A graph fraud detection method based on structural risk coding and collaborative pattern generation

Abstract

This invention relates to the field of security technology for graph neural network applications, specifically providing a graph fraud detection method based on structural risk encoding and cooperative pattern generation. The method employs software installed on a PC, including a structural risk construction unit, a structural dominant encoding establishment unit, a structural awareness generation establishment unit, and an optimization and generation representation unit, as tools for graph fraud detection. The detection method includes four steps: constructing a structural risk feature model, establishing a structural dominant encoding model, establishing a structural awareness generation model, and jointly optimizing the original and generated representation models. Through the combined action of related software units and processes, this invention explicitly utilizes more stable structural risk signals to mitigate interference from fraud masquerading, and enhances the model's learning ability for diverse fraud patterns through structural awareness cooperative pattern extension, thereby improving the graph fraud detection performance under limited supervision. In summary, this invention has promising application prospects.

Description

Technical Field

[0001] This invention relates to the field of security technology for graph neural network applications, and in particular to a graph fraud detection method based on structural risk coding and collaborative pattern generation. Background Technology

[0002] Graph Neural Networks (GNNs) can leverage both node attribute information and graph structure information through neighborhood aggregation, demonstrating strong capabilities in graph structure data modeling. Therefore, they have become a crucial technical approach for graph fraud detection applications in financial risk control scenarios. Existing GNN-based applications typically represent entities such as accounts, users, and merchants as nodes, and transaction relationships or other business connections as edges, identifying suspicious nodes through graph propagation mechanisms. However, graph fraud detection still faces significant challenges in real-world financial scenarios. Specifically, fraudsters often strategically adjust individual behavioral statistics such as transaction frequency and amount distribution to make their behavior more similar to that of legitimate users. Furthermore, due to the high coupling between feature information and structural information during propagation, the disguised attributes further contaminate the neighborhood aggregation results, thereby weakening the ability of the model-based applications to identify fraudulent nodes. Furthermore, as fraudulent activities have evolved, fraudsters are no longer limited to the abnormal behavior of isolated accounts, but have gradually evolved into an organized model based on the collaboration of multiple accounts, forming a relatively stable collaborative structure. Compared to individual account transactions, which are easier to disguise, the interaction relationships and collaborative patterns formed by multiple accounts during transactions are more difficult to deliberately conceal. Therefore, the structural patterns in the graph can provide more stable and reliable risk signals. However, due to the extreme scarcity of known fraud labels in real business scenarios, a large number of potential suspicious collaborative patterns are difficult to fully observe during the training of graph neural network application software, thus limiting the learning and generalization capabilities of the model application software for complex fraud patterns.

[0003] Existing technologies and related application software for fraud spoofing mainly improve the problem from two directions: feature enhancement and relation aggregation. For example, DiG-In-GNN (a graph neural network fraud detection model for inconsistencies in multi-relation fraud graphs), CACO-GNN (a spoofing fraud detection model based on contrastive graph neural networks), SemiGraL (a general semi-supervised learning framework for graph data), and RHO (semi-supervised graph anomaly detection) improve node representation capabilities through multi-scale contrastive learning, supervised contrastive learning, semi-supervised enhancement, and frequency domain alignment. CARE-GNN (a graph neural network model designed to combat spoofing fraudsters), PC-GNN (a graph neural network model designed to solve the problem of extreme class imbalance in graph data), AO-GNN (a graph neural network model designed to solve the problem of class imbalance in graph data), GoSage (an inductive graph neural network), and SemiGNN (a general semi-supervised graph learning framework) optimize the relation aggregation process through neighbor selection, edge pruning, relation weighting, or hierarchical attention. For problems with limited supervision, generative learning mechanisms are mainly introduced. For example, GGA (Generating Adversarial Network-based Graph Generation Node Enhancement), GAAN (Gated Attention Mechanism in Graph Neural Networks), and AEGIS (Adversarial Graph Splitting Network) use generative adversarial learning to generate suspicious or abnormal nodes. DiGress (Graph Generation Method Based on Discrete Denoising Diffusion Model) and Grad (Graph Enhancement Model Based on Relation Diffusion) use diffusion generation mechanisms to enhance graph structure or auxiliary relations. GGAD (Generative Semi-Supervised Graph Anomaly Detection) generates abnormal samples by perturbing normal nodes. HAGAN (Homogeneous Perception Graph Anomaly Detection Model) generates high-quality abnormal nodes and injects them into the original graph through graph autoencoding.

