Statistical data correlation retrieval and mining system based on fusion graph neural network

Abstract

This invention relates to the field of data retrieval technology and discloses a statistical data association retrieval and mining system integrating graph neural networks. The system includes a data acquisition and graph construction module configured to acquire multi-source heterogeneous data and extract entities and relationships to construct a heterogeneous graph data. The heterogeneous graph data includes nodes and edges; the nodes include at least user identifiers, device fingerprints, IP addresses, and transaction events, and the edges represent the associations between nodes. A graph neural network embedding module is configured to extract features from the nodes in the heterogeneous graph data using a pre-trained graph neural network model. This invention, by constructing a heterogeneous graph and integrating graph neural network embedding with a few-shot learning mechanism, enables the system to achieve accurate node identification with only a very small number of labeled fraud samples, effectively overcoming the shortcomings of traditional methods that rely on large-scale labeled data. It is particularly suitable for real-world business scenarios where fraud patterns evolve rapidly.

Description

Technical Field

[0001] This invention relates to the field of data retrieval technology, and in particular to a statistical data association retrieval and mining system that integrates graph neural networks. Background Technology

[0002] In recent years, with the rapid development of internet finance, e-commerce, and social media platforms, various forms of fraud have become increasingly prevalent, causing significant economic losses to individuals and businesses. To effectively combat increasingly sophisticated fraud methods, data-driven intelligent risk control systems have become a research hotspot. Among these methods, using graph neural networks to model massive amounts of interactive data and uncover the complex relationships between entities such as users, devices, IP addresses, and transaction events has proven to be an effective way to improve the accuracy of fraud detection.

[0003] Existing fraud detection schemes typically require a large number of labeled fraudulent and legitimate samples to train a classification model through supervised learning. For example, a common approach is to first construct a heterogeneous graph where nodes include users, transactions, devices, etc., and edges represent relationships such as login, transfers, and shared devices; then, a graph neural network (such as a graph convolutional network (GCN) or a graph attention network (GAT)) is used to embed the nodes; finally, the embedding vectors are input into a fully connected layer or a logistic regression classifier to output the fraud probability. This type of method can achieve good results when there are sufficient fraudulent samples.

[0004] However, in real-world business scenarios, fraudulent activities are highly covert and evolving. New fraud patterns often emerge very recently, or the extremely high cost of manual labeling results in very few labeled fraud samples available to the system, sometimes only 1 to 5 positive examples. Summary of the Invention

[0005] This invention provides a statistical data association retrieval and mining system that integrates graph neural networks to solve existing technical problems, thereby addressing issues such as high false negative rate, poor generalization ability, and slow response speed caused by the scarcity of samples in the prior art.

[0006] To solve the above-mentioned technical problems, according to one aspect of the present invention, more specifically, a statistical data association retrieval and mining system integrating graph neural networks, comprising: The data acquisition and graph construction module is configured to acquire multi-source heterogeneous data, extract entities and relationships from it to construct heterogeneous graph data; the heterogeneous graph data includes nodes and edges, the nodes include at least user identifiers, device fingerprints, IP addresses, and transaction events, and the edges represent the association relationships between nodes; The graph neural network embedding module is configured to use a pre-trained graph neural network model to extract features from nodes in heterogeneous graph data and generate an embedding vector for each node. The embedding vector is used to characterize the statistical features of the node in the global topology. The few-sample fraud detection module is configured to use a very small number of labeled fraud samples as a support set to calculate the distance or similarity between the embedding vector of the target node to be detected and the prototype vectors of each category in the support set, thereby determining whether the target node belongs to the fraud category. The association retrieval and mining module is configured to perform multi-hop association retrieval in heterogeneous graph data in response to identified fraudulent nodes, mine the hidden gang structure and high-risk propagation path associated with the fraudulent nodes, and output the association retrieval and mining results.

