A time-series diagram based feature enhancement and sample purification financial transaction fraud detection method

Abstract

The application discloses a feature enhancement and sample purification financial transaction fraud detection method based on a timing diagram, and belongs to the technical field of financial risk control. The method aims at the problems of insufficient utilization of topological information, large sample noise interference and insufficient description of time dynamic relationship in existing financial transaction graph fraud detection. Firstly, the topological feature of the transaction graph node attribute is enhanced. Then, the samples in the enhanced feature space are purified, and a supervised training set is constructed. Then, the edge time information is encoded, and the time vector is embedded in the message passing process of the graph neural network. Finally, the complete graph structure is used for node representation learning, and the classification training is completed on the purified supervised training set, and the fraud detection result is output. The application can improve the accuracy and robustness of fraud node identification in the financial transaction graph.

Description

Technical Field

[0001] This invention relates to the field of financial risk control and intelligent graph data analysis technology, and in particular to a method for detecting financial transaction fraud based on feature enhancement and sample purification of time series graphs, specifically belonging to the technical field of cross-application of graph neural networks, time series modeling and fraud detection. Background Technology

[0002] With the rapid development of digital payments, mobile internet, cloud computing, and smart terminals, the scale of financial transactions continues to expand, and transaction relationships are becoming increasingly complex. Fraudulent activities have also evolved from single, decentralized attacks into complex patterns characterized by organization, chain-like structures, and collaboration. Such fraudulent activities not only cause direct financial losses but also lead to a decline in trust within the payment ecosystem, spillover of financial risks, and increased compliance costs. Therefore, accurately identifying fraudulent activities in financial transactions has become an important research direction in the field of financial risk control. Existing financial fraud detection methods have roughly gone through three stages: expert rules, traditional machine learning, and deep learning. Traditional machine learning methods have improved detection efficiency to some extent, but they heavily rely on manual feature design and are difficult to effectively characterize complex nonlinear relationships. While deep learning methods possess strong automatic representation capabilities, they typically treat transaction samples as independent objects, making it difficult to fully utilize the potential relationships between transaction entities. In recent years, graph neural networks (GNNs) have provided a new approach to financial fraud detection by simultaneously modeling node attributes and topological relationships between samples. However, existing methods still have the following shortcomings: First, GNNs mainly rely on neighborhood aggregation to implicitly learn topological information, making it difficult to directly express explicit topological information that is highly relevant to fraud identification, such as connection strength, neighborhood consistency, and bridging roles. Second, in real transaction graphs, normal and fraudulent samples often overlap, and some samples have grayscale attributes and noise interference, which can easily lead to blurred classification boundaries and amplify the impact of noise during propagation. Third, financial transaction behavior has significant time dependence, irregular time intervals, and multi-scale dynamic evolution characteristics, making it difficult for traditional sequence models to effectively adapt to the complex temporal interaction patterns in such dynamic graphs. Therefore, there is an urgent need to propose a fraud detection method that can improve topological representation ability, temporal modeling ability, and training robustness while maintaining the original transaction graph topological structure, in order to achieve accurate identification of fraudulent nodes. Summary of the Invention

[0003] "A Financial Transaction Fraud Detection Method Based on Temporal Graph Feature Enhancement and Sample Cleaning" is an invention proposed to address the problems in current financial transaction graph fraud detection, such as the difficulty in explicitly expressing topological information, the difficulty in effectively modeling irregular time intervals and multi-scale dynamic relationships, and the ambiguity of classification boundaries caused by sample overlap and noise interference. The invention aims to solve the problems of insufficient utilization of graph topological features, inadequate characterization of temporal dynamic relationships, and weak robustness of model training in existing financial fraud detection technologies.

