Fraudulent user detection method and apparatus, computer device, and storage medium

Abstract

This invention relates to the field of data processing technology and discloses a method, apparatus, computer equipment, and storage medium for detecting fraudulent users. The method involves acquiring target attribute data of a target user and candidate attribute data of multiple candidate users among credit users; determining at least one associated user of the target user based on the target attribute data and candidate attribute data; determining the associated user feature vector and user tag type of each associated user based on the candidate attribute data, and further determining fraud feature vector, integrity feature vector, and unknown feature vector; determining the target user feature vector of the target user based on the target attribute data; determining the feature conflict score of the target user based on the fraud gating vector, integrity gating vector, and unknown gating vector obtained based on a preset gating model; and determining the fraud detection result of the target user based on the feature conflict score. This invention improves the accuracy of fraudulent user detection based on group gating processing and feature conflict scoring.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, computer equipment, and storage medium for detecting fraudulent users. Background Technology

[0002] In the financial sector, user fraud undermines the fairness of financial markets and disrupts normal trading order. Existing technologies leverage the ability of graph networks to effectively handle complex relational data, determining high-level feature representations of nodes and edges, thereby enabling financial fraud detection. However, graph networks overlook the deception behavior of fraudulent users, gradually revealing their limitations in financial fraud detection. Fraudulent users disguise themselves, making graph network-based fraud detection methods susceptible to the inaccuracy of node information, leading to decreased detection capabilities. For example, in financial lending, a user might falsify their original annual income of 100,000 to claim 1 million, thus obtaining a higher credit line. Therefore, graph network-based fraud detection methods cannot effectively identify conflicts between falsified features and other genuine features, reducing the accuracy of fraud detection. Summary of the Invention

[0003] Therefore, it is necessary to provide a method, apparatus, computer equipment, and storage medium for detecting fraudulent users in order to address the aforementioned technical problems and solve the problem of low accuracy in detecting fraudulent users.

[0004] A method for detecting fraudulent users includes: Based on the fraud analysis request, target users and at least one candidate user are identified from all credit users, and target attribute data of the target user and candidate attribute data of each candidate user are obtained. Graph network analysis is performed on the target attribute data and candidate attribute data, and based on the results of the graph network analysis, at least one associated user of the target user is determined from all the candidate users. Based on the candidate attribute data, determine the associated user feature vector and user tag type for each associated user, and based on the associated user feature vector and user tag type for all associated users, determine the fraud feature vector, integrity feature vector, and unknown feature vector; Based on the target attribute data, the target user feature vector of the target user is determined. The target user feature vector, the fraud feature vector, the integrity feature vector, and the unknown feature vector are grouped and analyzed using a preset gating model to obtain the fraud gating vector, the integrity gating vector, and the unknown gating vector. Based on the target user feature vector, the fraud gating vector, the integrity gating vector, and the unknown gating vector, the feature conflict score of the target user is determined, and the fraud detection result of the target user is determined based on the feature conflict score.

[0005] A fraud detection device includes: The attribute data acquisition module is used to identify target users and at least one candidate user from all credit users according to the fraud analysis request, and to acquire target attribute data of the target user and candidate attribute data of each candidate user. The associated user determination module is used to perform graph network analysis processing based on the target attribute data and candidate attribute data, and determine at least one associated user of the target user from all the candidate users based on the results of the graph network analysis processing. The feature vector determination module is used to determine the associated user feature vector and user tag type of each of the associated users based on the candidate attribute data, and to determine the fraud feature vector, integrity feature vector and unknown feature vector based on the associated user feature vector and user tag type of all the associated users; The gate vector determination module is used to determine the target user feature vector of the target user based on the target attribute data, and to perform group analysis processing on the target user feature vector, the fraud feature vector, the integrity feature vector and the unknown feature vector through a preset gate model to obtain the fraud gate vector, the integrity gate vector and the unknown gate vector; The detection result determination module is used to determine the feature conflict score of the target user based on the target user feature vector, the fraud gating vector, the integrity gating vector and the unknown gating vector, and to determine the fraud detection result of the target user based on the feature conflict score.

[0006] A computer device includes a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein the processor implements the aforementioned fraudulent user detection method when executing the computer-readable instructions.

[0007] A computer-readable storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the fraudulent user detection method described above.

[0008] In the aforementioned fraud user detection method, apparatus, computer equipment, and storage medium, the fraud user detection method identifies a target user and at least one candidate user from all credit users based on a fraud analysis request, and obtains the target user's target attribute data and the candidate attribute data of each candidate user; based on the target attribute data and candidate attribute data, it identifies at least one associated user of the target user from all candidate users; based on the candidate attribute data, it determines the associated user feature vector and user tag type of each associated user, and based on the associated user feature vector and user tag type of all associated users, it determines the fraud feature vector, integrity feature vector, and unknown feature vector; based on the target attribute data, it determines the target user feature vector of the target user, and performs group analysis processing on the target user feature vector, fraud feature vector, integrity feature vector, and unknown feature vector through a preset gating model to obtain the fraud gating vector, integrity gating vector, and unknown gating vector; based on the target user feature vector, fraud gating vector, integrity gating vector, and unknown gating vector, it determines the feature conflict score of the target user, and determines the fraud detection result of the target user based on the feature conflict score. This invention performs group gating processing on target user feature vectors, fraud feature vectors, integrity feature vectors, and unknown feature vectors. This can filter out feature information that is helpful for subsequent analysis. At the same time, based on the vectors after group gating processing, the feature conflict score of the target user is determined, which can effectively identify the degree of conflict between user forgery features and other real features, thereby improving the accuracy of fraud user detection. Attached Figure Description

