selected nodes. In this way, multiple rounds of adversarial attacks are performed on the risk control model until the preset stopping condition is met. The output financial transaction graph with added fake transaction edges is used as an adversarial example to test the security of the target GNN financial risk control model.

[0008] According to some embodiments, the present invention adopts the following technical solution: A graph neural network adversarial attack system for financial transaction graphs includes: The data acquisition module is configured to: acquire financial transaction graph data and a subset of candidate risky user nodes; the financial transaction graph data includes a set of user nodes, a set of transaction edges, and attribute information of the transaction edges; the subset of candidate risky user nodes is a number of candidate risky user nodes pre-specified from the set of user nodes by the attack task. The adversarial attack module is configured to: construct a reinforcement learning attack agent, interact with the target GNN financial risk control model through the agent, select the optimal target risk user node from the subset of candidate risk user nodes under the condition of global graph embedding, select the optimal neighbor user node from the set of user nodes under the condition of optimal target risk user node embedding, and add a fake transaction edge that conforms to the historical transaction distribution and has concealment between the two selected nodes, thereby performing multiple rounds of adversarial attacks on the risk control model until the preset stopping condition is met; The sample output module is configured to output a financial transaction graph with added fake transaction edges as an adversarial example to test the security of the target GNN financial risk control model.

[0009] According to some embodiments, the present invention adopts the following technical solution: A computer program product includes a computer program that, when executed by a processor, implements the aforementioned graph neural network adversarial attack method for financial transaction graphs.

[0010] According to some embodiments, the present invention adopts the following technical solution: A non-transitory computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement the aforementioned graph neural network adversarial attack method for financial transaction graphs.

[0011] According to some embodiments, the present invention adopts the following technical solution: An electronic device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement a graph neural network adversarial attack method for financial transaction graphs.

[0012] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention acquires financial transaction graph data containing user node sets, transaction edge sets, and edge attribute information such as transaction amount and transaction time. This allows the adversarial example generation process to simultaneously consider the structural and transaction attribute features of the financial transaction graph. By constructing a reinforcement learning attack agent and having it interact with the target GNN financial risk control model, the adversarial attack can be executed without knowing the internal parameters and gradient information of the target risk control model by selecting the target risk user node and its corresponding neighbor user nodes in the financial transaction graph. By adding fake transaction edges that conform to historical transaction distribution and have concealment between the selected two nodes, the generated adversarial examples can be made closer to real financial transaction behavior, reducing the risk of detection due to abnormal transaction amount or transaction time. By setting a preset stopping condition and outputting the financial transaction graph with added fake transaction edges as an adversarial example, the security of the target risk control model can be tested within a limited range of attack operations, thereby improving the evaluation effect of the security and robustness of the black-box graph neural network financial risk control model. Attached Figure Description

[0013] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0014] Figure 1 This is a flowchart of the method in Example 1. Detailed Implementation

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0016] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0017] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0018] Example 1 One embodiment of the present invention provides a method for adversarial attacks on graph neural networks for financial transaction graphs, comprising: Step 1: Obtain financial transaction graph data and a subset of candidate risky user nodes; the financial transaction graph data includes a set of user nodes, a set of transaction edges, and attribute information of the transaction edges; the subset of candidate risky user nodes is a number of candidate risky user nodes pre-specified from the set of user nodes by the attack task. Step 2: Construct a reinforcement learning attack agent. The agent interacts with the target GNN financial risk control model. Under the condition of global graph embedding, the optimal target risk user node is selected from the subset of candidate risk user nodes. Under the condition of optimal target risk user node embedding, the optimal neighbor user node is selected from the user node set. A fake transaction edge that conforms to the historical transaction distribution and has concealment is added between the two selected nodes. In this way, multiple rounds of adversarial attacks are performed on the risk control model until the preset stopping condition is met. Step 3: Output the financial transaction graph with added fake transaction edges as an adversarial example to test the security of the target GNN financial risk control model.