[0007] Furthermore, the small sample fraud detection module includes: Supports set construction units, configured to obtain K fraud sample nodes and N normal sample nodes labeled by the user, where K and N are both positive integers, and K << N, with the value of K ranging from 1 to 5; The prototype calculation unit is configured to input nodes from the support set into the graph neural network embedding module to obtain the embedding vector of each node, and to calculate the prototype vector of the fraud category and the prototype vector of the normal category respectively; the prototype vector of the fraud category is the mean vector of the embedding vectors of all fraud sample nodes, and the prototype vector of the normal category is the mean vector of the embedding vectors of all normal sample nodes. The distance metric unit is configured to calculate a first distance between the embedding vector of the target node and the prototype vector of the fraud category, and a second distance between the embedding vector and the prototype vector of the normal category; The fraud determination unit is configured to calculate the probability that the target node belongs to the fraud category based on the first distance and the second distance. If the probability is greater than a preset threshold, the target node is determined to be a fraud node.

[0008] Furthermore, the distance metric unit is configured to calculate a first distance between the embedding vector of the target node and the fraud category prototype vector using the following formula: ; In the above formula, This represents the first distance between the embedding vector of the target node and the prototype vector of the fraud category; Represents the embedding vector of the target node; This represents the prototype vector for the fraud category.

[0009] Furthermore, the fraud determination unit is configured to calculate the probability that the target node belongs to the fraud category using the following formula: ; In the above formula, This indicates the probability that the target node belongs to the fraud category; This represents the prototype vector of the normal category.

[0010] Furthermore, the small sample fraud detection module includes a relational network unit and an aggregation determination unit: the relational network unit is configured to concatenate or fuse the embedding vector of the target node with the embedding vector of each sample node in the support set, and input the result into a learnable deep relational network, and output the similarity score between the target node and each support sample.

[0011] Furthermore, the aggregation determination unit is configured to aggregate the similarity scores of the target node with all fraudulent supporting samples and the similarity scores with all normal supporting samples, and determine the category of the target node based on the aggregation results.

[0012] Furthermore, the graph neural network embedding module employs a heterogeneous graph attention network, which is configured to adaptively aggregate the features of neighboring nodes through a node-level attention mechanism for different types of edges during message passing, in order to generate the embedding vector of the node.

[0013] Furthermore, the association retrieval and mining module includes a gang mining unit and a path mining unit; the gang mining unit is configured to start from the identified fraudulent node, traverse its multi-level neighbor nodes in the heterogeneous graph data, count the co-occurrence frequency of each neighbor node and the fraudulent node, and identify the subgraph composed of neighbor nodes whose co-occurrence frequency exceeds a preset threshold as a suspicious gang structure.

[0014] Furthermore, the path mining unit is configured to use a graph path search algorithm to mine the shortest path or critical path connecting multiple different fraudulent nodes, and output the node sequence on the shortest path or critical path as a high-risk propagation path.

[0015] This invention provides a statistical data association retrieval and mining system that integrates graph neural networks. Compared with existing technologies, the advantages achieved by this method are as follows: 1. This invention constructs a heterogeneous graph and integrates graph neural network embedding with few-shot learning mechanism, enabling the system to complete accurate node identification with only a very small number of labeled fraud samples. This effectively overcomes the shortcomings of traditional methods that rely on large-scale labeled data, and is especially suitable for real-world business scenarios where fraud patterns evolve rapidly.

[0016] 2. This invention employs a distance metric and probability normalization method based on prototype networks. By exponentially calculating the negative distance and class probability in the embedding space, efficient small-sample classification can be achieved without additional classifier training, significantly improving the accuracy and robustness of fraud detection under conditions of scarce samples.

[0017] 3. This invention introduces a learnable relational network to replace the fixed distance metric. The embedding vectors of the target node and the supporting samples are concatenated and fused and then input into the deep network. This can capture complex nonlinear similarity patterns and enhance the system's adaptability and generalization performance to different embedding distribution scenarios.