[0004] While the aforementioned methods have improved the graph fraud detection capabilities of relevant application software from different perspectives, they still have the following significant shortcomings: Most existing technologies still alleviate the spoofing problem within the existing behavioral features and propagation framework, directly coupling behavioral and structural information during propagation. This causes spoofing behavior to not only reduce the class separability in the behavioral space but also contaminate the structural aggregation results. Furthermore, the lack of explicit modeling of the organizational forms of collaborative fraud structures makes it difficult to fully utilize structural risk signals that are more robust to spoofing. Secondly, most existing generative methods primarily fit existing observational data distributions or perturb local decision boundaries, making it difficult to proactively expand the diverse collaborative fraud patterns not fully covered during training. Therefore, existing technologies still lack a method that can explicitly model structural risk signals under the dual constraints of fraud spoofing and label scarcity, further discover suspicious groups, expand observable collaborative patterns, and jointly improve graph fraud detection performance. Summary of the Invention

[0005] To overcome the shortcomings of existing graph fraud detection applications, as described in the background section, due to technological limitations, this invention provides a graph fraud detection method based on structural risk encoding and collaborative pattern generation. This method explicitly utilizes more stable structural risk signals to mitigate interference from fraud spoofing under the combined action of relevant software units and processes, and enhances the model's learning ability for diverse fraud patterns through structure-aware collaborative pattern extension, thereby improving the graph fraud detection effect under limited supervision.

[0006] The technical solution adopted by this invention to solve its technical problem is: A graph fraud detection method based on structural risk coding and collaborative pattern generation employs software installed on a PC, including a structural risk construction unit, a structure-dominant coding unit, a structure-aware generation unit, and an optimization and generation representation unit, as the tools for graph fraud detection. The detection method includes the following steps: S1: Constructing a structural risk feature model. The structural risk construction unit constructs node structural features on multi-relationship financial transaction graph data from multiple perspectives, including relation-specific connectivity, cross-relationship consistency, and local structural tightness, to explicitly characterize structural risk signals in multi-entity collaborative associations; S2: Establishing a structure-dominant coding model. The structure-dominant coding unit inputs the original behavioral and structural features of the graph data into a decoupled behavior encoder and structure encoder, respectively, to obtain behavioral and structural representations. Based on this, a controlled fusion gating and structural risk estimation mechanism adaptively adjusts the behavioral signals. S3: Establish a structure-aware generative model. Based on the node structure representation, the structure-aware generative model unit identifies candidate suspicious groups by combining static subgraph partitioning and dynamic clustering of graph data in a hierarchical group discovery method. Based on fraud evidence, risk concentration, and predictive statistics in the groups, the groups are divided into different risk roles. Then, different expansion strategies are selected according to different group roles to actively generate diverse suspicious collaborative patterns in the representation space. S4: Jointly optimize the original representation and generative representation models. The optimization and generative representation units use a shared classifier to jointly train the original node representation and generative representation of the graph data for fraud classification. Supervised contrastive learning objectives are introduced into the behavioral representation space and the structural representation space respectively to improve intra-class compactness and inter-class separability, thereby improving the final graph fraud detection performance.

[0007] Further, the graph data in steps S1 to S4 is denoted as... ,in, For a set of nodes, For the first The set of edges corresponding to class relationships. This is the original behavioral feature matrix of the nodes. This is the node label vector.

[0008] Furthermore, in step S1, node structural features are constructed on the multi-relation graph of the graph data from three aspects: relation-specific connectivity, cross-relation consistency, and local structural tightness. Wherein, if Represents a node In relationship The following is a collection of neighbors (a total of) Class relationship, If it is a very small constant, then the relation-specific connectivity is expressed as: The formula for cross-relation consistency is: Local structural compactness is obtained by statistically merging the number of triangular closures in the graph. After aggregating the statistics of relation-specific connectivity, cross-relation consistency, and local structural compactness, a node structure feature vector is formed. The structural features of all nodes together constitute the structural feature matrix. This serves as the common foundation for subsequent steps of encoding and generation.