[0019] As one embodiment, the present invention provides a graph neural network adversarial attack method for financial transaction graphs. By combining edge attribute constraints and attack concealment optimization of financial transaction graphs, it generates attack samples that conform to the real transaction distribution within a limited number of operations. This is of great significance for evaluating and improving the security of GNN financial risk control models. The specific implementation process is described below, such as... Figure 1 As shown: Step S1: Obtain financial transaction graph data and the candidate risk user node subset in the corresponding user node set.

[0020] According to the financial transaction chart Obtain the original graph structure data, which includes a set of user nodes. The transaction edge set E and edge attribute information: each user node includes features such as credit score, number of historical transactions, and average transaction amount; each transaction edge includes two edge attributes: transaction amount and transaction time.

[0021] Based on the attack mission, a subset of candidate risky user nodes is determined in the original financial transaction graph. The subset of candidate risky user nodes can be the target risky user node pre-specified by the attack task, or it can include several candidate risky user nodes selected from the set of marked risky user nodes.

[0022] It should be noted that the subset of candidate risky user nodes is used to limit the candidate range of target risky user nodes that the attacking agent can select. Not all user nodes in the subset are the final targets of the current round of attack. The target risky user node of the current round of attack is further selected and determined by the attacking agent from the subset of candidate risky user nodes.

[0023] Step S2: Constructing a reinforcement learning attack agent Construct a reinforcement learning attack agent. The state space includes the embedding vector of each user node and the global graph embedding vector. The action space includes: selecting the target risk user node, selecting neighboring user nodes, and setting the attribute information of the fake transaction edge (i.e., transaction amount and transaction time).

[0024] Step S2.1 State Coding Network The state of the agent is constructed by encoding the state of the financial transaction graph into an embedding vector using a Structure2Vec (S2V) network.

[0025] Specifically, the embedding vector of each user node is generated by iteratively aggregating the feature information of its neighboring nodes. In the The layer embedding update formula is:

[0026] in, For nodes The feature vectors include credit score, number of historical transactions, and average transaction amount. For nodes The set of neighbors, For neighboring nodes In the Layer embedding, For nodes In the Layer embedding, For nodes In the Layer embedding, , , For learnable parameters, This is the activation function.

[0027] Initial embedding Structure2Vec (S2V) network co-iteration The final node embedding is denoted as . = The global graph embedding vector is obtained by summing the embedding vectors of all nodes, and can be expressed by the formula:

[0028] in, For a set of user nodes, For nodes The embedding vector.

[0029] Step S2.2 Hierarchical decomposition of action space The agent employs a hierarchical action space decomposition strategy, using a first action value function to select from a subset of candidate risky user nodes under global graph embedding conditions. Select the optimal target risk user node, and then use the second action value function to select from the user node set under the embedding condition of the optimal target risk user node. Select the neighboring user node and perform the operation of adding a fake transaction edge between the target risk user node and the neighboring user node.

[0030] Specifically, during the current round of attack t, the current state of the financial transaction graph is recorded as follows: The current financial transaction graph status This represents the graph state after the previous fake transaction edge addition operation has been performed. In this embodiment, the node embedding set of the current round t is used. and global graph embedding vector To represent, where, nodes Embedded and global graph embedding vector It is obtained by encoding the current round of financial transactions using Structure2Vec.

[0031] Assumption Indicates the target risk user node Node embedding, Representing neighboring user nodes Node embedding; action selection is achieved through two action value functions, the first action value function... Used to evaluate the current graph state Below, from the subset of candidate risky user nodes Select user node The expected action value of the starting node of the false transaction edge; the second action value function. Used to evaluate the current graph state Below, in the selected target risk user nodes Under the condition of user node set Further select neighboring user nodes The expected action value of acting as the endpoint node of a fake transaction and performing an edge-adding operation.

[0032] The two action value functions are respectively approximated by a multilayer perceptron to calculate the expected action value, and are expressed as follows:

[0033]

[0034] Where [] denotes vector concatenation operation, and All are multilayer perceptron networks used to output the action value scores of the corresponding candidate actions.