[0004] This invention innovatively proposes a financial transaction fraud detection method based on temporal graph feature enhancement and sample purification. By performing topological enhancement on the node features in the financial transaction graph, purifying the supervised sample set, and embedding edge time information into the graph message passing process, the method can accurately identify fraudulent nodes. The invention mainly consists of the following parts: Firstly, for the original node attributes in financial transaction graphs, topological statistical information such as node degree statistics, local agglomeration features, degree centrality, and neighborhood consistency is introduced and concatenated with the original features to construct an enhanced node representation, enabling the model to more fully perceive structural patterns related to fraudulent behavior. Secondly, to address the issues of sample overlap and noise interference in real transaction graphs, fraudulent nodes are clustered in the enhanced feature space, and a hypersphere set corresponding to high-density regions is constructed. Normal samples falling into the region are assigned a noise probability, and a cleaned supervised training set is formed by combining an undersampling strategy to reduce the interference of noise samples on the model training process. Thirdly, the relative time difference of edges is encoded into a multi-scale time vector and embedded in the graph attention propagation process, so that time information participates in both neighbor weight allocation and message content construction, thereby enhancing the model's ability to characterize the temporal dependence, suddenness, and long-term dynamic evolution of transaction behavior.

[0005] To achieve the aforementioned fraud detection method, this invention focuses on topological statistical features in transaction graphs, a supervised set purification strategy, and a time-aware graph network. It transforms the original financial transaction graph into an enhanced graph representation that can be learned by a time-series graph model, and completes node representation learning and classification prediction on the complete graph structure. The entire technical framework includes a feature enhancement module, a sample purification module, and a time-series information encoding module. The feature enhancement module extracts features such as node degree, local clustering coefficients, degree centrality, and neighborhood consistency to generate enhanced node representations. The sample purification module clusters fraudulent nodes in the enhanced feature space and identifies candidate noise samples through high-density hyperspherical regions, forming a purified supervised training set by combining probabilistic judgment and undersampling strategies. The time-series information encoding module encodes edge time information and inputs the time vector into an attention-based graph neural network, thereby enhancing the model's ability to characterize the temporal evolution of transaction behavior. Attached Figure Description

[0006] The objectives, implementation methods, advantages, and features of the present invention will become clearer from the following detailed description taken in conjunction with the accompanying drawings.

[0007] Figure 1 It is the methodological framework for invention.

[0008] Figure 2 It is an interpretable topological statistics-driven feature enhancement framework.

[0009] Figure 3 This is a schematic diagram of noise undersampling based on clustered hyperspheres.

[0010] Figure 4 This is a flowchart of time-aware coding. Detailed Implementation

[0011] This invention is primarily used for identifying fraudulent nodes in financial transaction graphs. The identification target is node samples within the financial transaction graph, with the classification result being either fraudulent or normal nodes. Therefore, this invention extracts directed transaction graphs with node attributes and edge time information from financial transaction scenarios as raw data. After node feature enhancement, supervised set purification, time encoding, and time-series graph model training, a final financial transaction graph fraud detection model is obtained. The hierarchical framework of the invention is as follows: Figure 1 As shown.

[0012] The overall framework of this invention comprises three parts: a feature enhancement module, a sample purification module, and a temporal information encoding module. The feature enhancement module extracts topological statistical features such as node degree, local clustering coefficient, degree centrality, and neighborhood consistency from the input transaction graph node attributes and graph topological relationships, generating enhanced node representations as input for subsequent modules. The sample purification module performs cluster analysis on fraudulent nodes based on the enhanced feature space, identifying candidate noise samples by constructing high-density hyperspherical regions corresponding to cluster centers, and forming a purified supervised training set by combining probability judgment and undersampling strategies. The temporal information encoding module encodes edge temporal information into time vectors. These vectors are then input into an attention-based graph neural network, allowing the temporal encoding to simultaneously affect attention scoring and message construction, ultimately outputting the fraud classification result for the node to be detected. Each part is described in detail below.

[0013] like Figure 2As shown, the feature enhancement module processes the node attributes in the original transaction graph and, without altering the original graph's topology, incorporates explicit statistics representing the node's topological role and local structural relationships into the original node attributes. Specifically, it first calculates the node's in-degree and out-degree to characterize the node's interaction strength and activity level; second, it calculates the node's local clustering coefficient to characterize the cohesion and community characteristics of the node's neighborhood; then, it calculates the node's degree centrality to characterize the scale of direct associations between the node and other transaction entities; and finally, it calculates the similarity statistics between the node and its neighbors in the attribute space, such as mean cosine similarity, to characterize the consistency or deviation between the node and its surrounding groups. Through these operations, the original node attributes are concatenated with the topological statistical features to obtain the enhanced node feature matrix. This processing method allows the model to obtain explicit topological priors in the early stages of training, without relying entirely on multi-layer neighborhood aggregation to implicitly learn topological meaning, thereby enhancing its ability to identify fraud-related structural patterns.

