Learning device, learning method, and program
The learning device enhances fraud detection by training a model to recognize rare attribute value combinations, allowing it to identify novel fraud scenarios that were previously undetectable.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Patents
- Current Assignee / Owner
- NEC CORP
- Filing Date
- 2023-02-02
- Publication Date
- 2026-07-22
AI Technical Summary
Existing fraud detection methods using graph link prediction technology struggle to accurately detect new fraud that is not present in the learning data.
A learning device and method that adds small-number combination links to attribute values with rare combinations in the training data to train a fraud prediction model, enabling it to detect novel fraud by leveraging unique characteristics of these combinations.
Enables the generation of a machine learning model capable of detecting new fraud that was not present in the learning data, improving the accuracy of fraud detection.
Smart Images
Figure 0007893319000001 
Figure 0007893319000002 
Figure 0007893319000003
Abstract
Description
Technical Field
[0001] This disclosure relates to unauthorized prediction.
Background Art
[0002] Conventionally, using a machine learning model based on a knowledge graph composed of a set of nodes and a set of edges between those nodes, the relationship between nodes has been predicted. Such a technique is also called graph link prediction technology, and graph link prediction technology is used for fraud detection, product recommendations, and the like.
[0003] The learning of a machine learning model based on the above knowledge graph is proposed in Patent Document 1.
Prior Art Documents
Patent Documents
[0004]
Patent Document 1
Summary of the Invention
Problems to be Solved by the Invention
[0005] In fraud detection using graph link prediction technology, there may be cases where it is desired to detect new fraud that does not exist in the learning data. In such cases, it is not always possible to detect fraud with high accuracy even by the method of Patent Document 1.
[0006] One object of the present disclosure is to provide a learning device capable of generating a machine learning model capable of detecting new fraud that does not exist in the learning data.
Means for Solving the Problems
[0007] In one aspect of the present disclosure, the learning device is A means for acquiring training data that represents attribute values as nodes and acquires graph data as training data that includes multiple attribute values and links indicating the relationships between attribute values, A learning-type small-number combination detection means that adds a small-number combination link to attribute values that have a small number of combinations in the learning data, A learning means for training a fraud prediction model that predicts the presence or absence of fraud using training data including the aforementioned small number of combination links, It is equipped with.
[0008] From another perspective of this disclosure, the prediction device, A means for acquiring data to be judged, which represents attribute values as nodes and acquires graph data including multiple attribute values and links indicating the relationships between attribute values as data to be judged, A determination-type small number of combinations detection means adds a small number of combination links to attribute values that have a small number of combinations included in the data to be determined, to indicate that the number of combinations is small. Fraud prediction means that predicts fraud in the data to be judged, including the few combination links, using a fraud prediction model trained by the learning device described in claim 1, It is equipped with.
[0009] In other aspects of this disclosure, Executed by a computer The learning method is, Attribute values are represented as nodes, and graph data containing multiple attribute values and links indicating the relationships between attribute values is obtained as training data. For attribute values in the aforementioned training data where the number of attribute value combinations is small, a small number of combination links is added to indicate that the number of combinations is small. Using the training data containing the aforementioned small number of link combinations, a fraud prediction model is trained to predict whether or not fraud is occurring.
[0010] In other aspects of this disclosure, program teeth, Attribute values are represented as nodes, and graph data containing multiple attribute values and links indicating the relationships between attribute values is obtained as training data. Add a small combination link indicating that the number of combinations is small between attribute values for which the number of combinations of attribute values included in the learning data is small. Cause a computer to execute a process of learning an anomaly prediction model that predicts the presence or absence of anomalies using the learning data including the small combination link.
Effect of the Invention
[0011] According to the present disclosure, it becomes possible to generate a machine learning model that can detect new anomalies not present in the learning data's abnormal examples.