[0009] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a flowchart illustrating a fraudulent user detection method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of graph network analysis of a fraudulent user detection method in one embodiment of the present invention; Figure 3 This is a flowchart illustrating step S20 of a fraudulent user detection method in one embodiment of the present invention; Figure 4 This is a flowchart illustrating step S30 of a fraudulent user detection method in one embodiment of the present invention; Figure 5 This is a flowchart illustrating step S40 of a fraudulent user detection method in one embodiment of the present invention; Figure 6This is a flowchart illustrating step S50 of a fraudulent user detection method in one embodiment of the present invention; Figure 7 This is a flowchart illustrating step S502 of the fraudulent user detection method in one embodiment of the present invention; Figure 8 This is another flowchart illustrating step S50 in a fraudulent user detection method according to an embodiment of the present invention; Figure 9 This is a schematic diagram of a fraudulent user detection device according to an embodiment of the present invention; Figure 10 This is a schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0011] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0012] The fraudulent user detection method provided in this embodiment can be applied in scenarios where the server detects whether a user is fraudulent based on user data submitted by the client. The client communicates with the server, and the client includes, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0013] Specifically, during and after loan disbursement, the server needs to analyze the attribute data of new and existing users and promptly identify fraudulent users. Fraudulent users refer to those who obtain credit through financial lending using forged or false information. This embodiment employs deep learning technology and a contrastive learning method based on a grouped gating mechanism to improve the predictive accuracy of financial fraud prevention and enhance the security of financial lending.

[0014] In one embodiment, such as Figure 1 As shown, a method for detecting fraudulent users is provided. Taking the application of this method on the server side as an example, it includes the following steps S10-S50.

[0015] S10. Based on the fraud analysis request, identify the target user and at least one candidate user from all credit users, and obtain the target attribute data of the target user and the candidate attribute data of each candidate user.

[0016] Understandably, a credit user refers to a client user of a financial credit client, such as... Figure 2 There are nine client users, u1 to u9, representing credit users. Operations personnel can specify a credit user as a target user by inputting or selecting information on the client's display interface. The client generates a fraud analysis request based on the user information specified by the operations personnel and sends it to the server. The fraud analysis request requests information to assess whether the specified credit user is a fraudulent user. The server, based on the fraud analysis request, determines the target user from all client users and identifies the remaining client users as candidate users. The set of target users and candidate users constitutes all credit users. A target user is the object to be detected for fraud, i.e., the specified client user whose fraud is being determined, such as... Figure 2 In this context, client user u6 is the target user. Candidate users refer to the remaining client users besides the target user, such as... Figure 2 All client users except u6 are considered candidate users. Target users can be new users or existing users whose attribute data has changed. Target attribute data refers to the attribute data of the target user, while candidate attribute data refers to the attribute data of the candidate users. Attribute data is characteristic data used to characterize the differences between different users, such as user age.

[0017] S20. Perform graph network analysis processing based on the target attribute data and candidate attribute data, and determine at least one associated user of the target user from all the candidate users based on the results of the graph network analysis processing.

[0018] Understandably, the server uses graph network analysis to compare the target user's target attribute data with the candidate attribute data of all candidate users, identifying at least one related user of the target user from all candidate users. A related user is a user similar to the target user in terms of a specific attribute. For example, when the specific attribute is user address, if the target user's address is Shenzhen, then all candidate users with Shenzhen addresses are considered related users of the target user.

[0019] In one embodiment, such as Figure 3 As shown, step S20, namely, performing graph network analysis based on the target attribute data and candidate attribute data, and determining at least one associated user of the target user from all candidate users based on the results of the graph network analysis, includes: S201. Obtain the target individual attribute data from the target attribute data and the candidate individual attribute data from the candidate attribute data; S202. Perform graph network analysis on the target individual attribute data of the target user and the candidate individual attribute data of all the candidate users to obtain a target user subgraph; the node users of the target user subgraph include the target user and the candidate users among all the candidate users who have an adjacent relationship with the target user; S203. All candidate users in the target user subgraph are identified as associated users of the target user.

[0020] Understandably, when identifying at least one associated user of the target user from all candidate users, the server first obtains the target individual attribute data from the target attribute data and the candidate individual attribute data from the candidate attribute data. The credit user's attribute data includes transaction attribute data, behavioral attribute data, and individual attribute data. Individual attribute data is used to characterize the differences in personal information between different users, including age, gender, education level, and address. Target individual attribute data refers to the target user's individual attribute data, and candidate individual attribute data refers to the candidate users' individual attribute data. Next, the server performs graph network analysis on the target individual attribute data and all candidate individual attribute data to obtain the target user subgraph. Graph network analysis is a processing method that models objects (such as client users) as nodes and relationships between objects (such as social connections, transaction behavior similarity, and clustering) as edges, forming a graph structure. A graph network has a structure of nodes (users) and edges (relationships). The target user subgraph refers to the subgraph structure obtained through graph network analysis, with the target user as the core node, containing candidate users with directly related edges and their connection relationships. The target user subgraph's node users include the target user and all candidate users who have an adjacent relationship with the target user. Finally, the server determines all candidate users in the target user subgraph as associated users of the target user. Figure 2 The target user subgraph in the graph is a subgraph structure with target user u6 as the core node, containing five candidate users u4, u5, u7, u8, and u9, along with their connections. In this case, u4, u5, u7, u8, and u9 are all associated users of target user u6. The target user serves as the central node of the subgraph, and the target user's individual attribute data (such as age, address, and behavioral preferences) is the starting point for analysis. Associated users are other node users with potential relationships to the target user, and their individual attribute data is connected to the target user through edges in the graph network.

[0021] This embodiment performs graph network analysis on target users and candidate users from the perspective of individual attributes. Through the nodes and edges in the graph network, the direct or indirect relationship between users can be intuitively reflected, thereby accurately filtering out related users and helping to detect fraud among target users.