[0014] like Figure 3 As shown, the sample purification module filters and purifies the supervised samples in the enhanced feature space to reduce the interference of class overlap and noise samples on model training. Specifically, firstly, a clustering algorithm is used to cluster fraudulent node samples, preferably using the K-Means algorithm to divide fraudulent nodes into several clusters and obtain the center of each cluster. Then, a corresponding high-density hypersphere region is constructed with each cluster center as the sphere center and the distance from the farthest sample point in the corresponding cluster to the cluster center as the radius. Next, the distance of normal node samples to each cluster center is calculated. When a normal node sample falls inside any hypersphere region, it is identified as a candidate noise sample. Further, the probability of a candidate noise sample being a noise sample is calculated based on the distance between the candidate noise sample and the corresponding cluster center, where the closer the node is to the cluster center, the higher its noise probability. Finally, random determination is performed based on the noise probability to remove samples identified as noise, and a purified supervised training set is constructed by combining an undersampling strategy. This method can suppress noise propagation while avoiding excessive deletion of boundary samples, thereby improving the quality of training samples and reducing the blurring of classification boundaries. It should be noted that during the sample purification process, nodes identified as noise are only removed from the supervised training set and do not participate in the loss calculation. However, their nodes and associated edges in the original transaction graph are still retained for subsequent message passing and context modeling. In this way, the interference of noisy supervision on parameter optimization can be reduced while the contextual information in the complete graph structure can be preserved.

[0015] like Figure 4As shown, the temporal information encoding module processes the temporal information of edges and maps irregular time intervals into fixed-dimensional time vectors. Specifically, for each edge, the relative time difference with respect to the first occurrence time of the source node is calculated. Then, a multi-frequency cosine time encoder is used to encode the relative time difference to obtain a continuous, smooth time vector representation with multi-scale resolution. This encoding method ensures that similar time differences are represented similarly and maintains multi-scale characterization over a large time span, enabling the model to simultaneously capture short-term bursts of behavior and long-term evolutionary patterns. The encoded time vector is then used as the edge attribute input to the subsequent graph neural network model, providing temporal feature support for modeling the temporal dependencies of transaction behavior.

[0016] During the detection process, the time vector obtained by encoding the edge temporal information is used as the edge attribute input to the attention-based graph neural network, and participates in node representation learning together with the enhanced node features. Specifically, the enhanced node features are first mapped to the query vector, key vector, and value vector required for multi-head attention. Then, the edge temporal vector is transformed to the representation space corresponding to each attention head through linear mapping, and the mapped edge temporal vector is added to both the key vector and the value vector, so that the temporal information participates in the calculation of neighbor attention weights and the construction of message content. Through this design, the temporal information not only affects the importance allocation of neighbor nodes, but also affects the content expression of message transmission between nodes, thus enabling the model to more effectively characterize the dynamic behavioral patterns common in financial trading scenarios, such as recent decay, sudden activity, and long-tail time intervals. During training, topology augmentation is first performed on the node features in the transaction graph. Noise samples are then filtered and removed from the normal samples based on the clustering results of fraudulent nodes, constructing a purified supervised training set. Subsequently, the time-encoded edge temporal vectors and the augmented node features are input into the graph neural network for message propagation and node representation updates on the complete transaction graph structure. Finally, the classification loss is calculated only on the purified supervised training set, completing end-to-end model training. After training, inputting the node to be detected into the trained model will output the classification result: whether the node belongs to a fraudulent node or a normal node.