[0009] Furthermore, in step S2, the specific establishment of the structure-dominated coding model includes three processes: behavior coding, structure coding, and controlled fusion. (1) The original behavior feature matrix is ​​converted into a single matrix. Input behavior encoder The behavior representation matrix is ​​obtained. (2) The structural feature matrix Input structure encoder The structure representation matrix is ​​obtained. (3) Based on the above, a controlled fusion mechanism is introduced to generate gating vectors according to the structural representation, behavioral representation and their interaction relationship. And obtain the node structure risk score based on the structural representation. and inhibition coefficient This forms a comprehensive node representation. The structural representation in this step serves as the primary criterion, while the behavioral representation is adaptively introduced based on its reliability.

[0010] Furthermore, in step S3, the specific establishment of the structure-aware generation model includes two processes: hierarchical group discovery and group pattern expansion. (1) First, static partitioning is performed on the original graph to obtain several static subgraphs. (2) Dynamic clustering is performed on each static subgraph based on the node structure representation to obtain candidate groups. For each group, it is divided into fraud groups, risk groups and normal groups according to the fraud evidence, average prediction score and high-risk node concentration within the group.

[0011] Furthermore, in step S3, a basic sample pool is determined using a strategy selection function for different role groups. Target sample pool random disturbance and extended strength control parameters And a new representation is generated by interpolation in the prototype direction and random perturbation: This step actively expands the representation space with diverse collaborative fraud patterns developed during training.

[0012] Furthermore, in step S4, the specific process of joint optimization is as follows: establishing a shared classifier and optimizing the original representation matrix. and generating representation matrix For fraud classification, we define the classification loss for real samples and the classification loss for generated samples for generated representations and their assigned labels. And using weight parameters Controlling sample generation loss The contribution to the overall classification objective is used to construct the overall classification loss. .

[0013] Furthermore, in step S4, to further enhance the discriminative capability of the decoupled representation space, two enhanced views are constructed in the behavior representation space and the structure representation space respectively. Similar samples are brought closer together, while dissimilar samples are moved further away, thereby obtaining the behavior space supervised contrastive loss. Comparison of loss with structural space supervision and its weight parameters and The ultimate overall training objective is It consists of classification loss and two supervised comparison losses, and improves graph fraud detection capability through joint optimization.

[0014] Compared with the prior art, the beneficial effects of this invention are: (1) Explicitly modeling structural risk signals improves robustness against fraud spoofing. Structural features are explicitly constructed from the perspectives of relation-specific connectivity, cross-relation consistency, and local structural tightness. A more stable risk representation is established through a structure-dominated encoding mechanism, thereby effectively reducing the interference of fraud spoofing on the detection results. (2) Decoupling modeling and controlled fusion of behavioral and structural information are achieved. Behavioral and structural features are independently encoded, and the intensity of behavioral information introduction is adaptively controlled according to the structural risk level, thereby establishing a more reliable node comprehensive representation. (3) It can actively expand collaborative fraud patterns and improve the generalization ability under limited supervision. It identifies groups with different risk roles through hierarchical group discovery and selects different expansion strategies according to the group roles. It actively expands diverse collaborative fraud patterns in the representation space, thereby enhancing the model's learning ability for complex fraud evolution patterns. (4) Joint training of original and generated representations improves the overall decision boundary. The original and generated samples are jointly included in the training through a shared classifier, and supervised contrastive learning constraints are applied in the behavior space and structure space respectively, so that the generated suspicious patterns can directly participate in optimizing the classification boundary, while enhancing the discriminativeness of the decoupled representation space. (5) After being applied to real financial graph data scenarios, it has strong application value. It is designed to address the problems of fraud disguise and label scarcity in financial transaction graphs, taking into account individual behavior, structural risk and collaborative pattern evolution. It can be used for practical risk control tasks such as user risk identification, gang fraud detection and potential victim protection. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the process of this invention.

[0016] Figure 2 This is a schematic diagram of the architecture of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Figure 1 , Figure 2As shown, a graph fraud detection method based on structural risk coding and collaborative pattern generation is presented, primarily addressing the problems of fraud spoofing and label scarcity in financial graph data. It achieves effective identification of fraudulent nodes by constructing structural risk features, establishing a structure-dominant coding model, executing structure-aware generation, and jointly optimizing a classification model. This embodiment is implemented on a server (configured with an NVIDIA Tesla V100 GPU) using the PyTorch 2.4.0 and DGL 2.4.0 frameworks. Specifically, it employs application software installed on a PC, including structural risk construction units, structure-dominant coding establishment units, structure-aware generation establishment units, and optimization and generation representation units, as tools for graph fraud detection. The method specifically includes the following steps.