[0022] S30. Determine the associated user feature vector and user tag type for each of the associated users based on the candidate attribute data, and determine the fraud feature vector, integrity feature vector, and unknown feature vector based on the associated user feature vector and user tag type of all the associated users.

[0023] Understandably, the server determines the associated user feature vector and user tag type based on the candidate attribute data of each associated user. The associated user feature vector refers to the result of converting the candidate attribute data corresponding to the associated user into a vector representation. The user tag type is an identifier used to characterize whether a user has been identified as a fraudulent user in historical data, and is divided into fraudulent user tags, honest user tags, and unknown user tags. For example... Figure 2 As shown, the fraudulent user label is represented by three concentric circles, specifically indicating that client user u7 is a historically known fraudulent user. The benign user label is represented by two concentric circles, specifically indicating that client users u1, u2, u5, u8, and u9 are historically known benign users. The unlabeled user label is represented by three concentric circles, specifically indicating that client users u3, u4, and u6 are unlabeled users who have not yet been identified. Based on the user label type, the server merges the associated user feature vectors of all related users with the same user label type to determine the fraudulent feature vector, the benign feature vector, and the unlabeled feature vector.

[0024] Specifically, the attribute data of the client user is represented as follows: The attribute data (including all transaction attribute data, behavioral attribute data, and individual attribute data) are converted into vector representations using embedding. .in, Indicates the first One client user, Indicates the user's first Item attribute features, such as Indicates the user's age characteristics, Indicates the user's first User feature vector components corresponding to item attribute features.

[0025] In one embodiment, the user tag types include fraudulent user tags, trustworthy user tags, and unknown user tags; such as Figure 4 As shown, step S30, namely determining the fraud feature vector, integrity feature vector, and unknown feature vector based on the associated user feature vectors and user tag types of all the associated users, includes: S301. The associated users whose user tag type is fraudulent user tag are identified as associated fraudulent users, the associated users whose user tag type is honest user tag are identified as associated honest users, and the associated users whose user tag type is unknown user tag are identified as associated unknown users. S302. When all the associated users simultaneously include associated fraudulent users, associated honest users, and associated unknown users, the associated user feature vectors of a preset number of users selected for associated fraudulent users are converted into fraudulent feature vectors, the associated user feature vectors of a preset number of users selected for associated honest users are converted into honest feature vectors, and the associated user feature vectors of a preset number of users selected for associated unknown users are converted into unknown feature vectors.

[0026] Understandably, user tag types include fraudulent user tags, honest user tags, and unknown user tags. A fraudulent user tag indicates that the currently associated user has been identified as a fraudulent user in historical data; an honest user tag indicates that the currently associated user has been identified as not a fraudulent user in historical data; and an unknown user tag indicates that the currently associated user has not undergone fraud detection in historical data. The server identifies associated users with the fraudulent user tag type as associated fraudulent users, associated users with the honest user tag type as associated honest users, and associated users with the unknown user tag type as associated unknown users.

[0027] Among associated users, there may be one or more of the following: associated fraudulent users, associated honest users, and associated unknown users. When only one of these three types exists (e.g., only fraudulent feature vectors), the honest and unknown feature vectors are zero. When all three types exist simultaneously, the fraudulent, honest, and unknown feature vectors are determined based on the associated user feature vectors and user tag types of all associated users. In this case, because the number of associated fraudulent, honest, and unknown users may vary significantly, a preset number of users needs to be selected from each type to avoid eliminating specificity when averaging feature vectors due to an excessive number of users. The preset number of users is a pre-defined value used to select a specific number of users from the associated users corresponding to different user tag types. It can be set to a default value or adjusted as needed. Specifically, if the preset number of users is less than or equal to the minimum of the number of associated fraudulent, honest, and unknown users, the fraudulent, honest, and unknown feature vectors are determined based on the preset number of users. If the preset number of selected users is greater than the minimum of the number of associated fraudulent users, the number of associated trustworthy users, and the number of associated unknown users, then the minimum of these three numbers is determined as the updated preset number of selected users. Based on this updated preset number of selected users, fraud feature vectors, trustworthy feature vectors, and unknown feature vectors are determined. The fraud feature vector is a vector obtained by merging the associated user feature vectors of a specific number of associated users based on fraudulent user tags; that is, merging the associated user feature vectors of a specific number of associated fraudulent users. The trustworthy feature vector is a vector obtained by merging the associated user feature vectors of a specific number of associated users based on trustworthy user tags; that is, merging the associated user feature vectors of a specific number of associated trustworthy users. The unknown feature vector is a vector obtained by merging the associated user feature vectors of a specific number of associated users based on unknown user tags; that is, merging the associated user feature vectors of a specific number of associated unknown users. The merging method can be a weighted average of vector components corresponding to the same attribute among different vectors. Specifically, the fraud feature vector is represented as... The integrity feature vector is represented as The unknown feature vector is represented as .in, Represents the fraud feature vector. Represents the integrity feature vector. Represents an unknown feature vector. Indicates the user's first Item attribute features, Indicates the first Fraudulent feature vector components of item attribute features, Indicates the first The integrity feature vector components of the item attribute features, Indicates the first Unknown feature vector components of item attribute features.

[0028] In this embodiment, when there are simultaneously associated fraudulent users, associated honest users, and associated unknown users among all associated users, the associated user feature vectors of a preset number of users are converted into fraud feature vectors, honest feature vectors, and unknown feature vectors. This ensures the comparability of fraud feature vectors, honest feature vectors, and unknown feature vectors, and helps improve the accuracy of fraudulent user detection.

[0029] S40. Determine the target user feature vector of the target user based on the target attribute data, and perform group analysis on the target user feature vector, the fraud feature vector, the integrity feature vector and the unknown feature vector through a preset gating model to obtain the fraud gating vector, the integrity gating vector and the unknown gating vector.

