Learning device, learning method, and program

Abstract

In a training device according to the present invention, a training data acquiring means acquires graph data as training data, the graph data representing attribute values as nodes and including a plurality of attribute values and links indicating relationships among the attribute values. A minority-combination-for-training detecting means adds minority combination links, which indicate a small number of combinations, between attribute values with a small number of combinations of attribute values included in the training data. A training means uses training data including the minority combination links to train a fraud prediction model that predicts the presence or absence of fraud.

Description

Learning device, learning method, and recording medium

[0001] The present disclosure relates to fraud prediction.

[0002] Traditionally, machine learning models based on knowledge graphs, which consist of a set of nodes and a set of edges between those nodes, have been used to predict the relationships between nodes. This type of technology is also known as graph link prediction technology, and is used in fraud detection, product recommendations, and other applications.

[0003] Patent Literature 1 proposes a method for training a machine learning model based on the above-mentioned knowledge graph by expanding the data of graph information to suppress a decrease in training accuracy.

[0004] Japanese Patent Application Laid-Open No. 2022-72149

[0005] In fraud detection using graph link prediction technology, there are cases where it is desired to detect new fraud that is not included in the fraud examples in the training data. In such cases, even the method of Patent Document 1 may not necessarily be able to detect fraud with high accuracy.

[0006] One object of the present disclosure is to provide a learning device capable of generating a machine learning model that can detect new fraud that is not present in the fraud examples in the training data.

[0007] In one aspect of the present disclosure, a learning device comprises: a learning data acquisition means for acquiring, as learning data, graph data in which attribute values ​​are represented as nodes and which includes a plurality of attribute values ​​and links indicating relationships between the attribute values; a learning minority combination detection means for adding a minority combination link indicating that the number of combinations is small between attribute values ​​included in the learning data that have a small number of combinations; and a learning means for learning a fraud prediction model that predicts the presence or absence of fraud using the learning data including the minority combination link.

[0008] In another aspect of the present disclosure, a prediction device includes: a data to be determined acquisition means for acquiring, as data to be determined, graph data in which attribute values ​​are represented as nodes and which includes a plurality of attribute values ​​and links indicating relationships between the attribute values; a judgment minority combination detection means for adding a minority combination link indicating a minority of combinations between attribute values ​​in the data to be determined, the minority combination link indicating a minority of combinations, to attribute values ​​in which the number of combinations of attribute values ​​included in the data to be determined is a minority; and a fraud prediction means for predicting fraud in the data to be determined including the minority combination link using a fraud prediction model trained by the learning device described in claim 1.

[0009] In yet another aspect of the present disclosure, a learning method includes: acquiring, as training data, graph data in which attribute values ​​are represented as nodes and which includes a plurality of attribute values ​​and links indicating relationships between the attribute values; adding, between attribute values ​​included in the training data that have a small number of combinations, small number combination links indicating that the number of combinations is small; and using the training data including the small number combination links, learning a fraud prediction model that predicts whether or not fraud is occurring.

[0010] In yet another aspect of the present disclosure, a recording medium records a program that causes a computer to execute a process of: acquiring, as training data, graph data in which attribute values ​​are represented as nodes and which includes a plurality of attribute values ​​and links indicating relationships between the attribute values; adding few combination links indicating that the number of combinations is small between attribute values ​​included in the training data that have a small number of combinations; and using the training data including the few combination links, training a fraud prediction model that predicts whether or not fraud is occurring.

[0011] According to the present disclosure, it is possible to generate a machine learning model that can detect new fraud that is not present in the fraud examples in the training data.

[0012] 1 is a diagram conceptually showing learning data of the first embodiment. FIG. 2 is a diagram conceptually showing a prediction result by the prediction model of the first embodiment. FIG. 3 is a diagram conceptually showing learning data and judgment data including minority combinations. FIG. 4 shows the overall configuration of a learning device according to the first embodiment. FIG. 5 is a block diagram showing the hardware configuration of the learning device according to the first embodiment. FIG. 6 is a diagram showing the functional configuration of the learning device according to the first embodiment. FIG. 7 shows an example of a method for determining minority combinations using an occurrence rate. FIG. 8 is a flowchart of processing by the learning device according to the first embodiment. FIG. 9 shows the overall configuration of a prediction device according to the first embodiment. FIG. 10 is a block diagram showing the hardware configuration of the prediction device according to the first embodiment. FIG. 11 is a diagram showing the functional configuration of the prediction device according to the first embodiment. FIG. 12 is a diagram showing the functional configuration of a learning device according to the second embodiment. FIG. 13 is a flowchart of processing by the learning device according to the second embodiment.

