A credit card fraud detection method and system based on graph tree decoupling fusion

Abstract

The application discloses a credit card fraud detection method and system based on graph tree decoupling fusion, and belongs to the technical field of financial risk control. The method comprises the following steps: acquiring historical transaction data and constructing a heterogeneous transaction graph composed of card nodes and merchant nodes; extracting time sequence behavior risk features, social structure risk features and graph embedding representation; obtaining transaction structure interaction information of both parties by node embedding splicing, difference calculation and element-by-element multiplication, and fusing the information with multi-source features to construct an edge-level hybrid risk feature vector; inputting a gradient boosting tree classification model to output a fraud probability; and processing the class imbalance problem by using a multi-strategy cooperative mode of sample enhancement, loss function adjustment and classification threshold optimization. The application also discloses a corresponding detection system. Through the decoupling architecture of graph representation learning and tree model classification, the application fuses multi-level risk features of time sequence, structure and community, and improves the accuracy, interpretability and gang fraud recognition ability of fraud detection.

Description

Technical Field

[0001] This invention relates to a graph-tree decoupled fusion method and system for credit card fraud detection, belonging to the field of financial risk control and intelligent information processing technology, and is particularly applicable to a graph-tree decoupled fusion method for credit card fraud detection. Background Technology

[0002] With the rapid development of the digital economy and electronic payments, credit card fraud is exhibiting new characteristics of concealment, organized crime, and instantaneous activity. Traditional rule-based anti-fraud systems rely on manually defined features and thresholds, making it difficult to adapt to the dynamic changes in new fraud patterns. Single machine learning models (such as logistic regression and random forests) focus on individual transaction characteristics, failing to effectively capture the associated risks between cards and merchants, and exhibiting low detection rates for organized fraud.

[0003] In recent years, Graph Neural Networks (GNNs) have gained widespread attention in the field of fraud detection due to their powerful modeling capabilities for non-Euclidean structured data. GNNs can uncover hidden group fraud activities through message passing and neighborhood aggregation between nodes in a transaction network. On the other hand, gradient boosting tree models, represented by LightGBM, have advantages such as fast training speed, strong interpretability, and suitability for imbalanced samples when processing tabular data.

[0004] However, existing research suffers from the following technical shortcomings: First, the coupling problem between representation learning and classification. A single GNN model couples graph structure learning and classification within the same framework, but their optimization objectives are not entirely aligned, leading to performance bottlenecks. Furthermore, the black-box nature of GNNs makes it difficult to meet the interpretability requirements of financial risk control scenarios. Second, the separation of temporal information and graph structure information: Existing methods fail to effectively integrate the temporal distribution characteristics of transactions (such as instantaneous high frequency and sudden increases in amount) with network association characteristics (such as group fraud), resulting in limited ability to identify fraudulent behavior. Third, the coarse granularity of group fraud detection. Existing methods mostly focus on detection at the level of single transactions or node neighbors, lacking the ability to model risk at the community level, making it difficult to effectively identify hidden, structured fraud groups. Fourth, the prominent problem of class imbalance. Fraudulent samples account for a very low percentage (usually less than 5%) of real transaction data, and directly training the model easily leads to a severely insufficient recall rate for fraudulent samples.

[0005] Therefore, there is an urgent need in this field for an efficient, interpretable fraud detection method that can simultaneously solve the above-mentioned technical problems and is applicable to large-scale IoT or financial transaction scenarios. Summary of the Invention

[0006] In view of this, the present invention provides a credit card fraud detection method and system based on graph-tree decoupling and fusion. By constructing a heterogeneous transaction graph composed of card nodes and merchant nodes, the graph structure representation, temporal behavioral risk characteristics, and community structure risk characteristics of the transaction subjects are extracted respectively. The gradient boosting tree model is then used for risk discrimination, thereby decoupling the graph structure learning process from the classification decision process.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] A method for credit card fraud detection using graph-tree decoupling and fusion, characterized by the following steps:

[0009] 51: Obtain historical transaction data, preprocess the historical transaction data to obtain standardized transaction data; wherein, the standardized transaction data includes transaction entity information and basic transaction attribute information, the transaction entity information includes at least card identification information and merchant identification information, and the basic transaction attribute information includes at least transaction amount, transaction time and transaction category information;

[0010] S2: Construct a heterogeneous transaction graph composed of card nodes and merchant nodes based on the standardized transaction data; wherein, the transaction entity corresponding to the card identifier is represented as a card node, the transaction entity corresponding to the merchant identifier is represented as a merchant node, and the transaction behavior between the card node and the merchant node is represented as a transaction edge connecting the two types of nodes;

[0011] S3: Extract multi-source risk features from standardized transaction data and heterogeneous transaction graphs, including:

[0012] Based on the transaction time and transaction amount information in the standardized transaction data, the historical behavioral changes of the transaction entities are statistically analyzed according to multiple time scales to generate time-series behavioral risk characteristics.

[0013] Based on the heterogeneous transaction graph, communities are divided to obtain the community structure to which the transaction entities belong, and community structure risk characteristics are generated according to the node connection relationship and transaction behavior statistics within the community.

[0014] The heterogeneous graph neural network is used to learn node representations of the heterogeneous transaction graph, and graph embedding representations of card nodes and merchant nodes are generated by neighborhood information propagation and aggregation.

[0015] S4: For the transaction to be detected, obtain the card node graph embedding representation, merchant node graph embedding representation, basic transaction attribute features, temporal behavior risk features, and community structure risk features corresponding to the transaction;

[0016] The structural interaction information of the two parties in the transaction is obtained by node embedding concatenation, node embedding difference calculation and node embedding element-wise multiplication operation. The structural interaction information is then fused with basic transaction attribute features, temporal behavior risk features and community structure risk features to obtain a side-level hybrid risk feature vector.

[0017] S5: Input the edge-level mixed risk feature vector into the gradient boosting tree classification model, and output the fraud probability corresponding to the transaction to be detected through the gradient boosting tree classification model;

[0018] S6: To address the imbalance between fraudulent and normal transaction samples, a multi-strategy collaborative optimization approach combining sample augmentation, loss function adjustment, and classification threshold optimization is adopted to optimize the model training and inference process.

[0019] Furthermore, step S1 specifically includes:

[0020] S101: Obtain historical credit card transaction dataset Where r i For the i-th transaction record, y i ∈{0,1} represents the fraud label, and N represents the total number of transaction records.

[0021] S102: For each transaction record r i Field extraction is performed to obtain transaction entity information and basic transaction attribute information; the transaction entity information includes at least the card identifier. i Merchant identification merch i The basic transaction attribute information includes at least the transaction amount. Transaction timestamp and transaction category codes

[0022] S103: Preprocess the raw data; specifically, fill missing values ​​of categorical features with preset signs and fill missing values ​​of numerical features with 0.