[0030] In essence, a target user feature vector is the result of converting the target user's various target attribute data into a vector representation, which can be achieved using embedding. The target user feature vector is represented as follows: ,in, Represents the target user feature vector. Indicates the user's first Item attribute features, Indicates the first The target user feature vector components of the attribute features. The pre-set gating model is a pre-trained gated recurrent neural network (GRNN) used to analyze the feature vectors of target users and associated users. Gated recurrent neural networks are network structures modified from classic recurrent neural networks, incorporating gating mechanisms (non-linear activation functions, such as sigmoid) to control information transmission within the neural network. Gating mechanisms control which information is retained and which is discarded in memory units, acting as information filtering. The fraud gating vector is the vector filtered by the gating mechanism between the target user feature vector and the fraud feature vector. The integrity gating vector is the vector filtered by the gating mechanism between the target user feature vector and the integrity feature vector. The unknown gating vector is the vector filtered by the gating mechanism between the target user feature vector and the unknown feature vector.

[0031] In one embodiment, the preset gating model includes a preset fraud gating network, a preset integrity gating network, and a preset unknown gating network; such as Figure 5 As shown, in step S40, the grouping analysis of the target user feature vector, the fraud feature vector, the integrity feature vector, and the unknown feature vector using a preset gating model to obtain the fraud gating vector, the integrity gating vector, and the unknown gating vector includes: S401. Perform gate analysis processing on the target user feature vector and the fraud feature vector through a preset fraud gating network to obtain a fraud gating vector; S402. Perform gate analysis processing on the target user feature vector and the integrity feature vector through a preset integrity gate network to obtain an integrity gate vector; S403. Perform gate analysis processing on the target user feature vector and the unknown feature vector through a preset unknown gate network to obtain an unknown gate vector.

[0032] Understandably, the pre-gated gating model includes a pre-defined fraud gating network, a pre-defined integrity gating network, and a pre-defined unknown gating network, used to implement a group gating mechanism. The pre-defined fraud gating network, pre-defined integrity gating network, and pre-defined unknown gating network share the same gated recurrent neural network structure, all including an input layer, a first multilayer perceptron (MLP) layer, a rectified linear unit (ReLU) layer, a second multilayer perceptron layer, a gating mechanism activation (Sigmoid) layer, and an output layer. In the gating network, the sigmoid function is primarily used to control information flow, adjusting the transmission weights of different information through nonlinear transformations.

[0033] Specifically, a pre-set fraud gating network (such as...) Figure 2 The input to Gate2 is the target user feature vector (e.g., ... Figure 2 Feature vectors of client user u6 and fraud feature vectors (such as...) Figure 2 The feature vector of client user u7), the output is a fraud gating vector, represented as Pre-set a trust-based gating network (such as...) Figure 2 The input to Gate1 is the target user feature vector (e.g., ... Figure 2 The feature vector of client user u6) and the integrity feature vector (such as...) Figure 2 The output is a credit gating vector, represented as a random feature vector from client users u5, u8, and u9 (or a combined vector of the three). Preset unknown gating network (e.g.) Figure 2 The input to Gate3 is the target user feature vector (e.g., ... Figure 2 Feature vectors of client user u6 and unknown feature vectors (such as...) Figure 2 The feature vector of client user u4), the output is an unknown gated vector, represented as .in, Indicates the number processed by the gating mechanism Item attribute features, Indicates the first Fraud gating vector components of item attribute features, Indicates the first Integrity-gated vector components of item attribute features, Indicates the first Unknown gated vector components of item attribute features.

[0034] This embodiment utilizes a preset fraud gating network to perform gating analysis on fraud feature vectors, a preset integrity gating network to perform gating analysis on integrity feature vectors, and a preset unknown gating network to perform gating analysis on unknown feature vectors, thus realizing a group gating mechanism and ensuring the accuracy of fraud gating vectors, integrity gating vectors, and unknown gating vectors.

[0035] S50. Based on the target user feature vector, the fraud gating vector, the integrity gating vector, and the unknown gating vector, determine the feature conflict score of the target user, and determine the fraud detection result of the target user based on the feature conflict score.

[0036] Understandably, the server analyzes the target user's feature vector, fraud gating vector, integrity gating vector, and unknown gating vector to obtain the target user's feature conflict score. The feature conflict score is a quantifiable value representing the degree of conflict between the target user's features and their perceived fraud or integrity tendencies. The server analyzes the target user's attribute data based on the feature conflict score to determine the fraud detection result. The fraud detection result is used to determine whether the target user is a fraudulent user, specifically whether the target user is a fraudulent user or an honest user.

[0037] This embodiment identifies a target user and at least one candidate user from all credit users based on a fraud analysis request, and obtains the target user's target attribute data and the candidate attribute data of each candidate user. Based on the target attribute data and candidate attribute data, at least one associated user of the target user is identified from all candidate users. The associated user feature vector and user tag type of each associated user are determined based on the candidate attribute data, and fraud feature vector, integrity feature vector, and unknown feature vector are determined based on the associated user feature vector and user tag type of all associated users. The target user feature vector of the target user is determined based on the target attribute data, and the target user feature vector, fraud feature vector, integrity feature vector, and unknown feature vector are grouped and analyzed using a preset gating model to obtain fraud gating vector, integrity gating vector, and unknown gating vector. Based on the target user feature vector, fraud gating vector, integrity gating vector, and unknown gating vector, the feature conflict score of the target user is determined, and the fraud detection result of the target user is determined based on the feature conflict score. This embodiment performs group gating processing on the target user feature vector, fraud feature vector, integrity feature vector, and unknown feature vector. This can filter out feature information that is helpful for subsequent analysis. At the same time, based on the vectors after group gating processing, the feature conflict score of the target user is determined, which can effectively identify the degree of conflict between the user's fake features and other real features, thereby improving the accuracy of fraud user detection.