[0019] Figure 1 , Figure 2 As shown, step one involves constructing a structural risk feature model using structural risk construction units, which includes the following sub-steps: (1) For any node in the multi-relationship graph constructed from financial transaction data... Statistics on its role in various relationships Neighbor set ,in, This represents a set of multiple relations, where different relations are used to describe different types of interaction patterns between entities, such as transactional connections, co-occurrence connections, behavioral similarity connections, and goal-sharing connections, and are categorized by the number of neighbors. The relation-specific connectivity of nodes under corresponding relationships is used to characterize the participation intensity and local activity of nodes in different transaction relationships, thereby providing basic features for identifying structural risks such as abnormally high-frequency connections and concentrated collaborative behaviors. (2) For any two different types of relationships and The intersection-union ratio of neighbor sets measures the cross-relational consistency of nodes under different relations. This is used to determine whether different relational perspectives provide similar structural evidence for the same node, thereby enhancing the characterization of stable collaborative risk patterns and reducing the impact of single-relational noise or masquerading behavior on structural judgment. The formula is as follows: (3) Merge the edges of multiple types of relationships into a unified graph structure, and denote its edge set as . and count the nodes The number of triangular closures in the neighborhood is used to characterize the tightness of the local structure and to describe the degree of interconnection between the neighbors around a node, thereby identifying cooperative structures with local clustering, such as fraud gangs and collusive groups. The formula is as follows: (4) Aggregate the statistics of specific connectivity, cross-relation consistency and local structural tightness of the above steps to form nodes. Structural feature vectors And further constitute the structural feature matrix. This step serves as a common foundation for subsequent structural encoding and structure-aware generation, enabling the model to simultaneously utilize node relational participation strength, cross-relational consistency, and local organizational tightness during the representation learning and sample generation stages. This enhances the model's ability to identify collaborative structural patterns in financial fraud. The overall goal of this step is to extract stable structural risk features from the original financial multi-relationship graph, reducing the vulnerability to fraud camouflage when relying solely on behavioral attributes. This provides a reliable structural basis for subsequent software structure-driven encoding and structure-aware generation.

[0020] Figure 1 , Figure 2 As shown, step two involves establishing and executing the structure-dominated coding model through the structure-dominated coding establishment unit. This includes the following sub-steps: (1) converting the original behavioral feature matrix into a structure-dominated coding model. Input the behavior encoder (where the original behavior features include account transaction frequency, transaction amount statistics, transaction time distribution, merchant interaction feature data, and other attribute information related to node behavior) to obtain the behavior representation matrix. ,in, Used to characterize the individual behavior patterns of nodes, reflecting individual differences in transaction frequency, transaction amount, transaction object and behavioral attributes, providing behavioral-level discrimination information for fraud detection. (2) The structural feature matrix obtained in step one is used to characterize the individual behavior patterns of nodes, reflecting individual differences in transaction frequency, transaction amount, transaction object and behavioral attributes, providing behavioral-level discrimination information for fraud detection. The input structure encoder, after two stages of structure propagation and nonlinear transformation, yields the structure representation matrix. ,in, Used to characterize the structural risk pattern of nodes in multi-entity collaborative relationships, the purpose is to reflect the connection strength, collaborative relationship, consistency structure and local clustering characteristics of nodes in multi-relationship graphs, and to provide structural-level discrimination criteria for identifying gang fraud, collaborative anomalies and disguised behavior. (3) For each node Each obtains a representation of behavior. With structural representation The structural representation, behavioral representation, their difference terms, and multiplicative interaction terms are concatenated and then input into the gating function. The gating vector formula is obtained as follows: Among them, the gate vector Based on the node's structural representation, behavioral representation, and the consistency and differences between the two, the proportion of behavioral information introduced into the final node representation is adaptively determined; when the node's behavioral features are inconsistent with the structural risk evidence, the gating vector can reduce the interference of suspicious behavior camouflage on representation learning; when the two are consistent, more behavioral discrimination information is retained. (4) Based on the node structural representation, a structural risk estimator is constructed to obtain the node structural risk score. and corresponding inhibition coefficient as follows ,in, To suppress transition parameters, For the suppression strength parameter. (5) Adaptively adjust the contribution of the gating vector and suppression coefficient to the behavior representation, and obtain the following formula for the node synthesis representation: When the node structure risk is high, the inhibition coefficient decreases, thus reducing the degree of behavioral representation introduction; when the node structure risk is low, more behavioral information is retained. The comprehensive representation of all nodes together forms the representation matrix. This matrix simultaneously contains structural risk information and gated behavioral information, which is used in subsequent structure-aware generation, classification prediction, and joint optimization processes. The overall goal of this step is to establish a structure-driven node representation learning mechanism that retains effective behavioral information while suppressing noise interference from fraud spoofing, thereby enabling the relevant software to obtain a more suitable comprehensive node representation for financial fraud detection.