[0035] Specifically, the agent first selects candidates from the subset of risky user nodes based on the first action value function. Select the target risk user node with the highest expected action value: ,in, This indicates that the attacking agent is selected from a subset of candidate risky user nodes. The target risk user node selected in the current round of attacks. Then, given the target risk user node... Under these conditions, the agent, based on the second action value function, selects a user node from the set of user nodes. Select the neighboring user node with the highest expected action value: ,in, Indicates the target risk user node Neighboring user nodes that establish fictitious transaction relationships; ultimately, the agent executes the fictitious transaction edge ( , Adding operations.

[0036] Step S2.3 Transaction Attribute Generation To improve the concealment of fake transaction edges, the corresponding transaction amount and transaction time attributes are generated simultaneously when generating fake transaction edges.

[0037] For the amount of fraudulent transactions, the generated amount of fraudulent transactions is recorded as follows: Since financial transaction amounts typically exhibit a right-skewed distribution, this embodiment applies a natural logarithmic transformation to historical transaction amounts and fits the transformed transaction amounts using a normal distribution, expressed as:

[0038] Among them, ln( ) represents the natural logarithm function. This represents the average of historical transaction amounts after taking the natural logarithm. This represents the standard deviation of historical transaction amounts after taking the natural logarithm. The mean is variance is The normal distribution is obtained by sampling from this distribution. And by taking an index from it, the amount of fraudulent transactions can be obtained. .

[0039] In one specific embodiment, the data is obtained by fitting historical transaction data. =4.5、 =1.2, then we have:

[0040] For fake transaction times, the time offset is recorded as follows: This represents the length of time that the fake transaction time has shifted forward relative to the current time. In this embodiment, Sampling from a uniform distribution:

[0041] in, This indicates a uniform distribution between 1 hour and 720 hours, with 720 hours corresponding to 30 days.

[0042] Record the current time as The time of the generated fake transaction is ,but:

[0043] This ensures that fraudulent transactions occur within a certain historical time window prior to the current time, thus preventing all fraudulent transactions from occurring at the same point in time and improving the authenticity and concealment of generated transaction edges.

[0044] Step S2.4 Reward Function Design To simultaneously consider attack success rate, attack concealment, and query efficiency in black-box attack scenarios, this embodiment constructs a comprehensive reward function, denoted as the financial transaction graph obtained after the t-th round of attack. The target risk user node is The target GNN financial risk control model targets user nodes with specific risks. The prediction result is Among them, target risk user nodes In the current round of attack, the attacking agent selects from a subset of candidate risky user nodes. The selected target risk user nodes, namely the aforementioned .

[0045] The target GNN financial risk control model here is a GCN (Graph Convolutional Network), which uses the current financial transaction graph to include user nodes, transaction edges, user node features, and edge attribute information such as transaction amount and transaction time. and the target risk user nodes to be predicted The input is the target risk user node, and the output is the target risk user node. Prediction results The prediction results include at least the target risk user nodes. The classification labels for users identified as abnormal or normal; in an optional implementation, the prediction result also includes target risk user nodes. The predicted probability of belonging to an abnormal user or a normal user.

[0046] The comprehensive reward function is defined as follows:

[0047] in, This represents the total reward value corresponding to the attack action in round t. This indicates the reward for a successful attack. This indicates a reward for attacking covertness. This indicates an attack efficiency bonus item; , , These are the weighting coefficients for attack success rewards, attack stealth rewards, and attack efficiency rewards, respectively.

[0048] The reward for a successful attack Used to evaluate target risk user nodes Whether a user is identified as a normal user by the target GNN financial risk control model is defined as follows:

[0049] The attack concealment reward item Used to evaluate the degree of change in graph structure and transaction amount distribution of a financial transaction graph after adding spurious transaction edges, it is defined as:

[0050] in, Indicates the target risk user node In the original financial transaction diagram Financial transaction chart after the tth round of attack The local neighborhood Jaccard similarity in the model is used to measure the degree of change in the local neighborhood structure of the target risk user node after adding a fake transaction edge. Indicates the distribution of original transaction amounts Distribution of transaction amounts after round t of attack The KL divergence between the two sides is used to measure the degree of change in the distribution of transaction amounts after adding spurious transaction edges.