[0023] S104: Output standardized transaction data in

[0024] Furthermore, step S2 specifically includes:

[0025] S201: Based on standardized transaction data Construct a heterogeneous transaction graph G = (V, E);

[0026] S202: Represent the transaction entity corresponding to the card identifier as a card node, forming a card node set V. card The transaction entity corresponding to the merchant identifier is represented as a merchant node, forming a merchant node set V.merch Therefore, the total node set V = V card ∪V merch ;

[0027] S203: Represent each transaction between the card node and the merchant node as a transaction edge connecting the two types of nodes, and set the edge. Each edge e i = (c, m) associated basic transaction attribute feature vector Where d base These are the basic transaction attribute feature dimensions.

[0028] Furthermore, the extraction process of the temporal behavioral risk features described in step 53 is specifically as follows:

[0029] S3101: Set the length of multiple sliding time windows in A set of preset window lengths;

[0030] S3102: For each card node c∈V card Using the time ti of its i-th transaction as a reference, backtrack the historical transactions within the window W and calculate the following time series characteristics: transaction frequency f c，W (t i ); Total amount s c，W (t i ); Average amount μ c，W (ti)=s c，W (t i ) / max(1,f c，W (t i Standard deviation of amount σ c，W (t i ); the percentage increase in amount r c，W (t i ) = amt i / μ c，W (t i If μ c，W (t i If ) = 0, then r c，W (t i ) = amt i .

[0031] S3103: Calculate behavioral temporal characteristics: Time interval from the previous transaction: Δt last =t i -t i-1 Nighttime trading sign The sudden transaction indicator isBurst(t) i )=1{f c，1h (ti )≥θ burst}, where t i-1 The timestamp of the last transaction on the same card node. Let θ be a preset set of nighttime periods, 1{·} be an indicator function, and θ be a preset set of nighttime periods. burst Preset burst threshold;

[0032] S3104: Concatenate all the above time-series features into a time-series behavioral risk feature vector. Where d time This represents the total dimension of the time-series features.

[0033] Furthermore, the community structure risk feature extraction process described in step S3 is as follows:

[0034] S3201: Perform community partitioning on the heterogeneous transaction graph G and define the modularity:

[0035]

[0036] Where M = |E| is the total number of sides, A ij Let k be the edge weight between nodes i and j. i =∑ j A ij 为 The degree of node i, com(i) is the community label to which node i belongs, and δ(·,·) is the characteristic function;

[0037] S3202: Iterate and optimize until the modularity Q no longer increases, and output the community tag for each node;

[0038] S3203: For each community C, calculate the following statistical characteristics: historical risk trading ratio ρ C Community density δ C Time concentration τ C Nighttime trading ratio v C Card quotient γ C ;

[0039] S3204: For the transaction edge to be detected, e = (c, m), if com(c) = com(m), then let Otherwise, community structure risk characteristics are generated according to the preset strategy.

[0040] Furthermore, the community segmentation described in step S3201 employs the Louvain community detection algorithm.

[0041] Furthermore, the graph embedding representation learning process described in step S3 specifically includes:

[0042] S3301: The heterogeneous transaction graph G is encoded using a heterogeneous graph neural network;

[0043] S3302: For card node c and merchant node m, the original node features are mapped to a unified latent space through independent linear projection layers:

[0044]

[0045] Where x c x m W represents the original feature vector of a node, which is obtained by statistically analyzing all historical transaction records associated with that node. card W merch For learnable projection matrix;

[0046] S3303: For the l-th layer (l = 1, 2, ..., L), each node v aggregates the features of its neighboring nodes N(v) and updates its own representation:

[0047]

[0048] Where AGGREGATE is the preset aggregation function, σ(·) is the activation function, and W (l) Let be the learnable weight matrix for the l-th layer.

[0049] S3304: After L layers of graph convolution, the graph embedding representation of each card node c is obtained. Graph embedding representation of each merchant node m Where d is the preset embedding dimension.

[0050] Furthermore, step S4 specifically includes:

[0051] S401: For the transaction to be detected, e = (c, m), obtain the card node graph embedding representation z corresponding to the transaction. c Merchant node graph embedding representation z m Basic transaction attribute characteristics x base Time-series behavioral risk characteristics x time and community structure risk characteristics x com ;

[0052] S402: Obtain the structural interaction information between the transacting parties through the following operations: (a) Embedding and splicing: z c ||z m (b) Embedding difference: z c -z m (c) Embedded element-wise product: z c ⊙z m .

[0053] S403: The structural interaction information is fused with the basic transaction attribute features, time-series behavioral risk features, and community structure risk features to obtain a boundary-level hybrid risk feature vector:

[0054]

[0055] Where D = 4d + d base +d time +5.

[0056] Furthermore, step S5 specifically includes:

[0057] S501: The edge-level mixed risk feature vector x hybrid Input gradient boosting tree classification model Output the fraud probability of the transaction to be detected.

[0058] S502: The gradient boosting tree classification model is a lightweight gradient boosting machine (LightGBM), and its optimization objective in the t-th iteration is:

[0059]

[0060] Where l(·,·) is the loss function, f is the predicted value for the first t-1 rounds. t Let w be the decision tree added in round t, where T is the number of leaf nodes. j Let be the weight of the j-th leaf node, and γ and λ be the regularization coefficients. Let be the edge-level mixed risk feature vector corresponding to the i-th transaction sample.

[0061] Furthermore, the sample augmentation involves using the SMOTE oversampling algorithm to synthesize fraudulent samples, generating new samples that are then added to the training set; the loss function adjustment includes using the Focal Loss loss function or constructing corresponding first and second gradient forms based on Focal Loss as the optimization objective of the gradient boosting tree model; and the classification threshold optimization involves searching for the optimal decision threshold θ on the validation set with the goal of maximizing the F1 score. * During the inference phase, the fraud probability p output by the model is compared with θ. * Comparison, if p≥θ * If it is not, it is considered a fraudulent transaction; otherwise, it is considered a normal transaction.

[0062] Furthermore, the heterogeneous graph neural network is either a heterogeneous graph sampling and aggregation network (HeteroGraphSAGE) or a heterogeneous graph attention network (HeteroGAT).

[0063] The present invention also provides a credit card fraud detection system with graph-tree decoupling and fusion, comprising: a heterogeneous graph construction and preprocessing module (1), a multi-scale temporal feature extraction module (2), a heterogeneous graph representation learning module (3), a community detection and risk perception module (4), a bi-branch feature fusion module (5), a gradient boosting tree classification decision module (6), and a multi-strategy collaborative optimization training module (7).

[0064] The heterogeneous graph construction and preprocessing module (1) includes a data acquisition unit (11), a data processing unit (12), and a graph structure generation unit (13) connected in series.

[0065] Among them, the data acquisition unit (11) is used to acquire historical credit card transaction data, the data processing unit (12) is used to process the missing values, encode and convert the historical credit card transaction data and standardize the features to obtain standardized transaction data and basic transaction attribute features; the graph structure generation unit (13) constructs a heterogeneous transaction graph containing card nodes, merchant nodes and transaction edges according to the transaction subject relationship in the standardized transaction data.

[0066] The output of the heterogeneous graph construction and preprocessing module (1) is connected to the multi-scale temporal feature extraction module (2), the heterogeneous graph representation learning module (3), the community detection and risk perception module (4), and the dual-branch feature fusion module (5), respectively.