[0017] This invention organically combines topological feature enhancement, supervised set purification, and time-aware propagation to construct a unified fraud detection framework suitable for financial transaction graph scenarios. Compared with traditional detection methods that rely solely on original attributes or static graph structures, this invention can more fully utilize explicit topological and temporal dynamic information in the graph, and reduce noise sample interference by purifying the supervised set, thereby effectively improving the accuracy of fraud node identification and training robustness. As described above, this invention successfully achieves efficient identification of fraud nodes in financial transaction graphs. Compared with existing technologies, this invention has the following innovations: First, by constructing topological statistical features such as node degree statistics, local clustering coefficients, degree centrality, and neighborhood consistency, the original node representation is enhanced, enabling the model to more directly perceive topological patterns related to fraudulent behavior. Second, by combining cluster recognition, noise probability assessment, and undersampling, supervised training samples are purified, thereby reducing the impact of noisy and overlapping samples on classification boundary learning. Third, by encoding the relative time difference of edges into a time vector and embedding the time vector into the graph attention propagation process, time information is simultaneously applied to neighbor weight allocation and message content construction, thereby enhancing the model's ability to characterize the dynamic evolution of transaction behavior.

Claims

1. A method for detecting financial transaction fraud based on time-series graph feature enhancement and sample purification, characterized in that, The method includes the following steps: A. Obtain financial transaction graph data, which includes a set of nodes, a set of edges, a node attribute matrix, and timestamp information corresponding to the edges, and classify the labeled nodes into fraudulent nodes and normal nodes; B. Enhance the node attributes in the financial transaction graph by concatenating the topological statistical features that reflect the topological roles and local organizational forms of the nodes into the original node attributes while keeping the original graph topology unchanged, to obtain the enhanced node features. C. Perform sample purification based on the enhanced node features. This involves clustering fraudulent nodes, identifying normal samples that overlap with high-density regions of fraudulent node clusters, and constructing a purified supervised training set using an undersampling strategy. D. Encode the time information of the transaction edges, map the relative time difference of the edges into a time vector, and embed the time vector into the message passing process of the graph neural network to construct a time-aware graph network model. E. Utilize the complete financial transaction graph to learn node representations, and calculate the classification loss only on the purified supervised training set to complete model training; F. Input the node to be detected into the trained model and output the classification result of whether the node to be detected is a fraudulent node or a normal node.

2. The financial transaction fraud detection method based on time-series graph feature enhancement and sample purification according to claim 1, characterized in that, The feature enhancement process in step B includes the following: B1. Calculate the degree statistics and centrality characteristics of the nodes. The degree statistics include at least the node in-degree and node out-degree, which are used to characterize the node interaction strength and activity level. The centrality characteristic is degree centrality, which is used to characterize the scale of direct association between the node and other transaction entities. B2. Calculate the local cohesion characteristics and neighborhood consistency characteristics of the node. The local cohesion characteristics are local clustering coefficients, which are used to characterize the degree of cohesion and community structure of the node's neighborhood. The neighborhood consistency characteristics are similarity statistics between the node and its neighbors in the attribute space, which are used to characterize the consistency or deviation relationship between the node and the surrounding group. B3. The degree statistical features, centrality features, local cohesion features, and neighborhood consistency features are concatenated with the original node attributes to obtain the enhanced node feature matrix.

3. The financial transaction fraud detection method based on time-series graph feature enhancement and sample purification according to claim 1, characterized in that, The sample purification process in step C includes the following: C1. The fraud node samples in the enhanced feature space are divided into multiple clusters using a clustering algorithm to obtain the cluster center of each fraud node cluster; C2. Using the center of each cluster as the center of the sphere and the distance from the farthest sample point in the corresponding cluster to the center of the cluster as the radius, construct a hypersphere region corresponding to each fraud node cluster. C3. Calculate the distance from normal node samples to the center of each cluster. When a normal node sample falls inside any hypersphere region, it is identified as a candidate noise sample. The probability of the candidate noise sample being a noise sample is calculated based on the distance between the candidate noise sample and the corresponding cluster center. The closer the node is to the cluster center, the higher its noise probability. C4. Randomly determine the candidate noise samples based on the noise probability, remove the samples determined to be noise, and construct a purified supervised training set by combining the undersampling strategy.

4. The financial transaction fraud detection method based on time-series graph feature enhancement and sample purification according to claim 1, characterized in that, The time encoding process in step D includes the following: D1. For each edge, calculate the relative time difference of the edge with respect to the first occurrence time of the source node; D2. The relative time difference is mapped to a fixed-dimensional time vector using a multi-frequency cosine time encoder to obtain a multi-scale time representation of short-term sudden changes and long-term evolution patterns. D3. The time vector is used as the edge attribute input to the graph neural network for subsequent time-aware message passing.

Images