[0051] Local neighborhood Jaccard similarity The calculation formula is:

[0052] in, Indicates the target risk user node In the original financial transaction diagram The set of neighboring user nodes in the middle, Indicates the target risk user node Financial transaction chart after the t-th round of attack The set of neighboring user nodes in the data; This indicates the number of neighboring user nodes shared by the target at-risk user node before and after the attack. This represents the number of neighboring user nodes of the target risky user node before and after the attack. The closer this value is to 1, the more similar the local neighborhood structure of the target risky user node is to that before the attack, and the less likely it is to detect fraudulent transaction edges.

[0053] KL divergence of transaction amount distribution The calculation formula is:

[0054] in, This indicates that the transaction amount in the original financial transaction chart falls into the first... The percentage of each amount range This indicates that the transaction amount in the financial transaction graph after the t-th round of attack falls into the t-th round of attack. The percentage of each amount range Indicates the total amount within the range. It is a smoothing coefficient used to avoid the denominator being zero; and All of these are obtained by dividing the transaction amount in the corresponding financial transaction chart into intervals, counting the number of transactions in each interval, and normalizing the result. Specifically: First, divide the transaction amount into We first define several amount intervals, then count the number of transaction edges in the financial transaction graph where the transaction amount falls into the i-th amount interval, and normalize this by dividing by the total number of transaction edges in the corresponding financial transaction graph. Finally, we obtain the number of transaction edges in the financial transaction graph where the transaction amount falls into the i-th amount interval. The percentage of each amount range.

[0055] The attack efficiency reward item This is used to constrain the model query cost during black-box attacks, and is expressed by the formula:

[0056] in, This represents the cumulative number of queries made by the attacking agent to the target GNN financial risk control model up to the t-th round of attack. Each time the attacking agent inputs the current financial transaction graph or the financial transaction graph with added fake transaction edges and the target risk user node to be predicted into the target GNN financial risk control model and obtains a prediction result for the target risk user node, the cumulative number of model queries increases by 1.

[0057] This is the query frequency penalty coefficient, used to control the impact of the model's query frequency on the overall reward function. In this embodiment, it is taken as... =0.1.

[0058] Step S2.5 Network Update Mechanism During each round of attack, the attacking agent updates the network parameters of the action value function based on the current graph state, the actions performed, the reward value obtained, and the graph state for the next round. Since action selection in this embodiment includes two stages—target risk user node selection and neighbor user node selection—the first action value function... Second action value function The network parameters can all be updated based on the Q-learning loss function.

[0059] Using Q-learning update rules, the loss function is defined as:

[0060] in, The loss function represents the action-value function. Indicates the current Q network parameters. Indicates the target Q-network parameters. Indicates the current state of the graph. Indicates the currently executing action. This represents the immediate reward value calculated by the attacking agent based on the comprehensive reward function after the current round of attack actions. This indicates the state of the next graph after the action is performed. This represents the candidate actions in the next state. This represents the action value output by the current Q-network. This represents the value of the next-state action output by the target Q-network. This represents the discount factor, used to measure the impact of future rewards on the value of current actions.

[0061] In one specific embodiment, the learning rate η =0.001, discount factor =0.95. Among them, This represents the future reward discount factor in the Q-learning update process, used to measure the impact of the next state reward on the value of the current action; Reward weighting coefficient in the comprehensive reward function They have different meanings and are used in different calculation processes.

[0062] Step S3: Execute a black-box countermeasure attack The agent interacts with the target GNN financial risk control model to perform a fake transaction addition operation, specifically: Step 3.1: Obtain the current financial transaction graph for the current round t. The current financial transaction chart Includes user node set V Current transaction edge set User node characteristics and transaction edge attribute information, wherein the transaction edge attribute information includes transaction amount and transaction time.

[0063] The attacking agent is based on the current financial transaction graph. Using the Structure2Vec (S2V) network, node embedding vectors and global graph embedding vectors are generated for each user node. These vectors are then used as state representations of the current graph state for subsequent selection of target risk user nodes and neighboring user nodes.