[0038] In one embodiment, such as Figure 6 As shown, step S50, namely determining the feature conflict score of the target user based on the target user feature vector, the fraud gating vector, the integrity gating vector, and the unknown gating vector, includes: S501. Determine a fraud propensity score based on the target user feature vector and the fraud gating vector; determine an integrity propensity score based on the target user feature vector and the integrity gating vector; determine an unknown propensity score based on the target user feature vector and the unknown gating vector. S502. Determine a fraud tendency vector based on the target user feature vector and the fraud tendency score, determine an integrity tendency vector based on the target user feature vector and the integrity tendency score, and determine an unknown tendency vector based on the target user feature vector and the unknown tendency score. S503. Perform cosine similarity analysis on the fraud tendency vector, the integrity tendency vector, and the unknown tendency vector to obtain the feature conflict score of the target user.

[0039] Understandably, firstly, the server determines the fraud propensity score, integrity propensity score, and unknown propensity score based on the target user feature vector, fraud gating vector, integrity gating vector, and unknown gating vector. The fraud propensity score is a vector representing the similarity between the components of the target user feature vector and the fraud gating vector. The integrity propensity score is a vector representing the similarity between the components of the target user feature vector and the integrity gating vector. The unknown propensity score is a vector representing the similarity between the components of the target user feature vector and the unknown gating vector. Multiplying one vector matrix by its transpose can be used to calculate the similarity between the two vectors, thus determining their correlation. For example, when two vectors are orthogonal, the projection is 0, and the inner product is 0, indicating that they are completely dissimilar. The larger the inner product of two vectors, the closer the values ​​at corresponding positions are, indicating that they are more similar. Specifically, the server calculates the similarity function between the fraud gating vector and the target user feature vector using the inner product to obtain the fraud propensity score, represented as... In other words, the vector components of the fraud propensity score are the result of an inner product operation between each vector component of the fraud gating vector and the transpose of the corresponding vector component of the target user feature vector. The server calculates the similarity between the integrity gating vector and the target user feature vector using the inner product to obtain the integrity propensity score, represented as... The server calculates the similarity between the fraud gating vector and the target user feature vector using the inner product, obtaining a fraud propensity score, denoted as... .in, This represents the transpose of the target user's feature vector. The vector representing the fraud propensity score. The vector representing the integrity tendency score. A vector representing the unknown tendency rating.

[0040] Next, the server converts the target user's feature vector into a fraud propensity vector based on the fraud propensity score. The fraud propensity vector is composed of a specific number of vector components from the target user's feature vector and is used to reflect fraud propensity characteristics. The server converts the target user's feature vector into a trustworthiness vector based on the trustworthiness propensity score. The trustworthiness propensity vector is composed of a specific number of vector components from the target user's feature vector and is used to reflect trustworthiness propensity characteristics. The server-side converts the target user's feature vector into an unknown tendency vector based on the unknown tendency score. The unknown tendency vector is composed of a specific number of vector components from the target user's feature vector and is used to reflect the unknown tendency characteristics. express.

[0041] Finally, the server performs cosine similarity analysis on the fraud propensity vector, integrity propensity vector, and unknown propensity vector to obtain the feature conflict score for the target user. The specific formula for the feature conflict score is as follows: ,in, This indicates a score reflecting conflicting characteristics.

[0042] Based on the determination of fraud propensity score, integrity propensity score, and unknown propensity score, this embodiment converts the target user feature vector into fraud propensity vector, integrity propensity vector, and unknown propensity vector, and comprehensively evaluates the feature conflict score of the target user from three aspects, ensuring the comprehensiveness of the feature conflict score.

[0043] In one embodiment, the fraud propensity score includes fraud propensity component scores corresponding to each feature vector component in the target user's feature vector; the integrity propensity score includes integrity component scores corresponding to each feature vector component in the target user's feature vector; and the unknown propensity score includes unknown propensity component scores corresponding to each feature vector component in the target user's feature vector. Figure 7 As shown, step S502, namely determining the fraud propensity vector based on the target user feature vector and the fraud propensity score, determining the integrity propensity vector based on the target user feature vector and the integrity propensity score, and determining the unknown propensity vector based on the target user feature vector and the unknown propensity score, includes: S5021. Sort all feature vector components in the target user feature vector according to the fraud tendency component score, and select a number of feature vector components according to the preset feature with the highest ranking to generate a fraud tendency vector. S5022. Sort all feature vector components in the target user feature vector according to the integrity tendency component score, and select a number of feature vector components according to the preset feature with the highest ranking to generate an integrity tendency vector. S5023. Sort all feature vector components in the target user feature vector according to the unknown tendency component score, and select a number of feature vector components according to the preset feature with the highest ranking to generate an unknown tendency vector.

[0044] In essence, a fraud propensity score is a vector component in the fraud propensity score vector that corresponds to a user-specific attribute. Each fraud propensity score corresponds to a feature vector component in the target user's feature vector. For example, the target user's age attribute corresponds to a feature vector component in the target user's feature vector, and also to a fraud propensity score. Similarly, an integrity propensity score is a vector component in the integrity propensity score vector that corresponds to a user-specific attribute. Each integrity propensity score corresponds to a feature vector component in the target user's feature vector. Finally, an unknown propensity score is a vector component in the unknown propensity score vector that corresponds to a user-specific attribute. Each unknown propensity score corresponds to a feature vector component in the target user's feature vector.

[0045] The preset feature selection quantity is a pre-defined value used to select a specific number of features from all feature vector components of the target user's feature vector. It can be set to a default value or adjusted as needed, and is denoted by K. The server sorts all feature vector components in the target user's feature vector according to the fraud propensity component score, and selects a number of feature vector components based on the highest-ranked preset feature to generate a fraud propensity vector. That is, the top K feature vector components are selected from all feature vector components of the target user's feature vector, and the fraud propensity vector is represented as... , This represents the attribute data corresponding to the feature vector components selected from the target user's feature vector based on the fraud propensity component score. This indicates that the selected attribute data will be converted into a vector. The server uses the same method to generate a trustworthiness vector, represented as... ; and generate unknown tendency vectors in the same way, denoted as .in, This represents the attribute data corresponding to the feature vector components selected from the target user's feature vector based on the integrity tendency component score. This represents the attribute data corresponding to the feature vector components selected from the target user's feature vector based on the unknown tendency component score.