[0018] 4. This invention uses a heterogeneous graph attention network to adaptively aggregate neighbor features of different types of edges, and combines multi-hop association retrieval and gang path mining to reveal hidden fraud gang structures and high-risk propagation chains. It provides risk control personnel with interpretable and traceable in-depth analysis results, and improves the linkage and prevention capabilities of the overall risk control system. Attached Figure Description

[0019] Figure 1 This is a flowchart of the present invention; Figure 2 In this invention Follow A schematic diagram illustrating the changes; Figure 3 This is a surface plot of the fraud probability in this invention; Figure 4 This is a flowchart of the small sample fraud detection module in this invention. Detailed Implementation

[0020] To make the technical solution of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Example 1

[0021] like Figure 1 As shown, according to one aspect of the present invention, a statistical data association retrieval and mining system integrating graph neural networks is provided, comprising: The data acquisition and graph construction module is configured to acquire multi-source heterogeneous data, extract entities and relationships to construct heterogeneous graph data; the heterogeneous graph data includes nodes and edges, where nodes include at least user identifiers, device fingerprints, IP addresses, and transaction events, and edges represent the relationships between nodes; the graph neural network embedding module is configured to use a pre-trained graph neural network model to extract features from nodes in the heterogeneous graph data, generating an embedding vector for each node, which is used to characterize the statistical features of the node in the global topology; the few-shot fraud identification module is configured to use a very small number of labeled fraud samples as a support set based on a few-shot learning mechanism, calculate the distance or similarity between the embedding vector of the target node to be detected and the prototype vectors of each category in the support set, and then determine whether the target node belongs to the fraud category; the association retrieval and mining module is configured to perform multi-hop association retrieval in the heterogeneous graph data in response to the identified fraud nodes, mine the hidden gang structure and high-risk propagation path associated with the fraud nodes, and output the association retrieval and mining results.

[0022] This embodiment proposes a system architecture that integrates graph neural networks and few-shot learning mechanisms. First, a data acquisition and graph construction module extracts entities (such as users, devices, IPs, and transaction events) and their relationships from multi-source heterogeneous data to construct a heterogeneous graph. Then, a pre-trained graph neural network module generates an embedding vector for each node, capturing its statistical features within the global topology. Based on this, a few-shot fraud detection module relies on only a very small number of labeled samples (e.g., 1-5 fraudulent samples) as a support set, calculating the distance or similarity between the target node and the category prototype vector to achieve fraud detection. Finally, an association retrieval and mining module uses the identified fraudulent nodes as starting points to perform multi-hop association retrieval, uncovering hidden groups and high-risk propagation paths.

[0023] This architecture effectively solves the bottleneck problem of traditional fraud detection methods relying on a large number of labeled samples, making it particularly suitable for real-world business scenarios where fraudulent behavior evolves frequently and labeling costs are high. By introducing a few-shot learning mechanism, the system can achieve fast and accurate fraud identification with a very small number of positive examples. Combined with the association mining capabilities of graph structures, it significantly improves the detection rate and response timeliness of concealed fraudulent behavior. Example 2

[0024] like Figure 1 , Figure 2 , Figure 3 As shown, according to one aspect of the present invention, a statistical data association retrieval and mining system integrating graph neural networks is provided, wherein a small sample fraud detection module includes: Supports set construction units, configured to obtain K fraud sample nodes and N normal sample nodes labeled by the user, where K and N are both positive integers, and K << N, with the value of K ranging from 1 to 5; The prototype calculation unit is configured to input the nodes of the support set into the graph neural network embedding module to obtain the embedding vector of each node, and to calculate the prototype vector of the fraud category and the prototype vector of the normal category respectively; the prototype vector of the fraud category is the mean vector of the embedding vectors of all fraud sample nodes, and the prototype vector of the normal category is the mean vector of the embedding vectors of all normal sample nodes. The distance metric unit is configured to calculate a first distance between the embedding vector of the target node and the prototype vector of the fraud category, and a second distance between the embedding vector and the prototype vector of the normal category; The fraud determination unit is configured to calculate the probability that the target node belongs to the fraud category based on the first distance and the second distance. If the probability is greater than a preset threshold, the target node is determined to be a fraud node.