[0021] Figure 1 , Figure 2 As shown, in step three, the ventilation structure perception generation unit establishes and executes the structure perception generation model, including the following sub-steps. (1) Perform hierarchical group discovery based on structural representation (i.e., first perform coarse-grained static division on the original financial multi-relationship graph, and then perform fine-grained dynamic clustering within each static subgraph based on the node structure representation to discover local groups with similar structural risk patterns); First, perform static division on the original financial multi-relationship graph constructed from financial transaction data to obtain several static subgraphs, the formulas are as follows: The static partitioning method adopts Louvain, which aims to divide the overall financial multi-relationship graph into several relatively stable subgraph regions based on the topological connection relationship of the graph, thereby preserving the global structural organization information and reducing the computational complexity of subsequent dynamic clustering. (2) Within each static subgraph, the structural representation of the corresponding node is dynamically clustered to obtain several dynamic groups, as shown in the following formula: ,in, Representing a static subgraph The internal node structure representation uses the HDBSCAN dynamic clustering method, which aims to further discover local dynamic groups with similar structural representations within each static subgraph, thereby capturing fine-grained fraud pattern units with different risk levels and different cooperation methods. (3) For each dynamic group According to the group size Number of known fraudulent nodes within the group Group average predicted score and the concentration of high-risk nodes Divide group roles In this group, G1 represents the fraud group, G2 represents the risk group, and G3 represents the normal group. The purpose of this division is to assign different risk semantics to different structural pattern units based on the proportion of known labels, the predicted risk level, and the concentration of high-risk nodes in the group, thereby providing a basis for the selection of subsequent differentiated generation strategies. (4) For different role groups Using strategy selection function ,in, It is a strategy selection indicator; determining the basic sample pool. Target sample pool And further calculate the basic prototype. and target prototype A new representation is generated according to the following formula: ,in, To expand the strength control parameters, For random perturbation terms; its purpose is to expand the representation from the basic prototype along the risk semantic direction indicated by the target prototype, and enhance the diversity of generated representations through random perturbation terms, thereby supplementing the insufficient suspicious collaborative patterns in the training process. (5) For groups with different roles, different strategy instances are used to simulate diverse collaborative patterns. For fraud groups, strategies such as fraud scale expansion, fraud gang splitting, fraud cross-group bridging, and fraud fusion clusters can be used. For risk groups, strategies such as gray zone generation, risk diffusion, and risk disguise can be used. For normal groups, strategies such as structural penetration and reputation affiliation can be used. In this way, diverse collaborative fraud patterns in the training are actively expanded in the representation space. The purpose is to enable the model to learn different risk evolution directions such as fraud expansion, fraud gang splitting, cross-group bridging, risk diffusion, and normal group penetration, thereby improving the model's generalization ability under limited fraud labeling conditions. The overall purpose of this step is to discover pattern units with different risk semantics from the structural representation through a hierarchical process of "static partitioning - dynamic clustering - role recognition - strategy generation", and to expand the insufficiently learned collaborative fraud patterns in the representation space, so as to alleviate the problem of insufficient pattern learning caused by the scarcity of relevant software fraud labels in real financial scenarios.