[0064] Step 3.2: Based on the obtained node embedding vectors and global graph embedding vectors, the attacking agent uses the first action value function. In the subset of candidate risky user nodes The action value score of each candidate risky user node is calculated, and the target risky user node with the highest action value is selected. ; in identifying target risk user nodes Then, through the second action value function In the user node set The action value score of each candidate neighbor user node is calculated, and the neighbor user node with the highest action value is selected. .

[0065] Therefore, the two endpoints of the fake transaction edge to be added in this round are determined to be... and .

[0066] In this round of attacks, the agent selected target risky user nodes. That is, the target risk user node to be attacked. This is used for subsequent querying of the target GNN financial risk control model, judgment of successful attack, and calculation of the reward function.

[0067] It should be noted that when a target risky user node has been pre-specified in the attack task, the candidate risky user node set may only include that target risky user node; when a single target node has not been pre-specified in the attack task, the candidate risky user node set may be a set of already marked risky user nodes, and the attacking agent uses the first action value function. Select the target risk user node with the highest action value in the current round.

[0068] Step 3.3: Identifying target risk user nodes and neighboring user nodes Then, the attacking agent generates a fake transaction edge between the two. , ).

[0069] For the transaction amount of the fake transaction edge, sample from the log-normal distribution fitted based on historical transaction amounts according to formula (4) to generate the fake transaction amount. In one specific embodiment, formula (5) can be used. =4.5、 The fitted parameters = 1.2 are used to generate fake transaction amounts.

[0070] For the transaction time of this fake transaction edge, the time offset is sampled from the uniform distribution according to formula (6). The time offset is then subtracted from the current time according to formula (7) to obtain the time of the fraudulent transaction. .

[0071] Will contain fake transaction amounts and fake transaction time Fake transactions ( , Add to the current financial trading chart The financial transaction graph obtained after adding fake transaction edges. .

[0072] Step 3.4: Add the fake trading edge to the financial trading chart. and the target risk user nodes to be predicted Input the target GNN financial risk control model and obtain the target risk user nodes. The user is identified by a classification label as either an abnormal or normal user; in an optional implementation, the target risk user node is also obtained. The predicted probability of belonging to an abnormal user or a normal user.

[0073] Each time the attacking agent inputs the current financial transaction graph or a financial transaction graph with added fake transaction edges, along with the target risk user node to be predicted, into the target GNN financial risk control model and obtains a prediction result for the target risk user node, it is recorded as a model query, and the cumulative number of model queries is recorded as follows. .

[0074] Step 3.5: Calculate the attack success reward based on the target risk user node prediction results output by the target GNN financial risk control model; based on the target risk user node... In the original financial transaction diagram Financial transaction chart after the tth round of attack The differences between neighboring user node sets are analyzed to calculate the local Jaccard similarity of the target node. Based on the original and post-attack transaction amount distributions, the KL divergence of the transaction amount distribution is calculated, and further, the attack concealment reward is calculated. The cumulative model query count is also considered. Calculate the attack efficiency reward item.

[0075] After obtaining the attack success reward, attack stealth reward, and attack efficiency reward, the final comprehensive reward value corresponding to the attack action in round t is calculated. .

[0076] The attacking agent is based on the aforementioned comprehensive reward value. The first action value function is updated according to the Q-learning loss function shown in formula (14), based on the current graph state, the action performed, and the next graph state. Second action value function The updated parameters include those used for approximate calculation. and The parameters of the multilayer perceptron network; in the case of using a target Q network, the periodic or soft updates of the target Q network parameters are also included.

[0077] Step 3.6: Repeat steps 3.1 to 3.5 until a preset stopping condition is met, wherein the preset stopping condition satisfies at least one of the following: (1) The attack is successful, that is, the target GNN financial risk control model identifies the target risk user node as a normal user; (2) The cumulative number of model queries has reached the preset maximum number of queries; (3) The number of fake transaction edges that have been added has reached the preset maximum number of edges to be added.

[0078] In this embodiment, the preset maximum number of queries is 20, and a maximum of 5 fake transaction edges are added during a single attack.