[0025] In this embodiment, the distance metric unit is configured to calculate the first distance between the embedding vector of the target node and the fraud category prototype vector using the following formula: ; In the above formula, This represents the first distance between the embedding vector of the target node and the prototype vector of the fraud category; Represents the embedding vector of the target node; This represents the prototype vector for the fraud category.

[0026] like Figure 2 , Figure 3 As shown, fixed hour, Follow The change graph is shown. Furthermore, the fraud detection unit is configured to calculate the probability that the target node belongs to the fraud category using the following formula: ; In the above formula, This indicates the probability that the target node belongs to the fraud category; This represents the prototype vector of the normal category. The specific steps to obtain the above are as follows: Step S1: Define a distance-based "compatibility" or "energy" score. In the embedding space, an intuitive assumption is that the closer a node is to the prototype of a certain category, the more likely it is to belong to that category. Therefore, we need a mechanism to convert "distance" into "similarity score".

[0027] Distance itself is generally considered to be as small as possible. To convert this to a score where "larger is better," a standard approach is to take the negative of the distance. We define nodes... With fraud prototype Compatibility score between for: ; Similarly, the compatibility score with the normal prototype is: ; The higher the compatibility score (i.e., the smaller the negative distance, which means the smaller the original distance), the better the node matches the prototype.

[0028] Step S2: Apply an exponential function to convert the scores to non-negative values ​​and amplify the differences. Original compatibility score It can be negative (because the distance d ≥ 0, so -d ≤ 0). For subsequent probability calculations, we need a non-negative function that amplifies the difference. The exponential function perfectly satisfies this requirement: (1) For all real numbers Established.

[0029] (2) The exponential function is monotonically increasing, therefore it maintains the relative order of scores. If ,So .

[0030] (3) The exponential growth property can amplify the differences between scores. For example, if two compatibility scores differ by 1, after exponentialization, their ratio will be... The difference is even more significant when the difference is multiplied by a factor of two.

[0031] Therefore, the non-negative compatibility between nodes and fraud categories is defined as follows: Non-negative compatibility with normal categories is .

[0032] Step S3: Calculate the probability distribution through normalization. To ensure the final output has probabilistic meaning (the sum of the probabilities of all possible categories is 1), we need to normalize the non-negative compatibility calculated above. In a binary classification problem (fraud vs. normal), the probability that a target node belongs to the fraud category is the proportion of its non-negative compatibility to the total compatibility: ; Substituting the expression from step 2, we get: ; In the above formula, This indicates the probability that the target node belongs to the fraud category; The normal category prototype vector is specifically: ; In the above formula, This represents the prototype vector of the normal category.

[0033] This embodiment employs the prototype network concept, constructing a support set (containing a small number of fraudulent and normal samples) and inputting it into a graph neural network module to obtain embedding vectors. By calculating the prototype vectors of the fraudulent and normal classes (i.e., the mean of the embeddings for each class), and then calculating the Euclidean distance between the target node and the two prototype classes, a Softmax-style probability formula (exponentializing and normalizing the negative distance) is used to determine the probability that the target node belongs to the fraudulent category. If this probability exceeds a preset threshold, it is determined to be a fraudulent node.

[0034] This method eliminates the need for additional classifier training, achieving efficient small-sample classification solely through distance metrics in the embedding space, significantly reducing the model's reliance on large-scale labeled data. Furthermore, by employing exponentialization and normalization, the method enhances the expressive power of distance differences, making nodes near the prototype vector in the embedding space more easily classified correctly, thus improving the accuracy of fraud detection. Example 3

[0035] like Figure 1 , Figure 2 As shown, according to one aspect of the present invention, a statistical data association retrieval and mining system integrating graph neural networks is provided, wherein the small sample fraud identification module includes a relation network unit and an aggregation determination unit: the relation network unit is configured to concatenate or feature-fuse the embedding vector of the target node with the embedding vector of each sample node in the support set, and input the result into a learnable deep relation network, and output the similarity score between the target node and each support sample.