Brief Description of Drawings
[0012] [Figure 1] It is a diagram conceptually showing the learning data of the first embodiment. [Figure 2] It is a diagram conceptually showing the prediction result by the prediction model of the first embodiment. [Figure 3] It is a diagram conceptually showing the learning data and determination data including small combinations. [Figure 4] It shows the overall configuration of the learning device according to the first embodiment. [Figure 5] It is a block diagram showing the hardware configuration of the learning device of the first embodiment. [Figure 6] It is a diagram showing the functional configuration of the learning device of the first embodiment. [Figure 7] It shows an example of a method for determining small combinations using the appearance ratio. [Figure 8] It shows an example of a method for determining small combinations using the chi-square value. <0000It is a diagram showing the functional configuration of the learning device according to the second embodiment. [Figure 14] It is a flowchart of the processing by the learning device of the second embodiment.
Mode for Carrying Out the Invention
[0013] Hereinafter, referring to the drawings, preferred embodiments of the present disclosure will be described. Note that the present embodiment described below is for detecting unauthorized access to a computer connected to a network, but the method of the present disclosure can be applied to unauthorized detection in various procedures such as various applications, registrations, and approvals. <First Embodiment>
[0014] [Basic Principle] FIG. 1 shows learning data used for learning a machine learning model (hereinafter, also referred to as an “unauthorized prediction model”) used for unauthorized detection. The table data 50 in FIG. 1 shows the learning data in a table. The table data 50 includes an attribute name 51 and an attribute value 52. The attribute name 51 is an item of the table data 50 and includes an access ID, access information, unauthorized possibility, and the like. The “access ID” is an ID for uniquely identifying access information. The “unauthorized possibility” is a label indicating the correct answer as to whether the access related to the access ID is unauthorized access. When the access is unauthorized access, an “unauthorized” label is assigned. The attribute value 52 is a value corresponding to the attribute name 51, and a value is input for each access ID.
[0015] The graph data 60 in Figure 1 represents the training data as a knowledge graph. The graph data 60 includes relations 61, nodes 62, and links 63. Nodes 62 correspond to attribute values in table data 50. Links 63 indicate connections between attribute values. Relations 61 indicate relationships between attribute values. Relationships between attribute values are represented by the attribute names in table data 50. For example, in graph data 60, link 63 is attached between access ID "101" and attribute value "A1", indicating that the relationship is "access destination IP address". The fraud prediction model learns the relationship between attribute values and relationships between attributes and the presence or absence of fraudulent access based on the graph data 60.
[0016] Figure 2 shows the prediction results using the fraud prediction model. The fraud prediction model can take the graph data 65 to be judged as input and output whether or not the access related to the graph data 65 is fraudulent access.
[0017] The fraud prediction model described above predicts fraudulent access if the graph data being judged (hereinafter also referred to as "judgment data") has attribute values similar to the training data that has been labeled as fraudulent. Therefore, it was difficult to detect fraud when the judgment data did not have attribute values similar to the training data.
[0018] However, even if the judgment data does not have attribute values similar to the training data, the combination of attribute values in the judgment data may have unique characteristics. For example, if the combination of attribute values included in the judgment data is a rare combination, there is a high probability that the access related to that judgment data is unauthorized access. Therefore, in this embodiment, information that there are few combinations of attribute values (hereinafter also referred to as "rare combinations") is used as a feature to train the fraud prediction model. This makes it possible to detect novel fraud that is not present in the fraud examples of the training data.
[0019] Figure 3 shows an example of graph data containing a small number of combinations. In Figure 3(A), the information that there are a small number of combinations between the destination port number and the source IP address is used as one of the features of unauthorized access. For example, the combination of attribute value "B1" and attribute value "C1" is a small number of combinations in the entire training data. Therefore, a small number of combination links is added between attribute value "B1" and attribute value "C1". A small number of combination links includes a link 63a that connects the attribute values and a relation 61a that indicates the relationship that the attribute values are a small number of combinations. The fraud prediction model learns the relationship between the combination of attribute values to which the small number of combination links are attached and the presence or absence of fraud. Figure 3(B) shows the results of fraud prediction using small number of combinations. The graph data 65a to be judged is judgment data for a new case and does not have attribute values similar to the training data that has been labeled as fraudulent. However, the attribute values "Bn" and "Cn" included in the graph data 65a are a small number of combinations. Therefore, fraud prediction models can perform fraud predictions based on the fact that the attribute values "Bn" and "Cn" are in only a few combinations.