[0046] This embodiment sorts all feature vector components in the target user feature vector and selects a specific number of top-ranked components to generate fraud propensity vectors, integrity propensity vectors, and unknown propensity vectors. This can eliminate a large number of irrelevant or less disruptive features, reduce the complexity of subsequent data analysis, and improve the efficiency of fraud detection.

[0047] In one embodiment, such as Figure 8 As shown, step S50, namely determining the fraud detection result of the target user based on the feature conflict score, includes: S504. Determine the attention weight parameters based on the feature conflict score; S505. Perform attention analysis processing on the target user attribute data according to the preset fraud detection model and the attention weight parameters to obtain the fraud detection result of the target user.

[0048] Understandably, the server determines the attention weight parameters of the self-attention mechanism based on the feature conflict score. These attention weight parameters characterize the contribution of various user attributes to the final decision. The pre-trained fraud detection model is a neural network model that uses a self-attention mechanism to determine whether a target user is fraudulent. In practical applications, different feature conflict scores correspond to different attention weight parameters. For example, the server pre-sets a mapping relationship between different intervals of feature conflict scores and different attention weight parameters. When the actual feature conflict score falls within a specific interval, the actual attention weight parameters can be determined based on this mapping relationship. The server then performs attention analysis on the target user's attribute data based on the pre-trained fraud detection model and the actual attention weight parameters to obtain the fraud detection result for the target user. In transaction attribute data, high attention weight parameters may indicate forged transaction time, amount, or location, in which case the target user is a fraudulent user.

[0049] This embodiment determines the attention weight parameters of the self-attention mechanism based on feature conflict scores, and determines the fraud detection results of the target user through model analysis. It can effectively identify the degree of conflict between user forged features and other real features, thereby improving the accuracy of fraud user detection.

[0050] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0051] In one embodiment, a fraudulent user detection device is provided, which corresponds one-to-one with the fraudulent user detection methods described in the above embodiments. For example... Figure 9 As shown, the fraudulent user detection device includes an attribute data acquisition module 10, an associated user determination module 20, a feature vector determination module 30, a gating vector determination module 40, and a detection result determination module 50. Detailed descriptions of each functional module are as follows: The attribute data acquisition module 10 is used to determine the target user and at least one candidate user from all credit users according to the fraud analysis request, and to acquire the target attribute data of the target user and the candidate attribute data of each candidate user. The associated user determination module 20 is used to perform graph network analysis processing based on the target attribute data and candidate attribute data, and determine at least one associated user of the target user from all the candidate users based on the results of the graph network analysis processing. The feature vector determination module 30 is used to determine the associated user feature vector and user tag type of each of the associated users based on the candidate attribute data, and to determine the fraud feature vector, integrity feature vector and unknown feature vector based on the associated user feature vector and user tag type of all the associated users. The gate vector determination module 40 is used to determine the target user feature vector of the target user based on the target attribute data, and to perform group analysis processing on the target user feature vector, the fraud feature vector, the integrity feature vector and the unknown feature vector through a preset gate model to obtain the fraud gate vector, the integrity gate vector and the unknown gate vector; The detection result determination module 50 is used to determine the feature conflict score of the target user based on the target user feature vector, the fraud gating vector, the integrity gating vector and the unknown gating vector, and to determine the fraud detection result of the target user based on the feature conflict score.

[0052] In one embodiment, the associated user determination module 20 includes: An individual attribute data acquisition unit is used to acquire target individual attribute data from the target attribute data and candidate individual attribute data from the candidate attribute data; The graph network analysis unit is used to perform graph network analysis on the target individual attribute data of the target user and the candidate individual attribute data of all the candidate users to obtain a target user subgraph; the node users of the target user subgraph include the target user and the candidate users among all the candidate users who have an adjacent edge relationship with the target user; The associated user determination unit is used to determine all the candidate users in the target user subgraph as associated users of the target user.

[0053] In one embodiment, the feature vector determination module 30 includes: The associated user classification unit is used to identify associated users whose user tag type is fraudulent user tag as associated fraudulent users, to identify associated users whose user tag type is honest user tag as associated honest users, and to identify associated users whose user tag type is unknown user tag as associated unknown users. The feature vector conversion unit is used to convert the feature vectors of a preset number of users associated with fraudulent users into fraudulent feature vectors, the feature vectors of a preset number of users associated with honest users into honest feature vectors, and the feature vectors of a preset number of users associated with unknown users into unknown feature vectors when all the associated users simultaneously contain associated fraudulent users, associated honest users, and associated unknown users.

[0054] In one embodiment, the gating vector determination module 40 includes: The fraud gating network analysis unit is used to perform gating analysis processing on the target user feature vector and the fraud feature vector through a preset fraud gating network to obtain a fraud gating vector. The integrity gating network analysis unit is used to perform gating analysis processing on the target user feature vector and the integrity feature vector through a preset integrity gating network to obtain the integrity gating vector. The unknown gating network analysis unit is used to perform gating analysis processing on the target user feature vector and the unknown feature vector through a preset unknown gating network to obtain an unknown gating vector.