[0013] Hereinafter, preferred embodiments of the present disclosure will be described with reference to the drawings. Note that the present embodiment described below is intended to detect unauthorized access to a computer connected to a network, but the method of the present disclosure can also be applied to detecting fraud in various other procedures such as application, registration, and approval. <First Embodiment>

[0014] [Basic Principle] FIG. 1 shows training data used to train a machine learning model used for fraud detection (hereinafter also referred to as a "fraud prediction model"). Table data 50 in FIG. 1 shows the training data in a table. The table data 50 includes attribute names 51 and attribute values ​​52. The attribute names 51 are items in the table data 50 and include an access ID, access information, and fraud possibility. The "access ID" is an ID for uniquely identifying the access information. The "fraud possibility" is a label indicating whether or not the access associated with the access ID is fraudulent access. If the access is fraudulent access, a "fraud" label is assigned. The attribute values ​​52 are values ​​corresponding to the attribute names 51, and a value is input for each access ID.

[0015] Graph data 60 in FIG. 1 shows learning data in the form of a knowledge graph. The graph data 60 includes relations 61, nodes 62, and links 63. The nodes 62 correspond to attribute values ​​in the table data 50. The links 63 indicate connections between attribute values. The relations 61 indicate relationships between attribute values. The relationships between attribute values ​​are represented by the attribute names in the table data 50. For example, in the graph data 60, a link 63 is added between the access ID "101" and the attribute value "A1," indicating that the relationship is "access destination IP address." The fraud prediction model learns the relationship between attribute values, relationships between attributes, and the presence or absence of fraudulent access based on the graph data 60.

[0016] 2 shows the prediction results using the fraud prediction model. The fraud prediction model receives the graph data 65 as an input and can output whether the access related to the graph data 65 is fraudulent or not.

[0017] The fraud prediction model predicts fraudulent access if the graph data to be judged (hereinafter referred to as "judgment data") has attribute values ​​similar to those of training data labeled as fraudulent. Therefore, it has been difficult to detect fraud if the judgment data does not have attribute values ​​similar to those of the training data.

[0018] However, even if the judgment data does not have attribute values ​​similar to those of the training data, the combination of attribute values ​​in the judgment data may be characteristic. For example, if the combination of attribute values ​​included in the judgment data is rare, there is a high possibility that access related to that judgment data is unauthorized access. Therefore, in this embodiment, information that the number of combinations of attribute values ​​is small (hereinafter also referred to as "small number of combinations") is used as a feature to train a fraud prediction model. This makes it possible to detect new fraud that is not found in the fraud examples in the training data.

[0019] FIG. 3 shows an example of graph data including a small number of combinations. In FIG. 3A, the information that the number of combinations of a destination port number and an access source IP address is small is used as one of the features of unauthorized access. For example, the combination of attribute value "B1" and attribute value "C1" is a small number of combinations in the entire training data. Therefore, a small number of combinations link is added between attribute value "B1" and attribute value "C1." The small number of combinations link includes a link 63a connecting the attribute values ​​and a relation 61a indicating the relationship between the attribute values ​​as a small number of combinations. The fraud prediction model learns the relationship between the combination of attribute values ​​to which the small number of combinations link is added and the presence or absence of fraud. FIG. 3B shows the results of fraudulent access prediction using a small number of combinations. The graph data 65a to be judged is judgment data for a new case and does not have attribute values ​​similar to those in the training data labeled as fraudulent. However, the attribute values ​​"Bn" and "Cn" included in the graph data 65a are a small number of combinations. Therefore, the fraud prediction model is able to make a fraud prediction based on the fact that the attribute value "Bn" and the attribute value "Cn" are a small number of combinations.

[0020] [Learning Device] (Overall Configuration) FIG. 4 shows the overall configuration of the learning device 100 according to this embodiment. Graph data is input to the learning device 100 as learning data. The learning device 100 first determines whether the input graph data contains minority combinations. If minority combinations are present, the learning device 100 adds minority combination links between the attribute values. The learning device 100 then generates a fraud prediction model using the graph data containing the minority combination links. Note that the setting information input to the learning device 100 is information related to a method for detecting minority combinations from graph data, which will be described later.

[0021] 5 is a block diagram showing the hardware configuration of the learning device 100. As shown in the figure, the learning device 100 includes an interface (IF) 111, a processor 112, a memory 113, a recording medium 114, a database (DB) 115, and an input unit 116.

[0022] The IF 111 inputs and outputs data to and from an external device. Specifically, the learning device 100 acquires learning data through the IF 111. Furthermore, the fraud prediction model generated by the learning device 100 is output to the external device through the IF 111 as needed.

[0023] The processor 112 is a computer such as a CPU (Central Processing Unit), and executes a prepared program to control the entire learning device 100. Specifically, the processor 112 executes a fraud prediction model generation process, which will be described later.

[0024] The memory 113 is configured by a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The memory 113 is also used as a working memory while the processor 112 is executing various processes.

[0025] Recording medium 114 is a non-volatile, non-transitory recording medium such as a disk-shaped recording medium or semiconductor memory, and is configured to be detachable from learning device 100. Recording medium 114 records various programs executed by processor 112. When learning device 100 executes various processes, the programs recorded on recording medium 114 are loaded into memory 113 and executed by processor 112.