[0067] The multi-scale temporal feature extraction module (2) includes a time window management unit (21), a behavior statistics unit (22), and a temporal feature generation unit (23) connected in series.

[0068] Among them, the time window management unit (21) is used to establish time windows of multiple scales based on transaction time information; the behavior statistics unit (22) is used to statistically analyze the transaction frequency, transaction amount changes and transaction behavior changes of the transaction subjects in different time windows; the time series feature generation unit (23) generates time series behavior risk features based on the statistical results and outputs them to the dual-branch feature fusion module (5).

[0069] The heterogeneous graph representation learning module (3) includes a node feature mapping unit (31), a graph information propagation unit (32), and a node representation output unit (33) connected in series.

[0070] Among them, the node feature mapping unit (31) is used to map the initial features of different types of nodes; the graph information propagation unit (32) uses a heterogeneous graph neural network to perform neighborhood information aggregation and node state update on the heterogeneous transaction graph; the node representation output unit (33) outputs the graph embedding representations corresponding to card nodes and merchant nodes and sends them to the dual-branch feature fusion module (5).

[0071] The community detection and risk perception module (4) includes a community segmentation unit (41), a community risk statistics unit (42), and a community feature matching unit (43) connected in series.

[0072] Among them, the community segmentation unit (41) is used to determine the transaction community structure based on the node connection relationship in the heterogeneous transaction graph; the community risk statistics unit (42) is used to calculate the structural risk statistics information corresponding to each transaction community; the community feature matching unit (43) generates the corresponding community structural risk features based on the community to which the corresponding node of the transaction to be detected belongs, and outputs them to the dual-branch feature fusion module (5).

[0073] The dual-branch feature fusion module (5) includes a graph interaction feature generation unit (51) and a hybrid feature fusion unit (52) connected in series.

[0074] Among them, the graph interaction feature generation unit (51) calculates the structural interaction relationship between nodes based on the graph embedding representation of the nodes at both ends of the transaction to be detected; the hybrid feature fusion unit (52) is used to fuse the structural interaction relationship, basic transaction attribute features, temporal behavior risk features and community structure risk features to generate a side-level hybrid risk feature vector, and the output end is connected to the gradient boosting tree classification decision module (6).

[0075] The gradient boosting tree classification decision module (6) includes a classification prediction unit (61) and a risk output unit (62) connected in series.

[0076] Among them, the classification prediction unit (61) is used to receive the edge-level mixed risk feature vector and calculate the fraud probability corresponding to the transaction to be detected through the gradient boosting tree model; the risk output unit (62) outputs the transaction risk judgment result according to the fraud probability and the preset decision strategy.

[0077] The multi-strategy collaborative optimization training module (7) includes a sample optimization unit (71), a model optimization unit (72), and a decision optimization unit (73);

[0078] Among them, the data optimization unit (71) is connected to the dual-branch feature fusion module (5) and is used to perform class balancing on the generated side-level mixed risk feature samples; the model optimization unit (72) is connected to the gradient boosting tree classification decision module (6) and is used to adjust the training objective of the classification model; the decision optimization unit (73) is connected to the gradient boosting tree classification decision module (6) and is used to determine the optimal classification threshold and feed it back to the risk output process.

[0079] Through the collaborative work of the above modules, this system achieves end-to-end processing from credit card transaction data input, heterogeneous correlation modeling, multi-source risk feature extraction, graph-tree decoupling and fusion analysis to fraud risk output, improving the accuracy, interpretability, and adaptability of credit card fraud detection in complex correlation fraud scenarios.

[0080] The beneficial effects of this invention are as follows: This invention constructs a hybrid detection architecture that decouples graph representation learning from tree model classification. It utilizes heterogeneous graph neural networks to extract high-order association structure information between card nodes and merchant nodes, and combines transaction attribute features, temporal behavioral risk features, and community structure risk features to construct a hybrid risk representation oriented towards transaction edges. This enables the model to simultaneously perceive anomalies in individual transactions, changes in the behavior of transaction subjects, and group association risks. Simultaneously, gradient boosting of the tree model completes the final fraud detection, reducing the optimization conflict between graph representation learning and classification tasks and enhancing the interpretability of detection results. Furthermore, the multi-strategy collaborative mechanism of sample augmentation, loss adjustment, and decision optimization effectively alleviates the class imbalance problem in fraud detection scenarios, improves the ability to identify concealed fraudulent behavior and organized fraudulent behavior, thereby enhancing the accuracy, stability, and engineering application value of credit card fraud detection. Attached Figure Description

[0081] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the following figures are provided for illustration:

[0082] Figure 1 This is an overall flowchart of the graph-tree decoupled fusion credit card fraud detection method described in this invention;

[0083] Figure 2 This is a block diagram of a graph-tree decoupled fusion credit card fraud detection system according to the present invention;

[0084] Figure 3 This is a schematic diagram of the construction of a heterogeneous transaction graph in Embodiment 1 of the present invention;

[0085] Figure 4 This is a statistical chart of daily transaction time data in Embodiment 2 of the present invention;

[0086] Figure 5 This is a heatmap of weekday fraud statistics in Embodiment 2 of the present invention;

[0087] Figure 6 This is a graph showing the prediction results implemented by the software in Embodiment 2 of the present invention. Detailed Implementation

[0088] The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings. This embodiment uses a credit card transaction fraud detection scenario of a bank as an example to illustrate the specific implementation and beneficial effects of the present invention.

[0089] Example 1: In the development of credit card fraud detection technology, researchers often face the challenge of ensuring a new method functions correctly and that the logic of each module is consistent. Debugging and verification on large-scale real-world datasets is costly, time-consuming, and makes it difficult to visually observe the intermediate outputs of each step. Therefore, this method... Figure 3 The diagram shows a small, artificially constructed transaction network, illustrating the complete process of the method of this invention from data input to fraud detection in the simplest way. It verifies the logical correctness of each step and the compatibility of the interfaces between modules, laying the foundation for subsequent large-scale experiments on real datasets.

[0090] Set up a small transaction network with 3 cards and 2 merchants. The transaction records are shown in Table 1 below.

[0091] Table 1 Historical Transaction Records

[0092] 1 Card 1 Merchant 1 50 10:00 0 2 Card 2 Merchant 1 80 10:05 0 3 Card 1 Merchant 2 200 10:30 1 4 Card 2 Merchant 2 150 10:32 1 5 Card 3 Merchant 2 30 10:35 0

[0093] In this example, a fraud label y=1 indicates a fraudulent transaction, and y=0 indicates a legitimate transaction. The fraudulent sample accounts for 2 / 5 = 40%, but the proportion is even lower in real-world scenarios. This example is only for process demonstration.

[0094] To achieve accurate detection of credit card fraud, this invention provides a graph-tree decoupled fusion method for credit card fraud detection, combining... Figure 1 This includes the following steps:

[0095] S1: Obtain historical transaction data, preprocess the historical transaction data to obtain standardized transaction data; wherein, the standardized transaction data includes transaction entity information and basic transaction attribute information, the transaction entity information includes at least card identification information and merchant identification information, and the basic transaction attribute information includes at least transaction amount, transaction time, and transaction category information. Specifically, this includes the following steps:

[0096] S101: Obtain historical credit card transaction dataset Where r i For the i-th transaction record, y i ∈{0,1} represents the fraud label, and N represents the total number of transaction records.