[0055] In one embodiment, the detection result determination module 50 includes: The tendency scoring determination unit is used to determine a fraud tendency score based on the target user feature vector and the fraud gating vector, to determine an integrity tendency score based on the target user feature vector and the integrity gating vector, and to determine an unknown tendency score based on the target user feature vector and the unknown gating vector. A tendency vector determination unit is used to determine a fraud tendency vector based on the target user feature vector and the fraud tendency score, to determine an integrity tendency vector based on the target user feature vector and the integrity tendency score, and to determine an unknown tendency vector based on the target user feature vector and the unknown tendency score. The similarity analysis unit is used to perform cosine similarity analysis on the fraud tendency vector, the integrity tendency vector, and the unknown tendency vector to obtain the feature conflict score of the target user.

[0056] In one embodiment, the detection result determination module 50 further includes: The fraud propensity vector determination unit is used to sort all feature vector components in the target user feature vector according to the fraud propensity component score, and select a number of feature vector components according to the preset feature with the highest ranking to generate a fraud propensity vector. The integrity tendency vector determination unit is used to sort all feature vector components in the target user feature vector according to the integrity tendency component score, and select a number of feature vector components according to the preset feature with the highest ranking to generate an integrity tendency vector. The unknown tendency vector determination unit is used to sort all feature vector components in the target user feature vector according to the unknown tendency component score, and select a number of feature vector components according to the preset feature with the highest ranking to generate an unknown tendency vector.

[0057] In one embodiment, the detection result determination module 50 further includes: The weight parameter determination unit is used to determine attention weight parameters based on the feature conflict score. The attention analysis unit is used to perform attention analysis processing on the target user attribute data according to the preset fraud detection model and the attention weight parameters to obtain the fraud detection result of the target user.

[0058] Specific limitations regarding the fraudulent user detection device can be found in the limitations of the fraudulent user detection method described above, and will not be repeated here. Each module in the aforementioned fraudulent user detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0059] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a readable storage medium and internal memory. The readable storage medium stores an operating system, computer-readable instructions, and a database. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the readable storage medium. The database stores data related to fraudulent user detection methods. The network interface communicates with external terminals via a network connection. When the computer-readable instructions are executed by the processor, a fraudulent user detection method is implemented. The readable storage medium provided in this embodiment includes both non-volatile and volatile readable storage media.

[0060] In one embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein the processor performs the following steps when executing the computer-readable instructions: Based on the fraud analysis request, target users and at least one candidate user are identified from all credit users, and target attribute data of the target user and candidate attribute data of each candidate user are obtained. Graph network analysis is performed on the target attribute data and candidate attribute data, and based on the results of the graph network analysis, at least one associated user of the target user is determined from all the candidate users. Based on the candidate attribute data, determine the associated user feature vector and user tag type for each associated user, and based on the associated user feature vector and user tag type for all associated users, determine the fraud feature vector, integrity feature vector, and unknown feature vector; Based on the target attribute data, the target user feature vector of the target user is determined. The target user feature vector, the fraud feature vector, the integrity feature vector, and the unknown feature vector are grouped and analyzed using a preset gating model to obtain the fraud gating vector, the integrity gating vector, and the unknown gating vector. Based on the target user feature vector, the fraud gating vector, the integrity gating vector, and the unknown gating vector, the feature conflict score of the target user is determined, and the fraud detection result of the target user is determined based on the feature conflict score.

[0061] In one embodiment, one or more computer-readable storage media storing computer-readable instructions are provided. The readable storage media provided in this embodiment include non-volatile readable storage media and volatile readable storage media. The readable storage media stores computer-readable instructions, which, when executed by one or more processors, perform the following steps: Based on the fraud analysis request, target users and at least one candidate user are identified from all credit users, and target attribute data of the target user and candidate attribute data of each candidate user are obtained. Graph network analysis is performed on the target attribute data and candidate attribute data, and based on the results of the graph network analysis, at least one associated user of the target user is determined from all the candidate users. Based on the candidate attribute data, determine the associated user feature vector and user tag type for each associated user, and based on the associated user feature vector and user tag type for all associated users, determine the fraud feature vector, integrity feature vector, and unknown feature vector; Based on the target attribute data, the target user feature vector of the target user is determined. The target user feature vector, the fraud feature vector, the integrity feature vector, and the unknown feature vector are grouped and analyzed using a preset gating model to obtain the fraud gating vector, the integrity gating vector, and the unknown gating vector. Based on the target user feature vector, the fraud gating vector, the integrity gating vector, and the unknown gating vector, the feature conflict score of the target user is determined, and the fraud detection result of the target user is determined based on the feature conflict score.

[0062] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0063] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0064] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for detecting fraudulent users, characterized in that, include: Based on the fraud analysis request, target users and at least one candidate user are identified from all credit users, and target attribute data of the target user and candidate attribute data of each candidate user are obtained. Graph network analysis is performed on the target attribute data and candidate attribute data, and based on the results of the graph network analysis, at least one associated user of the target user is determined from all the candidate users. Based on the candidate attribute data, the associated user feature vector and user tag type of each associated user are determined. Then, based on the associated user feature vectors and user tag types of all associated users, fraud feature vectors, integrity feature vectors, and unknown feature vectors are determined. The fraud feature vector is a feature integration vector of users among the associated users who have been identified as fraudulent. The integrity feature vector is a feature integration vector of users among the associated users who have been identified as honest. The unknown feature vector is a feature integration vector of users among the associated users who have not yet undergone fraud detection. Based on the target attribute data, the target user feature vector of the target user is determined. The target user feature vector, the fraud feature vector, the integrity feature vector, and the unknown feature vector are grouped and analyzed using a preset gating model to obtain the fraud gating vector, the integrity gating vector, and the unknown gating vector. Based on the target user feature vector, the fraud gating vector, the integrity gating vector, and the unknown gating vector, the feature conflict score of the target user is determined, and the fraud detection result of the target user is determined based on the feature conflict score.