[0020] [Learning device] (Overall structure) Figure 4 shows the overall configuration of the learning device 100 according to this embodiment. Graph data is input to the learning device 100 as learning data. First, the learning device 100 determines whether or not there are any minority combinations in the input graph data. If there are minority combinations, the learning device 100 adds minority combination links between their attribute values. Then, the learning device 100 generates a fraud prediction model using the graph data including the minority combination links. The setting information input to the learning device 100 is information regarding the method for detecting minority combinations from the graph data, which will be described later.
[0021] (Hardware configuration) Figure 5 is a block diagram showing the hardware configuration of the learning device 100. As shown in the figure, the learning device 100 includes an interface (IF) 111, a processor 112, a memory 113, a recording medium 114, a database (DB) 115, and an input unit 116.
[0022] IF111 performs data input and output with external devices. Specifically, the learning device 100 acquires training data through IF111. The fraud prediction model generated by the learning device 100 is output to external devices through IF111 as needed.
[0023] The processor 112 is a computer such as a CPU (Central Processing Unit) and controls the entire learning device 100 by executing a pre-prepared program. Specifically, the processor 112 executes the fraud prediction model generation process, which will be described later.
[0024] Memory 113 consists of ROM (Read Only Memory), RAM (Random Access Memory), and other components. Memory 113 is also used as working memory during the execution of various processes by the processor 112.
[0025] The recording medium 114 is a non-volatile, non-temporary recording medium such as a disk-shaped recording medium or semiconductor memory, and is configured to be detachable from the learning device 100. The recording medium 114 stores various programs that the processor 112 will execute. When the learning device 100 performs various processes, the programs stored in the recording medium 114 are loaded into the memory 113 and executed by the processor 112.
[0026] DB115 stores training data input through IF111, fraud prediction models generated by the learning device 100, and other such data.
[0027] The input unit 116 is, for example, a keyboard or mouse, and is used by the user to give instructions or input when executing the fraud prediction model generation process described later.
[0028] (Functional Configuration) Figure 6 is a block diagram showing the functional configuration of the learning device 100. Functionally, the learning device 100 includes a data acquisition unit 11, a minority combination counting unit 12, a fraud prediction model learning unit 13, and a fraud prediction model output unit 14.
[0029] The learning device 100 receives learning data and setting information. The setting information is related to the method for determining the number of combinations, and includes information such as the calculation method and threshold for the number of combinations. The content of the setting information is specified by the user. The learning data and setting information are input to the data acquisition unit 11. The data acquisition unit 11 outputs the learning data and setting information to the number of combination count unit 12.
[0030] The decimal combination counting unit 12 determines whether a combination of attribute values included in the training data is a decimal combination. For example, the decimal combination counting unit 12 extracts two attribute values from multiple attribute values corresponding to an access ID. Then, according to the configuration information, the decimal combination counting unit 12 calculates the occurrence rate and chi-squared value of that combination of attribute values. For example, if the configuration information includes using the occurrence rate as the method for calculating decimal combinations and setting the threshold to TH1, the decimal combination counting unit 12 calculates the occurrence rate of the decimal combination and determines that the combination of attribute values is a decimal combination if the calculated value is less than or equal to the threshold TH1. As another example, if the configuration information includes using the chi-squared value as the method for calculating decimal combinations and setting the threshold to TH2, the decimal combination counting unit 12 calculates the chi-squared value of the decimal combination and determines that the combination of attribute values is a decimal combination if the calculated value is greater than or equal to the threshold TH2. Then, based on the determination result, the decimal combination counting unit 12 adds a decimal combination link to the training data. The minority combination counting unit 12 outputs the training data, including minority combination links, to the fraud prediction model training unit 13.