[0097] In this embodiment, N=5, and the transaction records r1 to r5 are shown in the table above. The corresponding fraud tags are y1=0, y2=0, y3=1, y4=1, and y5=0, respectively.

[0098] S102: For each transaction record r i Field extraction is performed to obtain transaction entity information and basic transaction attribute information; the transaction entity information includes at least the card identifier.i Merchant identification merch i The basic transaction attribute information includes at least the transaction amount. Transaction timestamp and transaction category codes

[0099] In this embodiment, the extraction results are as follows:

[0100] r1: card1 = card 1, merc1 = merchant 1, amt1 = 50, t1 = 10:00, prod1 = 1;

[0101] r2: card2 = card 2, merc2 = merchant 1, amt2 = 80, t2 = 10:05, prod2 = 1;

[0102] r3: card3 = card 1, merc3 = merchant 2, amt3 = 200, t3 = 10:30, prod3 = 1;

[0103] r4:card4=card2,merch4=merchant2,amt4=150,t4=10:32,prod4=1;

[0104] r5: card5 = card 3, merch5 = merchant 2, amt5 = 30, t5 = 10:35, prod5 = 1.

[0105] S103: Preprocess the original data; specifically, fill missing values ​​of categorical features with preset symbols and fill missing values ​​of numerical features with 0.

[0106] In this embodiment, all fields have no missing values ​​and do not require padding.

[0107] S104: Output standardized transaction data in

[0108] This embodiment outputs 5 standardized transaction records, each containing card identifier, merchant identifier, transaction amount, timestamp, and product code.

[0109] S2: Construct a heterogeneous transaction graph consisting of card nodes and merchant nodes based on the standardized transaction data; wherein, the transaction entity corresponding to the card identifier is represented as a card node, the transaction entity corresponding to the merchant identifier is represented as a merchant node, and the transaction behavior between the card node and the merchant node is represented as a transaction edge connecting the two types of nodes. Specifically,

[0110] S201: Based on standardized transaction data Construct a heterogeneous transaction graph G = (V, E).

[0111] S202: Represent the transaction entity corresponding to the card identifier as a card node, forming a card node set V. card The transaction entity corresponding to the merchant identifier is represented as a merchant node, forming a merchant node set V. merch Therefore, the total node set V = V card ∪V merch .

[0112] In this embodiment, V card ={Card 1, Card 2, Card 3}, V merch ={Merchant 1, Merchant 2}, V ={Card 1, Card 2, Card 3, Merchant 1, Merchant 2}.

[0113] S203: Represent each transaction between the card node and the merchant node as a transaction edge connecting the two types of nodes, and set the edge. Each edge e i = (c, m) associated basic transaction attribute feature vector Where d base These are the basic transaction attribute feature dimensions.

[0114] In this embodiment, the edge set E = {e1, e2, e3, e4, e5}, where:

[0115] e1 = (Card 1, Merchant 1), associated

[0116] e2 = (Card 2, Merchant 1), Associated

[0117] e3 = (Card 3, Merchant 2), Associated

[0118] e4 = (Card 4, Merchant 2), Associated

[0119] e5 = (Card 5, Merchant 2), Associated

[0120] S3: Extract multi-source risk features from standardized transaction data and heterogeneous transaction graphs, including:

[0121] S301: Based on the transaction time and transaction amount information in the standardized transaction data, the historical behavioral changes of the transaction entities are statistically analyzed according to multiple time scales to generate time-series behavioral risk characteristics;

[0122] S302: Based on the heterogeneous transaction graph, community segmentation is performed to obtain the community structure to which the transaction entity belongs, and community structure risk characteristics are generated based on the node connection relationship and transaction behavior statistics within the community.

[0123] S303: Use a heterogeneous graph neural network to learn node representations of the heterogeneous transaction graph, and generate graph embedding representations of card nodes and merchant nodes through neighborhood information propagation and aggregation.

[0124] The specific steps of S301 are as follows:

[0125] S3101: Set the length of multiple sliding time windows in This is a set of preset window lengths.

[0126] In this embodiment, the following settings are provided:

[0127] S3102: For each card node c∈V card The time t of its i-th transaction i Based on the historical transactions within the backtracking window W, the following time-series characteristics are calculated: transaction frequency f c，W (ti); Total amount s c，W (t i ); Average amount μ c，W (t i ) = s c，W (t i ) / max(1,f c，W (t i Standard deviation of amount σ c，W (t i ); the percentage increase in amount r c，W (t i ) = amt i / μ c，W (t i If μ c，W (t i If ) = 0, then r c，W (ti)=amt i .

[0128] In this embodiment, the third transaction of card 1 (e3, time 10:30) is used as the benchmark:

[0129] Within the 1-hour retrospective window (9:30-10:30), Card 1's historical transactions include e1 (10:00), therefore: f 卡1，1h (10:30)=1,s 卡1，1h (10:30)=50,μ 卡1，1h (10:30)=50, r=200 / 50=4.0.

[0130] S3103: Calculate behavioral temporal characteristics: Time interval from the previous transaction: Δt last =t i -t i-1 Nighttime trading sign The sudden transaction indicator isBurst(t) i )=1{f c，1h (t i )≥θ burst}, where t i-1 The timestamp of the last transaction on the same card node. Let θ be a preset set of nighttime periods, 1{·} be an indicator function, and θ be a preset set of nighttime periods. burst This is a preset burst threshold.

[0131] In this embodiment:

[0132] Time interval since the last transaction: Δt last =10:30 - 10:00 = 30 minutes

[0133] Trading hours are 10:30 AM, not during the nighttime hours. Therefore, isNight = 0

[0134] Preset burst threshold θ burst =3, f 卡1，1h =1 < 3, therefore isBurst = 0

[0135] S3104: Concatenate all the above time-series features into a time-series behavioral risk feature vector. Where d time This represents the total dimension of the time-series features.

[0136] In this embodiment, x time It is composed of features such as frequency, total amount, mean amount, standard deviation of amount, sudden increase rate of amount, time interval, nighttime indicator, and sudden event indicator.

[0137] Step S302 specifically involves:

[0138] S3201: Perform community partitioning on the heterogeneous transaction graph G and define the modularity:

[0139]

[0140] Where M = |E| is the total number of sides, A ij Let k be the edge weight between nodes i and j. i =∑ j A ij Let be the degree of node i, com(i) be the community label of node i, and δ(·,·) be the characteristic function.

[0141] In this embodiment, graph G has 5 edges, and the edge weight is A. ij =1 (no multiple edges), the degree of each node is: k 卡1 =2, k 卡2=2, k 卡3 =1, k 商户1 =2, k 商户2 =3.

[0142] S3202: Iterate and optimize until the modularity Q no longer increases, and output the community tag for each node.