[0079] Among them, the cumulative number of model queries This indicates the number of times the attacking agent submits the current financial transaction graph or the financial transaction graph after adding fake transaction edges to the target GNN financial risk control model and obtains the prediction results; the number of fake transaction edges added indicates the number of fake transaction edges actually added to the financial transaction graph up to the current round of attack. The two are used to constrain the query cost of the black box model and the perturbation amplitude of the graph structure, respectively.

[0080] By setting the maximum number of queries and the maximum number of edges added, the operational cost of the attacking agent and the magnitude of graph structure perturbation can be limited, making the generated adversarial samples more in line with the requirements of limited query budget and concealed transaction behavior in black-box attack scenarios.

[0081] Step S4: Output adversarial examples When the preset stopping condition is met, output the currently obtained adversarial sample graph. The adversarial sample graph It includes user nodes in the original financial transaction graph, original transaction edges, and fake transaction edges added during the attack. The fake transaction edges include corresponding transaction amount and transaction time attributes.

[0082] If the target GNN financial risk control model identifies the target risk user node as a normal user, then the adversarial example graph... This is a successful attack sample; if the attack is unsuccessful even after reaching the maximum number of queries or the maximum number of fake transaction edges added, the currently generated financial transaction graph and the corresponding model prediction results are output to analyze the security and robustness of the target GNN financial risk control model under restricted attack conditions.

[0083] To verify the effectiveness of the above method, this embodiment conducted a simulation verification, specifically as follows: Step 1: Obtain financial transaction chart data In this embodiment, a simulated financial transaction graph is constructed, which includes 10,000 user nodes and 50,000 transaction edges. Each user node includes features such as credit score, number of historical transactions, and average transaction amount (dimension D=20). Each transaction edge includes two attributes: transaction amount and transaction time.

[0084] The target GNN financial risk control model is a GCN (Graph Convolutional Network), a 2-layer structure with 16 hidden layer dimensions, and achieves a risk identification accuracy of 92.5% on clean data.

[0085] Step 2: Constructing a reinforcement learning attack agent Step 2.1 State Coding Network Construct a Structure2Vec (S2V) network with an input node feature dimension of 20, a hidden layer dimension of 128, and an output node embedding dimension of 128, for a total of K=3 iterations.

[0086] Step 2.2 Hierarchical Decomposition of Action Space A two-layer action value function is constructed, with MLP1 and MLP2 being 3-layer fully connected networks and a hidden layer dimension of 256. Through hierarchical action space decomposition, the action of adding false transaction edges is split into two stages: target risk user node selection and neighbor user node selection.

[0087] Step 2.3 Transaction Attribute Generation The method for generating fake transaction amounts is set according to formulas (4) and (5), where formula (4) represents a log-normal distribution obtained by fitting historical transaction amounts, and formula (5) represents taking a specific example. =4.5、 The distribution of transaction amounts when the value is 1.2.

[0088] The method for generating fake transaction time is set according to formula (6) and formula (7), where formula (6) is used to sample the time offset from 1 hour to 720 hours, and formula (7) is used to subtract the time offset from the current time to obtain the fake transaction time.

[0089] Step 2.4 Reward Function Design The reward function is set according to formulas (8) to (13), where formula (8) is the comprehensive reward function, formula (9) is the attack success reward, formula (10) is the attack concealment reward, formula (11) is the target node local Jaccard similarity calculation formula, formula (12) is the transaction amount distribution KL divergence calculation formula, and formula (13) is the attack efficiency reward.

[0090] In one specific embodiment, the weighting coefficient is set to =0.6、 =0.3、 =0.1.

[0091] Step 2.5 Network Update Mechanism The Q-learning update rule is set according to formula (14), with a learning rate η = 0.001 and a discount factor. =0.95. Among them, This represents the future reward discount factor during the Q-learning update process.

[0092] Step 3: Execute black-box countermeasures attack Perform the black-box adversarial attack according to steps 3.1 to 3.6. In one specific embodiment, the maximum number of model queries is preset to 20, and a maximum of 5 fake transaction edges are added during a single attack. The attack stops when the target GNN financial risk control model identifies the target risk user node as a normal user, or when the maximum number of queries or the maximum number of fake transaction edges added are reached.