[0031] Figure 7 shows an example of a method for determining minority combinations using occurrence rates. Table data 70 is training data. Equation (1) shows the formula for calculating the occurrence rate of attribute value combinations. Equation (2) calculates the occurrence rate of the combination of attribute value "B1" and attribute value "C1" included in table data 70 as a specific example. The total number of data in table data 70 is 100, and there are 5 combinations of attribute value "B1" and attribute value "C1". Therefore, from equation (2), the occurrence rate of the combination of attribute value "B1" and attribute value "C1" in table data 70 is 0.05. The minority combination counting unit 12 determines that the combination of attribute value "B1" and attribute value "C1" is a minority combination when the occurrence rate is below a predetermined threshold.
[0032] Figure 8 shows an example of a method for determining minority combinations using the chi-squared value. The minority combination counting unit 12 can determine whether a combination of attribute values is a minority combination by examining the presence or absence of a relationship between attribute values using the chi-squared value. The contingency table 80 shows the results of actual observations of attribute values "B1" and "C1". Equation (3) shows the formula for calculating the chi-squared value. Equation (4) shows the formula for calculating the measured frequency of the combination of attribute values "B1" and "C1". Equation (5) shows the formula for calculating the expected frequency of the combination of attribute values "B1" and "C1". The minority combination counting unit 12 determines that the combination of attribute values "B1" and "C1" is a minority combination when the measured frequency is greater than the expected frequency and the chi-squared value is above a predetermined threshold. In the method of Figure 8, if the attribute value is originally a small value, the combination containing that attribute value is not determined to be a minority combination. Therefore, the accuracy of determining minority combinations can be improved.
[0033] In Figures 7 and 8, the decimal combination counting unit 12 determines whether a combination of the destination IP address value and the destination port number value is a decimal combination, but the combinations of attribute values are not limited to these. The decimal combination counting unit 12 may also determine whether a combination of attribute values of other items is a decimal combination, or it may determine whether a combination of all attribute values is a decimal combination.
[0034] The fraud prediction model learning unit 13 acquires training data, including minority combination links, from the minority combination counting unit 12. The fraud prediction model learning unit 13 then generates a fraud prediction model that learns the relationship between the access information and minority combinations included in the training data and fraudulent access. The fraud prediction model learning unit 13 outputs the generated fraud prediction model to the fraud prediction model output unit 14.
[0035] The fraud prediction model output unit 14 outputs the fraud prediction model acquired from the fraud prediction model learning unit 13 to the prediction device 200, which will be described later.
[0036] In the above configuration, the data acquisition unit 11 is an example of a training data acquisition means, the minority combination counting unit 12 is an example of a training minority combination detection means, and the fraud prediction model learning unit 13 and the fraud prediction model output unit 14 are examples of training means.
[0037] (Fraud prediction model generation process) Next, the fraud prediction model generation process will be explained. Figure 9 is a flowchart of the fraud prediction model generation process by the learning device 100. This process is realized when the processor 112 shown in Figure 5 executes a pre-prepared program and operates as each element shown in Figure 6.
[0038] First, learning data and setting information are input to the learning device 100. The learning data and setting information are input to the data acquisition unit 11. The data acquisition unit 11 outputs the learning data and setting information to the decimal combination counting unit 12 (steps S11, S12).
[0039] Next, the minority combination counting unit 12 determines whether the combination of attribute values included in the training data is a minority combination or not. Based on the determination result, the minority combination counting unit 12 adds minority combination links to the training data. The minority combination counting unit 12 outputs the training data including the minority combination links to the fraud prediction model training unit 13 (step S13).