[0143] In this embodiment, after iterative optimization using the Louvain algorithm, two communities are obtained: community C1 = {card 1, card 2, merchant 1} and community C2 = {card 3, merchant 2}.

[0144] Node community tags: com(card1) = C1, com(card2) = C1, com(card3) = C2, com(merchant1) = C1, com(merchant2) = C2.

[0145] S3203: For each community C, calculate the following statistical characteristics: historical risk trading ratio ρ C Community density δ C Time concentration τ C Nighttime trading ratio v C Card quotient γ C .

[0146] In this embodiment:

[0147] For community C1: there were a total of 3 transactions (e1, e2), and 0 fraudulent transactions. Community density Card Merchant Other features are calculated similarly.

[0148] For community C2: There are a total of 2 transactions (there are actually 3 transactions in e3, e4, and e5, but card 3 is only connected to merchant 2, which needs to be verified). This embodiment simplifies the process.

[0149] S3204: For the transaction edge to be detected, e = (c, m), if com(c) = com(m), then let Otherwise, community structure risk characteristics are generated according to the preset strategy.

[0150] In this embodiment, for transaction edge e3 = (card 1, merchant 2), com(card 1) = C1, com(merchant 2) = C2, the two are not equal, therefore...

[0151] Step S303 specifically involves:

[0152] S3301: The heterogeneous transaction graph G is encoded using a heterogeneous graph neural network.

[0153] S3302: For card node c and merchant node m, the original node features are mapped to a unified latent space through independent linear projection layers:

[0154]

[0155] Where x c x m W represents the original feature vector of a node, which is obtained by statistically analyzing all historical transaction records associated with that node. card W merch It is a learnable projection matrix.

[0156] In this embodiment, let the projected dimension d be... h =8, each node obtains its initial representation.

[0157] S3303: For the l-th layer (l = 1, 2, ..., L), each node v aggregates the features of its neighboring nodes N(v) and updates its own representation:

[0158]

[0159] Where AGGREGATE is the preset aggregation function, σ(·) is the activation function, and W (l) Let be the learnable weight matrix for the l-th layer.

[0160] In this embodiment, L = 2, the aggregation function is the mean aggregation (MEAN), and the activation function is ReLU.

[0161] S3304: After L layers of graph convolution, the graph embedding representation of each card node c is obtained. Graph embedding representation of each merchant node m Where d is the preset embedding dimension.

[0162] In this embodiment, d = 4. After two layers of graph convolution, the graph embedding representation of each node is obtained (example values): z 卡1 =[0·2,-0.1,0.5,0.3],z 卡2 =[0·1,-0.2,0.4,0.2],z 卡3 =[-0.3, 0.1, -0.2, 0.1], z 商户1 =[0.15,-0.15,0.45,0.25],z 商户2 = [-0.2, 0.05, -0.1, 0.15].

[0163] S4: For the transaction to be detected, obtain the card node graph embedding representation, merchant node graph embedding representation, basic transaction attribute features, temporal behavior risk features, and community structure risk features corresponding to the transaction;

[0164] The structural interaction information of the two parties in the transaction is obtained by performing node embedding concatenation, node embedding difference calculation and node embedding element-wise multiplication operation. The structural interaction information is then fused with basic transaction attribute features, temporal behavioral risk features and community structural risk features to obtain a boundary-level hybrid risk feature vector.

[0165] Specifically,

[0166] S401: For the transaction to be detected, e = (c, m), obtain the card node graph embedding representation z corresponding to the transaction. c Merchant node graph embedding representation z m Basic transaction attribute characteristics x base Time-series behavioral risk characteristics x time and community structure risk characteristics x com .

[0167] In this embodiment, taking the transaction to be detected, e3 = (card 1, merchant 2), as an example: 卡1 =[0.2,-0.1,0.5,0.3],z 商户2 =[-0.2, 0.05, -0.1, 0.15], x base =[200, 10:30, 1] T x time x is calculated from S3104. com =0.

[0168] S402: Obtain the structural interaction information between the transacting parties through the following operations: (a) Embedding and splicing: z c ||z m (b), Embedding difference: z c -z m (c) Embedded element-wise product: z c ⊙z m .

[0169] In this embodiment: z 卡1 ||z 商户2 =[0.2,-0.1,0.5,0.3,-0.2,0.05,-0.1,0.15],z 卡1 -z 商户2 =[0.4,-0.15,0.6,0.15],z 卡1 ⊙z 商户2 = [-0.04, -0.005, -0.05, 0.045].

[0170] S403: The structural interaction information is fused with the basic transaction attribute features, time-series behavioral risk features, and community structure risk features to obtain a boundary-level hybrid risk feature vector:

[0171]

[0172] Where D = 4d + d base +d time +5.

[0173] In this embodiment, d = 4, let d base =3,d time =8, therefore D = 4×4 + 3 + 8 + 5 = 32.

[0174] S5: Input the edge-level mixed risk feature vector into the gradient boosting tree classification model, and output the fraud probability corresponding to the transaction to be detected through the gradient boosting tree classification model. Specifically,

[0175] S501: The edge-level mixed risk feature vector x hybrid Input gradient boosting tree classification model Output the fraud probability of the transaction to be detected.

[0176] In this embodiment, the input x hybrid Afterwards, the model outputs a fraud probability p = 0.87.

[0177] S502: The gradient boosting tree classification model is a lightweight gradient boosting machine, and its optimization objective in the t-th iteration is:

[0178]

[0179] Where l(·,·) is the loss function, f is the predicted value for the first t-1 rounds. t Let w be the decision tree added in round t, where T is the number of leaf nodes. j Let be the weight of the j-th leaf node, and γ and λ be the regularization coefficients. Let be the edge-level mixed risk feature vector corresponding to the i-th transaction sample.

[0180] In this embodiment, the model has completed parameter learning on the training set, and directly outputs the probability during the inference stage.

[0181] S6: To address the imbalance between fraudulent and legitimate transaction samples, a multi-strategy collaborative optimization approach combining sample augmentation, loss function adjustment, and classification threshold optimization is used to optimize the model training and inference processes. Specifically, in this embodiment:

[0182] Sample augmentation: The SMOTE oversampling algorithm is used to synthesize fraudulent samples, generating new samples that are added to the training set. In this embodiment, the training set contains 2 fraudulent samples and 3 normal samples; after oversampling, the number of fraudulent samples is increased to 3.

[0183] Loss function adjustment: Focal Loss is used instead of standard cross-entropy loss, and its expression is FL(p t )=-α t (1-p t ) γ log(p t ), where p t =y·p+(1-y)·(1-p), α t The category balance factor (in this embodiment, α is set as α) t =5), where γ is the focusing parameter (in this embodiment, γ = 2.0).

[0184] Classification threshold optimization: Search for the optimal decision threshold θ on the validation set with the goal of maximizing the F1 score. * During the inference phase, the fraud probability p output by the model is compared with θ. * Comparison, if p≥θ * If the transaction is fraudulent, it is considered a legitimate transaction; otherwise, it is considered a legitimate transaction. In this embodiment, θ is obtained through the search. * =0.5, p=0.87≥0.5, judged as fraudulent transaction, consistent with the real label.