[0093] Step 4: Output adversarial examples When the preset stopping condition is met, output the currently obtained adversarial sample graph. The adversarial sample graph It includes user nodes in the original financial transaction graph, original transaction edges, and fake transaction edges added during the attack. The fake transaction edges include corresponding transaction amount and transaction time attributes.

[0094] To statistically verify the attack effectiveness of the method in this embodiment, 10 independent and repeated experiments were conducted on a simulated financial transaction graph. In each experiment, 50 risky user nodes were randomly selected from the set of labeled risky user nodes to form a subset of candidate risky user nodes, resulting in a total of 500 candidate risky user nodes across the 10 experiments. For attacks where a single target node was pre-specified, the attack was executed sequentially using the candidate risky user nodes as the target risky user nodes. For attacks where a single target node was not pre-specified, the attacking agent, based on the current state of the financial transaction graph, selected the target risky user node with the highest attack benefit in the current round from the subset of candidate risky user nodes, and further selected corresponding neighboring user nodes to perform a fake transaction edge addition operation. The experimental results are shown in Table 1. Table 1 Experimental Results

[0095] Among them, the concealed anomaly trigger rate represents the proportion of generated adversarial samples that trigger anomaly detection rules due to excessive changes in the local neighborhood structure of the target node, deviations of the transaction amount distribution from the historical transaction distribution, or abnormal transaction time.

[0096] The above results demonstrate that the method in this embodiment, by introducing edge attribute constraints (i.e., the fake transaction amount and fake transaction time generation mechanism shown in formulas (4) to (7)) and concealment optimization (i.e., the attack concealment reward, target node local Jaccard similarity, and transaction amount distribution KL divergence constraints shown in formulas (10), (11), and (12), maintains a high attack success rate while keeping the average number of queries at a low level and significantly reducing the risk of generating adversarial samples triggering anomaly detection rules. Compared with the traditional RL-S2V method and random attack method, the method in this embodiment performs better in terms of attack success rate, query efficiency, local structure concealment, and transaction amount distribution consistency, verifying the effectiveness and superiority of the method in the scenario of adversarial attacks on financial transaction graphs.

[0097] Example 2 One embodiment of the present invention provides a graph neural network adversarial attack system for financial transaction graphs, comprising: The data acquisition module is configured to: acquire financial transaction graph data and a subset of candidate risky user nodes; the financial transaction graph data includes a set of user nodes, a set of transaction edges, and attribute information of the transaction edges; the subset of candidate risky user nodes is a number of candidate risky user nodes pre-specified from the set of user nodes by the attack task. The adversarial attack module is configured to: construct a reinforcement learning attack agent, interact with the target GNN financial risk control model through the agent, select the optimal target risk user node from the subset of candidate risk user nodes under the condition of global graph embedding, select the optimal neighbor user node from the set of user nodes under the condition of optimal target risk user node embedding, and add a fake transaction edge that conforms to the historical transaction distribution and has concealment between the two selected nodes, thereby performing multiple rounds of adversarial attacks on the risk control model until the preset stopping condition is met; The sample output module is configured to output a financial transaction graph with added fake transaction edges as an adversarial example to test the security of the target GNN financial risk control model.

[0098] Example 3 One embodiment of the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned graph neural network adversarial attack method for financial transaction graphs.

[0099] Example 4 In one embodiment of the present invention, a non-transitory computer-readable storage medium is provided for storing computer instructions. When the computer instructions are executed by a processor, they implement the aforementioned graph neural network adversarial attack method for financial transaction graphs.

[0100] Example 5 One embodiment of the present invention provides an electronic device, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the graph neural network adversarial attack method for financial transaction graphs.