[0040] The fraud prediction model learning unit 13 generates a fraud prediction model based on the training data, which includes a small number of combination links, input from the small number of combination counting unit 12. Specifically, the fraud prediction model learning unit 13 generates a fraud prediction model that learns the relationship between the access information and small number of combinations included in the training data and fraudulent access. The fraud prediction model learning unit 13 outputs the generated fraud prediction model to the fraud prediction model output unit 14 (step S14).
[0041] The fraud prediction model output unit 14 outputs the fraud prediction model acquired from the fraud prediction model learning unit 13 to the prediction device 200 described later (step S15). Then the fraud prediction model generation process ends.
[0042] [Prediction device] (Overall structure) Figure 10 shows the overall configuration of the prediction device 200 according to this embodiment. Judgment data is input to the prediction device 200. First, the prediction device 200 determines whether or not there are minority combinations in the input judgment data. If there are minority combinations, the prediction device 200 adds minority combination links between the attribute values. Then, the prediction device 200 uses a fraud prediction model to predict whether the access related to the judgment data is fraudulent access or not, and outputs the result. The fraud prediction model used by the prediction device 200 is a fraud prediction model generated by the learning device 100. By considering minority combinations, the prediction device 200 can detect novel fraud that is not present in the fraud examples of the learning data.
[0043] (Hardware configuration) Figure 11 is a block diagram showing the hardware configuration of the prediction device 200. As shown in the figure, the prediction device 200 includes an interface (IF) 211, a processor 212, a memory 213, a recording medium 214, a database (DB) 215, an input unit 216, and a display unit 217.
[0044] IF211 performs data input and output with external devices. Specifically, the prediction device 200 acquires judgment data through IF211.
[0045] The processor 212 is a computer such as a CPU (Central Processing Unit) and controls the entire prediction device 200 by executing a pre-prepared program. Specifically, the processor 212 performs fraud detection using a fraud prediction model.
[0046] Memory 213 consists of ROM (Read Only Memory), RAM (Random Access Memory), and other components. Memory 213 is also used as working memory while the processor 212 is executing various processes.
[0047] The recording medium 214 is a non-volatile, non-temporary recording medium such as a disk-shaped recording medium or semiconductor memory, and is configured to be detachable from the prediction device 200. The recording medium 214 stores various programs that the processor 212 executes. When the prediction device 200 performs various processes, the programs stored in the recording medium 214 are loaded into the memory 213 and executed by the processor 212.
[0048] DB215 stores judgment data entered through IF211, as well as prediction results for unauthorized access from the prediction device 200.
[0049] The input unit 216 is, for example, a keyboard or mouse, and is used by the user to give instructions or input when performing fraud detection using a fraud prediction model. The display unit 217 is, for example, a liquid crystal display, and displays the user's operation screen and the prediction results generated by the prediction device 200.
[0050] (Functional Configuration) Figure 12 is a block diagram showing the functional configuration of the prediction device 200. Functionally, the prediction device 200 includes a data acquisition unit 21, a minority combination counting unit 22, a fraud prediction unit 23, and a prediction result output unit 24.
[0051] The prediction device 200 receives judgment data and setting information. The setting information is specified by the user. The setting information is the same as the setting information specified when the fraud prediction model was generated. For example, if the setting information when the fraud prediction model was generated included using the occurrence rate as the method for calculating decimal combinations and setting the threshold to TH1, then the setting information during prediction will also include using the occurrence rate as the method for calculating decimal combinations and setting the threshold to TH1, just as when the fraud prediction model was generated. The judgment data and setting information are input to the data acquisition unit 21. The data acquisition unit 21 outputs the judgment data and setting information to the decimal combination count unit 22.