[0185] Example 2: In the field of credit card fraud detection, experiments on publicly available datasets are an important means of verifying the effectiveness and superiority of new methods. Real-world credit card transaction data is characterized by large sample sizes (hundreds of thousands to millions), extreme class imbalance (fraud rate is usually less than 5%), and the covert nature of fraudulent behavior, which often exhibits a trend towards organized groups. Traditional single models struggle to simultaneously capture both individual behavioral anomalies and group-related risks.

[0186] Therefore, this embodiment uses the IEEE-CIS FraudDetection public dataset and conducts systematic comparative experiments to quantitatively evaluate the improvement effect of the method of the present invention on the core indicators compared with the prior art (single GNN model, hybrid model without community features), so as to prove the effectiveness and superiority of the method of the present invention. It should be emphasized that the method steps used in this embodiment are basically the same as those in Embodiment 1, and will not be repeated here.

[0187] The IEEE-CIS Fraud Detection dataset originates from the fraud detection competition held by Kaggle in 2019, with real transaction records provided by Vesta. Combined with... Figure 4 and Figure 5As can be seen, the dataset contains 590,540 transaction records, of which 20,663 are fraudulent, accounting for approximately 3.5%, representing a typical extremely imbalanced classification scenario. The data includes a transaction information table (Transaction) and an identity information table (Identity), linked by TransactionID. Original features include transaction amount (TransactionAmt), relative timestamp (TransactionDT), product type (ProductCD), card number (card1), and merchant ID (merchantid), etc.

[0188] Stratified sampling was used to divide the training, validation, and test sets in a ratio of 7:1.5:1.5 to ensure that the proportion of fraudulent samples in each set was consistent with the original distribution. The heterogeneous graph neural network used was HeteroGraphSAGE, with a hidden layer dimension of 128, an output embedding dimension of 64, two graph convolutional layers, and a dropout rate of 0.3. LightGBM had a maximum of 2000 iterations and a minimum of 100 early stopping iterations. Evaluation metrics included area under the curve (AUC-ROC), average precision (AP), precision, recall, and F1 score.

[0189] Under the parameter configuration of this embodiment, the experimental results are shown in Table 2:

[0190] Table 2 shows the performance comparison results between the method of the present invention and the existing method in Example 2.

[0191] GraphSAGE (Single GNN) 0.9428 0.5574 0.2329 0.8202 0.3628 GraphSAGE+LightGBM 0.9805 0.8182 0.3982 0.9056 0.5532 This invention (full architecture) 0.9886 0.9138 0.9093 0.8152 0.8597

[0192] Experimental results show that:

[0193] (1) Effectiveness of the decoupled hybrid architecture: Compared with the single GraphSAGE model, the GraphSAGE+LightGBM hybrid architecture proposed in this invention improves the AP index from 0.5574 to 0.8182, an improvement of more than 46%, which verifies the rationality of decoupling graph structure learning and classification.

[0194] (2) Gains from community features: After adding community-level statistical features, the model precision increased significantly from 0.3982 to 0.9093, an increase of more than 128%, and the F1 score increased from 0.5532 to 0.8597, an increase of more than 55%. This shows that community-level features can significantly reduce the false alarm rate and effectively identify group fraud.

[0195] (3) Effectiveness of multi-strategy collaborative optimization: After multi-strategy optimization including SMOTE oversampling, FocalLoss and threshold search, the model maintains a high recall (0.8152) while the precision is significantly improved and the F1 score reaches 0.8597.

[0196] This embodiment fully demonstrates the effectiveness and superiority of the proposed method on real large-scale datasets. All core evaluation indicators are significantly better than the comparative schemes, verifying the technical advantages of this invention in solving class imbalance, identifying gang fraud, and utilizing time-series features.

[0197] Example 3: Transforming fraud detection methods from theoretical models into practically deployable software systems, such as... Figure 6 As shown, this is a key step in realizing the technological value. In actual risk control operations, financial institutions require an end-to-end system capable of automatically completing data access, feature extraction, model inference, and result output, while simultaneously meeting the requirements of real-time performance, interpretability, and maintainability. Therefore, this embodiment provides a graph-tree decoupled fusion credit card fraud detection system, demonstrating the structure, function, and connection relationships of each module, and illustrating how the system transforms the method of this invention into a practically deployable technical solution.

[0198] like Figure 2 As shown, the system includes a heterogeneous graph construction and preprocessing module (1), a multi-scale temporal feature extraction module (2), a heterogeneous graph representation learning module (3), a community detection and risk perception module (4), a bi-branch feature fusion module (5), a gradient boosting tree classification decision module (6), and a multi-strategy collaborative optimization training module (7). The data flow and control relationships between the modules are as follows:

[0199] Data input stage: The raw credit card transaction data enters the heterogeneous graph construction and preprocessing module (1). After being processed sequentially by the data acquisition unit (11), the data processing unit (12), and the graph structure generation unit (13), standardized transaction data and heterogeneous transaction graphs are output. The output of this module is connected to modules (2), (3), (4), and (5), respectively.

[0200] Parallel feature extraction stage:

[0201] Module (2) receives standardized transaction data, its time window management unit (21) sets multi-scale windows, the behavior statistics unit (22) calculates statistics such as transaction frequency and amount changes in each window, and the time series feature generation unit (23) outputs time series behavior risk features to module (5).

[0202] Module (3) receives a heterogeneous transaction graph. Its node feature mapping unit (31) performs type-aware projection on card nodes and merchant nodes. The graph information propagation unit (32) aggregates neighborhood information through a heterogeneous graph neural network. The node representation output unit (33) outputs the graph embedding representation of each node to module (5).

[0203] Module (4) receives the heterogeneous transaction graph. Its community division unit (41) uses the Louvain algorithm to determine the transaction community structure. The community risk statistics unit (42) calculates the fraud rate, density, card merchant ratio and other statistical information of each community. The community feature matching unit (43) outputs the community structure risk features to module (5) according to the community to which the corresponding node of the transaction to be detected belongs.

[0204] Feature fusion and decision-making stage: Module (5) receives basic transaction attribute features from module (1), time series features from module (2), graph embedding representation from module (3), and community features from module (4). Its graph interaction feature generation unit (51) calculates embedding concatenation, embedding difference, and element-wise embedding product. The hybrid feature fusion unit (52) concatenates all features into a side-level hybrid risk feature vector and outputs it to module (6). The classification prediction unit (61) of module (6) calculates the fraud probability through the LightGBM model. The risk output unit (62) outputs the risk judgment result according to the optimal decision threshold.

[0205] Training optimization phase: Module (7) performs multi-strategy collaborative optimization during model training. Data optimization unit (71) uses the SMOTE algorithm to perform class balance processing on training samples; model optimization unit (72) sets the loss function to Focal Loss; decision optimization unit (73) searches for the optimal decision threshold on the validation set and feeds it back to module (6).

[0206] Taking the small-scale transaction network in Example 1 as an example, the workflow of this system is as follows:

[0207] (1) Heterogeneous graph construction and preprocessing module (1) Read 5 transaction records, output standardized data, and construct a heterogeneous transaction graph containing 3 card nodes, 2 merchant nodes and 5 transaction edges.