[0022] Figure 1 , Figure 2 As shown, step four involves jointly optimizing the original representation and the generated representation model through optimization and generation of representation units, including the following sub-steps. (1) Using the original node comprehensive representation matrix obtained in step two... and the generated representation matrix obtained in step three For input, a shared two-layer MLP classifier is built, for any input representation The prediction probability formula is: ,in, The purpose is to use a unified classification decision boundary for the original node representation and the generated node representation, so that the generated representation can participate in fraud discrimination learning together with the real sample representation, thereby improving the model's unified recognition ability for real fraud samples and extended risk patterns. (2) Construct a real sample classification loss for the original labeled samples: in, It represents the probability of the true class in the original sample. Let the original labeled sample set be the starting point. The formula for the classification loss of the generated samples is as follows: in, It is the probability of the true class in the generated sample. This represents the generated sample set that has been assigned labels; thus, the formula for the total classification loss is as follows: The loss is used to simultaneously constrain the classification results of the original labeled samples and the generated labeled samples, so that the model can accurately identify fraudulent nodes in real samples and learn extended risk patterns from generated samples. (3) To enhance the discriminative ability of the decoupled representation space, two enhanced views are constructed in the behavioral representation space and the structural representation space obtained in step two, and the supervised contrastive learning objective is used to make samples of the same class closer and samples of different classes farther apart. The supervised contrastive loss of a single representation space can be written as the formula: in, This represents a labeled training sample set that has at least one valid positive sample. Indicates sample The set of positive samples, and This represents the candidate set used for comparative comparisons. Indicates sample and samples The similarity score in the representation space is used to derive the behavioral space supervised contrastive loss. Comparison of loss with structural space supervision (4) Finally, the overall optimization objective is composed of the classification loss and the two supervised comparison losses, as shown in the following formula: By jointly optimizing the above objective function, the generated suspicious cooperative patterns can directly participate in the classification boundary adjustment, while enhancing the intra-class compactness and inter-class separability in the behavior space and structure space, thereby improving the final graph fraud detection performance.

[0023] Figure 1 , 2As shown, through all the above technical solutions, the present invention achieves the following technical effects. (1) Explicitly modeling structural risk signals to improve robustness against fraud spoofing: Unlike existing technologies that mainly rely on behavioral feature enhancement and relation aggregation optimization, the present invention explicitly constructs structural features from the perspectives of relation-specific connectivity, cross-relation consistency, and local structural tightness, and establishes a more stable risk representation through a structure-dominated encoding mechanism, thereby effectively reducing the interference of fraud spoofing on the detection results. (2) Achieving decoupled modeling and controlled fusion of behavioral and structural information: Existing methods usually directly couple behavioral and structural information during propagation, which can easily cause spoofing behavior to pollute the neighborhood aggregation results. The present invention establishes a more reliable node comprehensive representation by independently encoding behavioral and structural features and adaptively controlling the intensity of behavioral information introduction according to the structural risk level. (3) It can actively expand collaborative fraud patterns and improve the generalization ability under limited supervision: Unlike existing generative methods that mainly fit existing data distributions or local perturbation decision boundaries, this invention identifies groups with different risk roles through hierarchical group discovery and selects different expansion strategies according to group roles. It actively expands diversified collaborative fraud patterns in the representation space, thereby enhancing the model's learning ability for complex fraud evolution patterns. (4) Joint training of original and generated representations improves the overall decision boundary: This invention incorporates original and generated samples into training through a shared classifier and applies supervised contrastive learning constraints in the behavior space and structure space, respectively. This allows the generated suspicious patterns to directly participate in optimizing the classification boundary and enhances the discriminativeness of the decoupled representation space. (5) It has strong application value when applied to real financial graph data scenarios: This invention is designed to address the problems of fraud disguise and label scarcity in financial transaction graphs. It takes into account individual behavior, structural risk, and collaborative pattern evolution. It can be used for practical risk control tasks such as user risk identification, gang fraud detection, and protection of potential victims.

[0024] The foregoing has shown and described the basic principles and main features of the present invention, as well as its advantages. It will be apparent to those skilled in the art that the present invention is limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or basic characteristics. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, it is intended that all variations falling within the meaning and scope of equivalents of the claims be included within the present invention.