[0052] The minority combination counting unit 22 determines whether a combination of attribute values included in the judgment data is a minority combination. For example, the minority combination counting unit 22 extracts two attribute values from multiple attribute values included in the judgment data. Then, according to the setting information, the minority combination counting unit 22 calculates the occurrence rate and chi-squared value of that combination of attribute values. Based on the calculated values, the minority combination counting unit 22 determines whether the combination of attribute values is a minority combination. If the minority combination counting unit 22 determines that the combination of attribute values is a minority combination, it adds a minority combination link to the judgment data. The minority combination counting unit 22 outputs the judgment data including the minority combination link to the fraud prediction unit 23.
[0053] The fraud prediction unit 23 acquires judgment data, including a small number of combination links, from the small number of combination count unit 22. The fraud prediction unit 23 then uses the fraud prediction model generated by the learning device 100 to predict whether the access related to the judgment data is fraudulent access or not. The fraud prediction unit 23 outputs the prediction result to the prediction result output unit 24.
[0054] The prediction result output unit 24 generates display data based on the prediction results obtained from the fraud prediction unit 23 and outputs it to the display unit 217 of the prediction device 200.
[0055] In the above configuration, the data acquisition unit 21 is an example of a means for acquiring data to be judged, the minority combination counting unit 22 is an example of a means for detecting minority combinations for judgment, and the fraud prediction unit 23 and the prediction result output unit 24 are examples of fraud detection means.
[0056] <Second Embodiment> Figure 13 is a block diagram showing the functional configuration of the learning device according to the second embodiment. The learning device 300 comprises a learning data acquisition means 311, a learning small number of combinations detection means 312, and a learning means 313.
[0057] Figure 14 is a flowchart of the processing performed by the learning device of the second embodiment. The learning data acquisition means 311 represents attribute values as nodes and acquires graph data as learning data, which includes multiple attribute values and links indicating the relationships between attribute values (step S31). The learning small number combination detection means 312 adds small number combination links to attribute values in the learning data that have a small number of combinations, indicating that the number of combinations is small (step S32). The learning means 313 uses the learning data including the small number combination links to learn a fraud prediction model that predicts whether or not fraud is occurring (step S33).
[0058] According to the learning device 300 of the second embodiment, it is possible to generate a machine learning model that can detect novel frauds that are not present in the fraud examples of the training data.
[0059] Some or all of the above embodiments may also be described as follows, but are not limited to the following:
[0060] (Note 1) A means for acquiring training data that represents attribute values as nodes and acquires graph data as training data that includes multiple attribute values and links indicating the relationships between attribute values, A learning-type small-number combination detection means that adds a small-number combination link to attribute values that have a small number of combinations in the learning data, A learning means for training a fraud prediction model that predicts the presence or absence of fraud using training data including the aforementioned small number of combination links, A learning device equipped with the following features.
[0061] (Note 2) The learning device described in Appendix 1, wherein the minority combination detection means assigns the minority combination links between attribute values whose occurrence rate is below a predetermined threshold.
[0062] (Note 3) The learning device according to Appendix 1, wherein the minority combination detection means assigns the minority combination link to attribute values where the measured frequency of the attribute value combination is greater than the expected frequency, and the chi-squared value of the measured frequency and the expected frequency is greater than or equal to a predetermined threshold.
[0063] (Note 4) The fraud prediction model is a learning device as described in Appendix 1, which is a model that has learned the relationship between graph data including the small number of combination links and the presence or absence of fraud.
[0064] (Note 5) A means for acquiring data to be judged, which represents attribute values as nodes and acquires graph data including multiple attribute values and links indicating the relationships between attribute values as data to be judged, A determination-type small number of combinations detection means adds a small number of combination links to attribute values that have a small number of combinations included in the data to be determined, to indicate that the number of combinations is small. A fraud prediction means that predicts fraud in the target data including the few combination links using a fraud prediction model trained by the learning device described in Appendix 1, A prediction device equipped with the following features.
[0065] (Note 6) The prediction device described in Appendix 5, wherein the learning-based small number of combination detection means and the determination-based small number of combination detection means detect combinations of attribute values with a small number of combinations using the same method and the same threshold.