[0208] (2) Multi-scale temporal feature extraction module (2) Taking card 1 as the analysis object, calculate the temporal features such as transaction frequency, average amount, and sudden increase rate of amount within a 1-hour window, and output x time .

[0209] (3) Heterogeneous graph representation learning module (3) encodes the heterogeneous graph and outputs the graph embedding representation z of each node. 卡1 , z 卡2 , z 卡3 , z 商户1 , z商户2 .

[0210] (4) Community Detection and Risk Perception Module (4) Executes the Louvain algorithm and outputs the community segmentation results and corresponding community characteristics. For the transaction edge (card 1, merchant 2), since the two endpoints belong to different communities, the output x com =0.

[0211] (5) The dual-branch feature fusion module (5) fuses the above features into a side-level mixed risk feature vector x. hybrid .

[0212] (6) Gradient boosting tree classification decision module (6) outputs fraud probability p = 0.87, which is related to the optimal threshold θ. * The value of 0.5 indicates a fraudulent transaction.

[0213] This system can also be deployed in the following scenarios:

[0214] Real-time transaction risk control: The system is embedded into the transaction processing chain of banks or payment institutions to complete the fraud risk assessment before transaction authorization, and the response time can be controlled in milliseconds.

[0215] Offline batch analysis: Perform retrospective analysis on historical transaction data to identify known and unknown fraud patterns for model iteration and risk control rule optimization.

[0216] Suspicious community mining: The community risk ranking output by the community detection and risk perception module (4) helps risk control personnel to locate high-risk trading groups and implement targeted control.

[0217] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes in form and detail can be made thereto without departing from the scope defined by the claims of the present invention.

Claims

1. A graph-tree decoupled fusion method for credit card fraud detection, characterized in that, Includes the following steps: S1: Obtain historical transaction data, preprocess the historical transaction data to obtain standardized transaction data; wherein, the standardized transaction data includes transaction entity information and basic transaction attribute information, the transaction entity information includes at least card identification information and merchant identification information, and the basic transaction attribute information includes at least transaction amount, transaction time and transaction category information; S2: Construct a heterogeneous transaction graph composed of card nodes and merchant nodes based on the standardized transaction data; wherein, the transaction entity corresponding to the card identifier is represented as a card node, the transaction entity corresponding to the merchant identifier is represented as a merchant node, and the transaction behavior between the card node and the merchant node is represented as a transaction edge connecting the two types of nodes; S3: Extract multi-source risk features from standardized transaction data and heterogeneous transaction graphs, including: Based on the transaction time and transaction amount information in the standardized transaction data, the historical behavioral changes of the transaction entities are statistically analyzed according to multiple time scales to generate time-series behavioral risk characteristics. Based on the heterogeneous transaction graph, communities are divided to obtain the community structure to which the transaction entities belong, and community structure risk characteristics are generated according to the node connection relationship and transaction behavior statistics within the community. The heterogeneous graph neural network is used to learn node representations of the heterogeneous transaction graph, and graph embedding representations of card nodes and merchant nodes are generated through neighborhood information propagation and aggregation. S4: For the transaction to be detected, obtain the card node graph embedding representation, merchant node graph embedding representation, basic transaction attribute features, temporal behavior risk features, and community structure risk features corresponding to the transaction; The structural interaction information of the two parties in the transaction is obtained by node embedding concatenation, node embedding difference calculation and node embedding element-wise multiplication operation. The structural interaction information is then fused with basic transaction attribute features, temporal behavior risk features and community structure risk features to obtain a side-level hybrid risk feature vector. S5: Input the edge-level mixed risk feature vector into the gradient boosting tree classification model, and output the fraud probability corresponding to the transaction to be detected through the gradient boosting tree classification model; S6: To address the imbalance between fraudulent and normal transaction samples, a multi-strategy collaborative optimization approach combining sample augmentation, loss function adjustment, and classification threshold optimization is adopted to optimize the model training and inference process.

2. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, characterized in that, Step 51 specifically involves: S101: Obtain historical credit card transaction dataset Where r i For the i-th transaction record, y i ∈{0,1} represents the fraud label, and N is the total number of transaction records; S102: For each transaction record r i Field extraction is performed to obtain transaction entity information and basic transaction attribute information; the transaction entity information includes at least the card identifier. i Merchant logo merch i The basic transaction attribute information includes at least the transaction amount. Transaction timestamp and transaction category codes S103: Preprocess the raw data; S104: Output standardized transaction data in 3. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, characterized in that, Step S2 specifically involves: S201: Based on standardized transaction data Construct a heterogeneous transaction graph G = (V, E); S202: Represent the transaction entity corresponding to the card identifier as a card node, forming a card node set V. card The transaction entity corresponding to the merchant identifier is represented as a merchant node, forming a merchant node set V. merch Therefore, the total node set V = V card ∪V merch ; S203: Represent each transaction between the card node and the merchant node as a transaction edge connecting the two types of nodes, and set the edge. Each edge e i = (c, m) associated basic transaction attribute feature vector Where d base These are the basic transaction attribute feature dimensions.

4. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, characterized in that, The extraction process of time-series behavioral risk features described in step S3 is as follows: S3101: Set the length of multiple sliding time windows in A set of preset window lengths; S3102: For each card node c∈V card The time t of its i-th transaction i Based on historical transactions within window W, calculate the following time-series characteristics: Transaction frequency; total amount; mean amount; standard deviation of amount; percentage of sudden increase in amount; S3103: Calculate behavioral temporal characteristics: Time interval from the previous transaction: Δt last =t i -t i-1 Nighttime trading sign The sudden transaction indicator isBurst(t) i )=1{f c，1h (t i )≥θ burst }, where t i-1 The timestamp of a transaction on the same card node. Let θ be a preset set of nighttime periods, 1{·} be an indicator function, and θ be a preset set of nighttime periods. burst Preset burst threshold; S3104: Concatenate all the above time-series features into a time-series behavioral risk feature vector. Where d time This represents the total dimension of the time-series features.

5. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, characterized in that, The community structure risk feature extraction process described in step S3 is as follows: S3201: Perform community partitioning on the heterogeneous transaction graph G and define the modularity: Where M = |E| is the total number of sides, A ij Let k be the edge weight between nodes i and j. i =∑ j A ij Let be the degree of node i, com(i) be the community label of node i, and δ(·,·) be the characteristic function; S3202: Iterate and optimize until the modularity Q no longer increases, and output the community tag for each node; S3203: For each community C, calculate the following statistical characteristics: historical risk trading ratio ρ C Community density δ C Time concentration τ C Nighttime trading ratio v C Cardiac ratio γ C ; S3204: For the transaction edge to be detected, e = (c, m), if com(c) = com(m), then let Otherwise, community structure risk characteristics are generated according to the preset strategy.

6. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 5, characterized in that, The community segmentation described in step S3201 uses the Louvain community detection algorithm.

7. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, characterized in that, The graph embedding representation learning process described in step S3 is as follows: S3301: The heterogeneous transaction graph G is encoded using a heterogeneous graph neural network; S3302: For card node c and merchant node m, the original node features are mapped to a unified latent space through independent linear projection layers: Where x c x m W represents the original feature vector of a node, which is obtained by statistically analyzing all historical transaction records associated with that node. card W merch For learnable projection matrix; S3303: For the l-th layer, each node v aggregates the features of its neighboring nodes N(v) and updates its own representation: Where AGGREGATE is the preset aggregation function, σ(·) is the activation function, and W (l) Let be the learnable weight matrix for the l-th layer, where l = 1, 2, ..., L; S3304: After L layers of graph convolution, the graph embedding representation of each card node c is obtained. Graph embedding representation of each merchant node m Where d is the preset embedding dimension.

8. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, characterized in that, Step S4 specifically involves: S401: For the transaction to be detected, e = (c, m), obtain the card node graph embedding representation z corresponding to the transaction. c Merchant node graph embedding representation z m Basic transaction attribute characteristics x base Time-series behavioral risk characteristics x time and community structure risk characteristics x com ; S402: Obtain the structural interaction information between the transacting parties through the following operations: (a) Embedding and splicing: z c ||z m (b) Embedding difference: z c -z m (c) Embedded element-wise product: z c ⊙z m ; S403: The structural interaction information is fused with the basic transaction attribute features, time-series behavioral risk features, and community structure risk features to obtain a boundary-level hybrid risk feature vector: Where D = 4d + d base +d time +5.

9. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, characterized in that, Step S5 specifically involves: S501: The edge-level mixed risk feature vector x hybrid Input gradient boosting tree classification model Output the fraud probability of the transaction to be detected. S502: The gradient boosting tree classification model is a lightweight gradient boosting machine (LightGBM), and its optimization objective in the t-th iteration is: Where l(·,·) is the loss function, f is the predicted value for the first t-1 rounds. t Let w be the decision tree added in round t, where T is the number of leaf nodes. j Let be the weight of the j-th leaf node, and γ and λ be the regularization coefficients. Let be the edge-level mixed risk feature vector corresponding to the i-th transaction sample.

10. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, characterized in that, The sample augmentation involves using the SMOTE oversampling algorithm to synthesize fraudulent samples and generate new samples to be added to the training set. The loss function adjustment includes using the FocalLoss loss function or constructing corresponding first-order and second-order gradient forms based on FocalLoss as the optimization objective of the gradient boosting tree model. The classification threshold optimization involves searching for the optimal decision threshold θ* on the validation set with the goal of maximizing the F1 score. During the inference phase, the fraud probability p output by the model is compared with θ*. If p ≥ θ*, the transaction is judged as fraudulent; otherwise, it is judged as a normal transaction.

11. The credit card fraud detection method based on graph-tree decoupling and fusion according to claim 1, wherein the heterogeneous graph neural network is a heterogeneous graph sampling and aggregation network (HeteroGraphSAGE) or a heterogeneous graph attention network (HeteroGAT).

12. A graph-tree decoupled fusion credit card fraud detection system, characterized in that, include: Heterogeneous graph construction and preprocessing module (1), multi-scale temporal feature extraction module (2), heterogeneous graph representation learning module (3), community detection and risk perception module (4), bi-branch feature fusion module (5), gradient boosting tree classification decision module (6), and multi-strategy collaborative optimization training module (7); The heterogeneous graph construction and preprocessing module (1) includes a data acquisition unit (11), a data processing unit (12), and a graph structure generation unit (13) connected in series. Among them, the data acquisition unit (11) is used to acquire historical credit card transaction data, the data processing unit (12) is used to process missing values, encode and convert and standardize features of historical credit card transaction data to obtain standardized transaction data and basic transaction attribute features; the graph structure generation unit (13) constructs a heterogeneous transaction graph containing card nodes, merchant nodes and transaction edges according to the transaction subject relationship in the standardized transaction data. The output of the heterogeneous graph construction and preprocessing module (1) is connected to the multi-scale temporal feature extraction module (2), the heterogeneous graph representation learning module (3), the community detection and risk perception module (4), and the dual-branch feature fusion module (5), respectively. The multi-scale temporal feature extraction module (2) includes a time window management unit (21), a behavior statistics unit (22), and a temporal feature generation unit (23) connected in series. Among them, the time window management unit (21) is used to establish time windows of multiple scales based on transaction time information; the behavior statistics unit (22) is used to statistically analyze the transaction frequency, transaction amount changes and transaction behavior changes of the transaction subjects within different time windows; the time series feature generation unit (23) generates time series behavior risk features based on the statistical results and outputs them to the dual-branch feature fusion module (5); The heterogeneous graph representation learning module (3) includes a node feature mapping unit (31), a graph information propagation unit (32), and a node representation output unit (33) connected in series. Among them, the node feature mapping unit (31) is used to map the initial features of different types of nodes; the graph information propagation unit (32) uses a heterogeneous graph neural network to perform neighborhood information aggregation and node state update on the heterogeneous transaction graph; the node representation output unit (33) outputs the graph embedding representations corresponding to card nodes and merchant nodes and sends them to the dual-branch feature fusion module (5); The community detection and risk perception module (4) includes a community segmentation unit (41), a community risk statistics unit (42), and a community feature matching unit (43) connected in series. Among them, the community division unit (41) is used to determine the transaction community structure based on the node connection relationship in the heterogeneous transaction graph; the community risk statistics unit (42) is used to calculate the structural risk statistics information corresponding to each transaction community; the community feature matching unit (43) generates the corresponding community structure risk features based on the community to which the node of the transaction to be detected belongs, and outputs them to the dual-branch feature fusion module (5). The dual-branch feature fusion module (5) includes a graph interaction feature generation unit (51) and a hybrid feature fusion unit (52) connected in series. Among them, the graph interaction feature generation unit (51) calculates the structural interaction relationship between nodes based on the graph embedding representation of the nodes at both ends of the transaction to be detected; the hybrid feature fusion unit (52) is used to fuse the structural interaction relationship, basic transaction attribute features, temporal behavior risk features and community structure risk features to generate a side-level hybrid risk feature vector, and the output end is connected to the gradient boosting tree classification decision module (6). The gradient boosting tree classification decision module (6) includes a classification prediction unit (61) and a risk output unit (62) connected in series. Among them, the classification prediction unit (61) is used to receive the edge-level mixed risk feature vector and calculate the fraud probability corresponding to the transaction to be detected through the gradient boosting tree model; the risk output unit (62) outputs the transaction risk judgment result according to the fraud probability and the preset decision strategy. The multi-strategy collaborative optimization training module (7) includes a sample optimization unit (71), a model optimization unit (72), and a decision optimization unit (73); Among them, the data optimization unit (71) is connected to the dual-branch feature fusion module (5) and is used to perform class balancing on the generated side-level mixed risk feature samples; the model optimization unit (72) is connected to the gradient boosting tree classification decision module (6) and is used to adjust the training objective of the classification model; the decision optimization unit (73) is connected to the gradient boosting tree classification decision module (6) and is used to determine the optimal classification threshold and feed it back to the risk output process.

Images