[0025] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in the embodiments can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A graph fraud detection method based on structural risk coding and collaborative pattern generation, characterized in that, The structural risk construction unit, structural dominant coding establishment unit, structural perception generation establishment unit, and optimization and generation representation unit application software installed in the PC are used as tools for graph fraud detection. The detection method includes the following steps: S1: Construct a structural risk feature model. Using structural risk construction units, construct node structural features on multi-relationship financial transaction graph data from multiple perspectives, including relationship-specific connectivity, cross-relationship consistency, and local structural tightness, so as to explicitly characterize the structural risk signals in multi-entity collaborative association. S2: Establish a structure-dominated coding model. The original behavioral features and structural features of the graph data are input into the decoupled behavioral encoder and structural encoder respectively through the structure-dominated coding establishment unit to obtain behavioral representation and structural representation. On this basis, the contribution of behavioral information is adaptively adjusted through controlled fusion gating and structural risk estimation mechanisms to obtain a node fusion representation dominated by structural evidence. S3: Establish a structure-aware generation model. Based on the node structure representation, the structure-aware generation unit identifies candidate suspicious groups by combining static subgraph partitioning and dynamic clustering of graph data in a hierarchical group discovery method. Based on fraud evidence, risk concentration and predictive statistics in the group, the group is divided into different risk roles. Then, different expansion strategies are selected according to different group roles to actively generate diverse suspicious collaboration patterns in the representation space. S4: Jointly optimize the original representation and generated representation models. The optimized and generated representation units use a shared classifier to jointly train fraud classification on the original node representation and generated representation of the graph data. Supervised contrastive learning objectives are introduced into the behavior representation space and structure representation space respectively to improve intra-class compactness and inter-class separability, thereby improving the final graph fraud detection performance.

2. The graph fraud detection method based on structural risk coding and collaborative pattern generation according to claim 1, characterized in that, The graph data in steps S1 to S4 are denoted as in, For a set of nodes, For the first The set of edges corresponding to class relationships. This is the original behavioral feature matrix of the nodes. This is the node label vector.

3. The graph fraud detection method based on structural risk coding and collaborative pattern generation according to claim 1, characterized in that, In step S1, node structural features are constructed on the multi-relation graph of the graph data from three aspects: relation-specific connectivity, cross-relation consistency, and local structural tightness. Wherein, if Represents a node In relation Given a set of neighbors, the relation-specific connectivity is represented as: The formula for cross-relation consistency is: Local structural compactness is obtained by statistically merging the number of triangular closures in the graph. After aggregating the statistics of relation-specific connectivity, cross-relation consistency, and local structural compactness, a node structure feature vector is formed. The structural features of all nodes together constitute the structural feature matrix.

4. The graph fraud detection method based on structural risk coding and collaborative pattern generation according to claim 1, characterized in that, In step S2, the specific establishment of the structure-dominated coding model includes three processes: (1) converting the original behavioral feature matrix into a single matrix. Input behavior encoder The behavior representation matrix is ​​obtained. (2) The structural feature matrix Input structure encoder , (3) Based on the above, a controlled fusion mechanism is introduced to generate gating vectors according to the structural representation, behavioral representation and their interaction relationship. And obtain the node structure risk score based on the structural representation. and inhibition coefficient This forms a comprehensive node representation. .

5. The graph fraud detection method based on structural risk coding and collaborative pattern generation according to claim 1, characterized in that, In step S3, the specific establishment of the structure-aware generative model includes a hierarchical group discovery and group pattern expansion process. First, the original graph is statically partitioned to obtain several static subgraphs. Within each static subgraph, dynamic clustering is performed based on the node structure representation to obtain candidate groups. For each group, it is divided into fraud groups, risk groups, and normal groups based on fraud evidence, average prediction scores, and the concentration of high-risk nodes within the group.

6. The graph fraud detection method based on structural risk coding and collaborative pattern generation according to claim 1, characterized in that, In step S3, a policy selection function is used to determine the basic sample pool for different role groups. Target sample pool and random disturbances And a new representation is generated by interpolation in the prototype direction and random perturbation: .

7. The graph fraud detection method based on structural risk coding and collaborative pattern generation according to claim 1, characterized in that, In step S4, the specific process of joint optimization is as follows: establish a shared classifier and optimize the original representation matrix. and generating representation matrix For fraud classification, we define the classification loss for real samples and the classification loss for generated samples for generated representations and their assigned labels. And using weight parameters Controlling sample generation loss The contribution to the overall classification objective is used to construct the overall classification loss. .

8. The graph fraud detection method based on structural risk coding and collaborative pattern generation according to claim 1, characterized in that, In step S4, to further enhance the discriminative power of the decoupled representation space, two enhanced views are constructed in the behavior representation space and the structure representation space, respectively. Similar samples are brought closer together, while dissimilar samples are moved further away, thus obtaining the behavior space supervised contrastive loss. Comparison of loss with structural space supervision and its weight parameters The ultimate overall training objective is It consists of classification loss and two supervised comparison losses, and improves graph fraud detection capability through joint optimization.

Images