2. The fraudulent user detection method as described in claim 1, characterized in that, The step of performing graph network analysis based on the target attribute data and candidate attribute data, and determining at least one associated user of the target user from all candidate users based on the results of the graph network analysis, includes: Obtain the target individual attribute data from the target attribute data, and the candidate individual attribute data from the candidate attribute data; Graph network analysis is performed on the target individual attribute data of the target user and the candidate individual attribute data of all the candidate users to obtain a target user subgraph; the node users of the target user subgraph include the target user and all the candidate users who have an adjacent relationship with the target user. All candidate users in the target user subgraph are identified as associated users of the target user.

3. The fraudulent user detection method as described in claim 1, characterized in that, The user tag types include fraudulent user tags, honest user tags, and unknown user tags; The step of determining fraud feature vectors, integrity feature vectors, and unknown feature vectors based on the associated user feature vectors and user tag types of all the associated users includes: Users associated with the user tag type "fraudulent user" are identified as associated fraudulent users; users associated with the user tag type "honest user" are identified as associated honest users; and users associated with the user tag type "unknown user" are identified as associated unknown users. When all the associated users simultaneously include associated fraudulent users, associated honest users, and associated unknown users, the associated user feature vectors of a preset number of users selected for associated fraudulent users are converted into fraudulent feature vectors, the associated user feature vectors of a preset number of users selected for associated honest users are converted into honest feature vectors, and the associated user feature vectors of a preset number of users selected for associated unknown users are converted into unknown feature vectors.

4. The fraudulent user detection method as described in claim 1, characterized in that, The preset gating model includes a preset fraud gating network, a preset integrity gating network, and a preset unknown gating network; The step involves grouping and analyzing the target user feature vector, the fraud feature vector, the integrity feature vector, and the unknown feature vector using a preset gating model to obtain fraud gating vectors, integrity gating vectors, and unknown gating vectors, including: By performing gate analysis on the target user feature vector and the fraud feature vector through a preset fraud gating network, a fraud gating vector is obtained; The target user feature vector and the integrity feature vector are subjected to gate control analysis processing by a preset integrity gate control network to obtain the integrity gate control vector. By performing gating analysis on the target user feature vector and the unknown feature vector through a preset unknown gating network, an unknown gating vector is obtained.

5. The fraudulent user detection method as described in claim 1, characterized in that, The step of determining the feature conflict score of the target user based on the target user feature vector, the fraud gating vector, the integrity gating vector, and the unknown gating vector includes: A fraud propensity score is determined based on the target user feature vector and the fraud gating vector; an integrity propensity score is determined based on the target user feature vector and the integrity gating vector; and an unknown propensity score is determined based on the target user feature vector and the unknown gating vector. A fraud tendency vector is determined based on the target user feature vector and the fraud tendency score; an integrity tendency vector is determined based on the target user feature vector and the integrity tendency score; and an unknown tendency vector is determined based on the target user feature vector and the unknown tendency score. Cosine similarity analysis is performed on the fraud propensity vector, the integrity propensity vector, and the unknown propensity vector to obtain the feature conflict score of the target user.

6. The fraudulent user detection method as described in claim 5, characterized in that, The fraud propensity score includes fraud propensity component scores corresponding to each feature vector component in the target user's feature vector; the integrity propensity score includes integrity component scores corresponding to each feature vector component in the target user's feature vector; the unknown propensity score includes unknown propensity component scores corresponding to each feature vector component in the target user's feature vector. The step of determining a fraud propensity vector based on the target user feature vector and the fraud propensity score, determining an integrity propensity vector based on the target user feature vector and the integrity propensity score, and determining an unknown propensity vector based on the target user feature vector and the unknown propensity score includes: Based on the fraud propensity component score, all feature vector components in the target user feature vector are sorted, and a number of feature vector components are selected based on the preset feature with the highest ranking to generate a fraud propensity vector. Based on the integrity tendency component score, all feature vector components in the target user feature vector are sorted, and a number of feature vector components are selected based on the preset feature with the highest ranking to generate an integrity tendency vector. Based on the unknown tendency component score, all feature vector components in the target user feature vector are sorted, and a number of feature vector components are selected based on the preset feature with the highest ranking to generate an unknown tendency vector.

7. The fraudulent user detection method as described in claim 1, characterized in that, Determining the fraud detection result of the target user based on the feature conflict score includes: The attention weight parameters are determined based on the feature conflict score; Based on the preset fraud detection model and the attention weight parameters, attention analysis processing is performed on the target user attribute data to obtain the fraud detection result of the target user.

8. A fraudulent user detection device, characterized in that, include: The attribute data acquisition module is used to identify target users and at least one candidate user from all credit users according to the fraud analysis request, and to acquire target attribute data of the target user and candidate attribute data of each candidate user. The associated user determination module is used to perform graph network analysis processing based on the target attribute data and candidate attribute data, and determine at least one associated user of the target user from all the candidate users based on the results of the graph network analysis processing. The feature vector determination module is used to determine the associated user feature vector and user tag type of each of the associated users based on the candidate attribute data, and to determine the fraud feature vector, integrity feature vector and unknown feature vector based on the associated user feature vector and user tag type of all the associated users; The gate vector determination module is used to determine the target user feature vector of the target user based on the target attribute data, and to perform group analysis processing on the target user feature vector, the fraud feature vector, the integrity feature vector and the unknown feature vector through a preset gate model to obtain the fraud gate vector, the integrity gate vector and the unknown gate vector; The detection result determination module is used to determine the feature conflict score of the target user based on the target user feature vector, the fraud gating vector, the integrity gating vector and the unknown gating vector, and to determine the fraud detection result of the target user based on the feature conflict score.

9. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, characterized in that, When the processor executes the computer-readable instructions, it implements the fraudulent user detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing computer-readable instructions, characterized in that, When the computer-readable instructions are executed by one or more processors, the one or more processors cause the fraudulent user detection method as described in any one of claims 1 to 7.

Images