[0036] In this embodiment, the aggregation determination unit is configured to aggregate the similarity scores of the target node with all fraudulent supporting samples and the similarity scores with all normal supporting samples, and determine the category of the target node based on the aggregation results.

[0037] This embodiment employs a relational network architecture instead of a fixed distance metric. It concatenates or fuses the embedding vector of the target node with the embedding vector of each sample node in the support set, then inputs this concatenation into a learnable deep relational network, outputting a similarity score between the target node and each support sample. Subsequently, it aggregates the similarity scores between the target node and all fraudulent support samples, as well as the similarity scores with all normal support samples, and determines the category of the target node based on the aggregation result.

[0038] Compared to fixed distance metrics (such as Euclidean distance), relational networks can capture more complex patterns of similarity between nodes through learnable nonlinear mappings, adapting to different embedding space distribution characteristics. This end-to-end learning approach improves the expressive power and generalization performance of few-sample fraud detection, and is particularly suitable for real-world graph data scenarios with highly nonlinear node embedding distributions. Example 4

[0039] like Figure 1 As shown, according to one aspect of the present invention, a statistical data association retrieval and mining system integrating graph neural networks is provided, wherein the graph neural network embedding module adopts a heterogeneous graph attention network, which is configured to adaptively aggregate the features of neighboring nodes through a node-level attention mechanism for different types of edges during message passing, so as to generate the embedding vector of the node.

[0040] In this embodiment, the association retrieval and mining module includes a gang mining unit and a path mining unit. The gang mining unit is configured to start from the identified fraudulent node, traverse its multi-level neighbor nodes in the heterogeneous graph data, count the co-occurrence frequency of each neighbor node and the fraudulent node, and identify the subgraph composed of neighbor nodes whose co-occurrence frequency exceeds a preset threshold as a suspicious gang structure.

[0041] The path mining unit is configured to use a graph path search algorithm to mine the shortest path or critical path connecting multiple different fraud nodes, and output the node sequence on the shortest path or critical path as a high-risk propagation path.

[0042] In this embodiment, the graph neural network embedding module employs a heterogeneous graph attention network. During message passing, it adaptively aggregates the features of neighboring nodes through a node-level attention mechanism for different types of edges, thereby generating more discriminative node embedding vectors. Simultaneously, the association retrieval and mining module includes a gang mining unit and a path mining unit: the former starts with a fraudulent node, counts the co-occurrence frequency of multi-level neighboring nodes, and extracts suspicious gang structures; the latter uses a graph path search algorithm to mine the shortest or critical path connecting multiple fraudulent nodes and outputs high-risk propagation paths.

[0043] Heterogeneous graph attention networks can effectively distinguish different types of edges (such as login, transfer, and shared devices) and focus attention weights on the neighbor information most important for fraud identification, significantly improving the semantic expressiveness of the embedded vectors. Combined with gang and path mining, the system can not only identify isolated fraud nodes, but also reveal hidden fraud gangs and high-risk propagation chains, providing risk control personnel with interpretable and traceable decision support, greatly enhancing the system's deep analysis and coordinated prevention and control capabilities.

[0044] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A statistical data association retrieval and mining system integrating graph neural networks, characterized in that, include: The data acquisition and graph construction module is configured to acquire multi-source heterogeneous data, extract entities and relationships from it to construct heterogeneous graph data; the heterogeneous graph data includes nodes and edges, the nodes include at least user identifiers, device fingerprints, IP addresses, and transaction events, and the edges represent the association relationships between nodes; The graph neural network embedding module is configured to use a pre-trained graph neural network model to extract features from nodes in heterogeneous graph data and generate an embedding vector for each node. The embedding vector is used to characterize the statistical features of the node in the global topology. The few-sample fraud detection module is configured to use a very small number of labeled fraud samples as a support set to calculate the distance or similarity between the embedding vector of the target node to be detected and the prototype vectors of each category in the support set, thereby determining whether the target node belongs to the fraud category. The association retrieval and mining module is configured to perform multi-hop association retrieval in heterogeneous graph data in response to identified fraudulent nodes, mine the hidden gang structure and high-risk propagation path associated with the fraudulent nodes, and output the association retrieval and mining results.