[0101] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0102] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0103] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A method for adversarial attacks on graph neural networks for financial transaction graphs, characterized in that, include: Obtain financial transaction graph data and a subset of candidate risky user nodes; the financial transaction graph data includes a set of user nodes, a set of transaction edges, and attribute information of the transaction edges; The subset of candidate risky user nodes is a number of candidate risky user nodes that the attack task pre-specifies from the set of user nodes; A reinforcement learning attack agent is constructed. The agent interacts with the target GNN financial risk control model. Under the condition of global graph embedding, the optimal target risk user node is selected from the subset of candidate risk user nodes. Under the condition of optimal target risk user node embedding, the optimal neighbor user node is selected from the set of user nodes. A fake transaction edge that conforms to the historical transaction distribution and has concealment is added between the two selected nodes. In this way, multiple rounds of adversarial attacks are performed on the risk control model until the preset stopping condition is met. The output financial transaction graph with added fake transaction edges is used as an adversarial example to test the security of the target GNN financial risk control model; The action space of the intelligent agent includes: selecting target risk user nodes, selecting neighboring user nodes, and setting attribute information for fake transaction edges; The agent employs a hierarchical action space decomposition strategy. Under the condition of global graph embedding, it selects the target risk user node with the largest first action value from the subset of candidate risk user nodes using the first action value function. Under the condition of optimal target risk user node embedding, it selects the neighbor user node with the largest second action value from the user node set using the second action value function. It then performs the addition of a fake transaction edge between the target risk user node and the neighbor user node.

2. The graph neural network adversarial attack method for financial transaction graphs as described in claim 1, characterized in that, The state space of the reinforcement learning attack agent includes: The state of the agent is encoded into an embedding vector through a Structure2Vec network, including the embedding vector of each user node and the global graph embedding vector. The embedding vector of each user node is generated by iteratively aggregating the feature information of its neighboring nodes, and the global graph embedding vector is obtained by summing the embedding vectors of all nodes.

3. The graph neural network adversarial attack method for financial transaction graphs as described in claim 1, characterized in that, The attribute information includes at least the transaction amount and transaction time. The attribute information for setting up a fake transaction edge is specifically as follows: A log-normal distribution is used to fit historical transaction amounts to generate fake transaction amounts; A uniformly distributed transaction time offset is generated, and the time of a fake transaction is set to the current timestamp minus this offset.

4. The graph neural network adversarial attack method for financial transaction graphs as described in claim 1, characterized in that, The reward function of the agent is obtained by combining the attack success reward, the attack concealment reward, and the attack efficiency penalty. The attack concealment reward is calculated based on the local Jaccard similarity index of the target node and the KL divergence index of the transaction amount distribution.

5. The graph neural network adversarial attack method for financial transaction graphs as described in claim 1, characterized in that, The preset stopping condition shall satisfy at least one of the following: The attack was successful; the target GNN financial risk control model identified the target risky user node as a normal user. The cumulative number of model queries has reached the preset maximum number of queries; The number of fake transaction edges added has reached the preset maximum number of edges to add.

6. A graph neural network adversarial attack system for financial transaction graphs, characterized in that, The method employs a graph neural network adversarial attack approach for financial transaction graphs as described in any one of claims 1-5, comprising: The data acquisition module is configured to: acquire financial transaction graph data and a subset of candidate risky user nodes; the financial transaction graph data includes a set of user nodes, a set of transaction edges, and attribute information of the transaction edges; the subset of candidate risky user nodes is a number of candidate risky user nodes pre-specified from the set of user nodes by the attack task. The adversarial attack module is configured to: construct a reinforcement learning attack agent, interact with the target GNN financial risk control model through the agent, select the optimal target risk user node from the subset of candidate risk user nodes under the condition of global graph embedding, select the optimal neighbor user node from the set of user nodes under the condition of optimal target risk user node embedding, and add a fake transaction edge that conforms to the historical transaction distribution and has concealment between the two selected nodes, thereby performing multiple rounds of adversarial attacks on the risk control model until the preset stopping condition is met; The sample output module is configured to output a financial transaction graph with added fake transaction edges as an adversarial example to test the security of the target GNN financial risk control model.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the graph neural network adversarial attack method for financial transaction graphs as described in any one of claims 1-5.

8. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium is used to store computer instructions, which, when executed by a processor, implement a graph neural network adversarial attack method for financial transaction graphs as described in any one of claims 1-5.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to perform a graph neural network adversarial attack method for financial transaction graphs as described in any one of claims 1-5.

Images