[0066] (Note 7) Attribute values are represented as nodes, and graph data containing multiple attribute values and links indicating the relationships between attribute values is obtained as training data. For attribute values in the aforementioned training data where the number of attribute value combinations is small, a small number of combination links is added to indicate that the number of combinations is small. A learning method for training a fraud prediction model that predicts the presence or absence of fraud using training data containing the aforementioned small number of combination links.
[0067] (Note 8) Attribute values are represented as nodes, and graph data containing multiple attribute values and links indicating the relationships between attribute values is obtained as training data. For attribute values in the aforementioned training data where the number of attribute value combinations is small, a small number of combination links is added to indicate that the number of combinations is small. A recording medium containing a program that causes a computer to perform a process of training a fraud prediction model that predicts the presence or absence of fraud using training data including the aforementioned small number of combination links.
[0068] Although the present disclosure has been described above with reference to embodiments and examples, the present disclosure is not limited to the above embodiments and examples. Various modifications to the structure and details of the present disclosure can be understood by those skilled in the art within the scope of the present disclosure. [Explanation of symbols]
[0069] 11 Data Acquisition Unit 12. Decimal combination counting section 13 Fraud Prediction Model Learning Section 14. Fraud prediction model output section 21 Data Acquisition Unit 22. Decimal combination counting section 23 Fraud Prediction Department 24 Prediction Result Output Unit 100 Learning Devices 200 Prediction Devices
Claims
1. A means for acquiring training data that represents attribute values as nodes and acquires graph data as training data, which includes multiple attribute values and links that show the relationships between attribute values, A learning-type small-number combination detection means that adds a small-number combination link to attribute values that have a small number of combinations in the learning data, A learning means for training a fraud prediction model that predicts the presence or absence of fraud using training data including the aforementioned small number of combination links, A learning device equipped with the following features.
2. The learning device according to claim 1, wherein the minority combination detection means assigns the minority combination link between attribute values whose occurrence rate of attribute value combinations is below a predetermined threshold.
3. The learning device according to claim 1, wherein the minority combination detection means assigns the minority combination link to attribute values where the measured frequency of the attribute value combination is greater than the expected frequency, and the chi-squared value of the measured frequency and the expected frequency is greater than or equal to a predetermined threshold.
4. The learning device according to claim 1, wherein the fraud prediction model is a model that has learned the relationship between graph data including the few combination links and whether or not fraud is present.
5. A means for acquiring data to be judged, which represents attribute values as nodes and acquires graph data including multiple attribute values and links indicating the relationships between attribute values as data to be judged, A determination-type small number of combinations detection means adds a small number of combination links to attribute values that have a small number of combinations included in the data to be determined, to indicate that the number of combinations is small. Fraud prediction means that predicts fraud in the data to be judged, including the few combination links, using a fraud prediction model trained by the learning device described in claim 1, A prediction device equipped with the following features.
6. The prediction device according to claim 5, wherein the learning-based small number of combination detection means and the determination-based small number of combination detection means detect combinations of attribute values with a small number of combinations using the same method and the same threshold.
7. A learning method performed by a computer, Attribute values are represented as nodes, and graph data containing multiple attribute values and links indicating the relationships between attribute values is obtained as training data. For attribute values in the aforementioned training data where the number of attribute value combinations is small, a small number of combination links is added to indicate that the number of combinations is small. A learning method for training a fraud prediction model that predicts the presence or absence of fraud using training data that includes the aforementioned small number of combination links.
8. Attribute values are represented as nodes, and graph data containing multiple attribute values and links indicating the relationships between attribute values is obtained as training data. For attribute values in the aforementioned training data where the number of attribute value combinations is small, a small number of combination links is added to indicate that the number of combinations is small. A program that causes a computer to perform a process of training a fraud prediction model that predicts the presence or absence of fraud using training data that includes the aforementioned small number of combination links.