2. The statistical data association retrieval and mining system based on fused graph neural networks according to claim 1, characterized in that: The small sample fraud detection module includes: Supports set construction units, configured to obtain K fraud sample nodes and N normal sample nodes labeled by the user; The prototype calculation unit is configured to input nodes from the support set into the graph neural network embedding module to obtain the embedding vector of each node, and to calculate the prototype vector of the fraud category and the prototype vector of the normal category respectively; the prototype vector of the fraud category is the mean vector of the embedding vectors of all fraud sample nodes, and the prototype vector of the normal category is the mean vector of the embedding vectors of all normal sample nodes. The distance metric unit is configured to calculate a first distance between the embedding vector of the target node and the prototype vector of the fraud category, and a second distance between the embedding vector and the prototype vector of the normal category; The fraud determination unit is configured to calculate the probability that the target node belongs to the fraud category based on the first distance and the second distance. If the probability is greater than a preset threshold, the target node is determined to be a fraud node.

3. The statistical data association retrieval and mining system based on fused graph neural networks according to claim 2, characterized in that: The distance metric unit is configured to calculate the first distance between the embedding vector of the target node and the fraud category prototype vector using the following formula: ； In the above formula, This represents the first distance between the embedding vector of the target node and the prototype vector of the fraud category; Represents the embedding vector of the target node; This represents the prototype vector for the fraud category.

4. The statistical data association retrieval and mining system based on fused graph neural networks according to claim 3, characterized in that: The fraud determination unit is configured to calculate the probability that the target node belongs to the fraud category using the following formula: ； In the above formula, This indicates the probability that the target node belongs to the fraud category; This represents the prototype vector of the normal category.

5. The statistical data association retrieval and mining system based on fused graph neural networks according to claim 1, characterized in that: The small sample fraud detection module includes a relation network unit and an aggregation judgment unit: the relation network unit is configured to concatenate or fuse the embedding vector of the target node with the embedding vector of each sample node in the support set, and input the result into a learnable deep relation network, and output the similarity score between the target node and each support sample.

6. The statistical data association retrieval and mining system based on fused graph neural networks according to claim 5, characterized in that: The aggregation determination unit is configured to aggregate the similarity scores of the target node with all fraudulent supporting samples and the similarity scores with all normal supporting samples, and determine the category of the target node based on the aggregation results.

7. The statistical data association retrieval and mining system based on fused graph neural networks according to claim 1, characterized in that: The graph neural network embedding module employs a heterogeneous graph attention network, which is configured to adaptively aggregate the features of neighboring nodes through a node-level attention mechanism for different types of edges during message passing, in order to generate the embedding vector of the node.

8. The statistical data association retrieval and mining system based on fused graph neural networks according to claim 1, characterized in that: The association retrieval and mining module includes a gang mining unit and a path mining unit. The gang mining unit is configured to start from the identified fraudulent node, traverse its multi-level neighbor nodes in the heterogeneous graph data, count the co-occurrence frequency of each neighbor node and the fraudulent node, and identify the subgraph composed of neighbor nodes whose co-occurrence frequency exceeds a preset threshold as a suspicious gang structure.

9. The statistical data association retrieval and mining system based on fused graph neural networks according to claim 8, characterized in that: The path mining unit is configured to use a graph path search algorithm to mine the shortest path or critical path connecting multiple different fraud nodes, and output the node sequence on the shortest path or critical path as a high-risk propagation path.

Images