[0026] The DB 115 stores the learning data input via the IF 111, the fraud prediction model generated by the learning device 100, and the like.

[0027] The input unit 116 is, for example, a keyboard, a mouse, etc., and is used by the user to give instructions and input when executing the fraud prediction model generation process described below.

[0028] 6 is a block diagram showing the functional configuration of the learning device 100. Functionally, the learning device 100 includes a data acquisition unit 11, a minority combination counting unit 12, a fraud prediction model learning unit 13, and a fraud prediction model output unit 14.

[0029] Learning data and setting information are input to the learning device 100. The setting information is information relating to a method for determining minority combinations, and includes information such as a method for calculating minority combinations and thresholds. The content of the setting information is specified by the user. The learning data and setting information are input to the data acquisition unit 11. The data acquisition unit 11 outputs the learning data and setting information to the minority combination counting unit 12.

[0030] The minority combination counting unit 12 determines whether a combination of attribute values ​​included in the training data is a minority combination. For example, the minority combination counting unit 12 extracts two attribute values ​​from a plurality of attribute values ​​corresponding to an access ID. Then, the minority combination counting unit 12 calculates the occurrence rate and chi-squared value of the combination of attribute values ​​according to the setting information. As an example, if the setting information includes a specification that the occurrence rate is used as a method for calculating a minority combination and that a threshold value is TH1, the minority combination counting unit 12 calculates the occurrence rate of the minority combination and determines that the combination of attribute values ​​is a minority combination if the calculated value is equal to or less than the threshold value TH1. As another example, if the setting information includes a specification that the chi-squared value is used as a method for calculating a minority combination and that a threshold value is TH2, the minority combination counting unit 12 calculates the chi-squared value of the minority combination and determines that the combination of attribute values ​​is a minority combination if the calculated value is equal to or greater than the threshold value TH2. Then, the minority combination counting unit 12 adds a minority combination link to the training data based on the determination result. The few combination counting unit 12 outputs the learning data including the few combination links to the fraud prediction model learning unit 13 .

[0031] FIG. 7 shows an example of a method for determining a minority combination using the occurrence rate. Table data 70 is learning data. Equation (1) shows a formula for calculating the occurrence rate of a combination of attribute values. Equation (2) calculates, as a specific example, the occurrence rate of the combination of attribute value "B1" and attribute value "C1" included in table data 70. The total number of data items in table data 70 is 100, and there are five combinations of attribute value "B1" and attribute value "C1". Therefore, according to equation (2), the occurrence rate of the combination of attribute value "B1" and attribute value "C1" in table data 70 is 0.05. When the occurrence rate is equal to or less than a predetermined threshold, the minority combination counting unit 12 determines that the combination of attribute value "B1" and attribute value "C1" is a minority combination.

[0032] FIG. 8 shows an example of a method for determining minority combinations using a chi-squared value. The minority combination counting unit 12 can determine whether a combination of attribute values ​​is a minority combination by examining whether there is a correlation between the attribute values ​​using the chi-squared value. A contingency table 80 shows the results of actual observations of the attribute value "B1" and the attribute value "C1." Equation (3) shows the formula for calculating the chi-squared value. Equation (4) shows the formula for calculating the actual frequency of the combination of the attribute value "B1" and the attribute value "C1." Equation (5) shows the formula for calculating the expected frequency of the combination of the attribute value "B1" and the attribute value "C1." The minority combination counting unit 12 determines that the combination of the attribute value "B1" and the attribute value "C1" is a minority combination when the actual frequency is greater than the expected frequency and the chi-squared value is equal to or greater than a predetermined threshold. In the method of FIG. 8, if an attribute value is originally a rare value, a combination including that attribute value is not determined to be a minority combination. This improves the accuracy of determining minority combinations.

[0033] 7 and 8, the minority combination counting unit 12 determines whether a combination of a value of an access destination IP address and a value of an access destination port number is a minority combination, but the combination of attribute values ​​is not limited to this. The minority combination counting unit 12 may determine whether a combination of attribute values ​​of other items is a minority combination, or may determine whether a combination of all attribute values ​​is a minority combination.

[0034] The fraud prediction model learning unit 13 acquires training data including minority combination links from the minority combination counting unit 12. The fraud prediction model learning unit 13 then generates a fraud prediction model that has learned the relationship between the access information and minority combinations included in the training data and fraudulent accesses. The fraud prediction model learning unit 13 outputs the generated fraud prediction model to the fraud prediction model output unit 14.

[0035] The fraud prediction model output unit 14 outputs the fraud prediction model acquired from the fraud prediction model learning unit 13 to the prediction device 200 described below.

[0036] In the above configuration, the data acquisition unit 11 is an example of a learning data acquisition means, the minority combination counting unit 12 is an example of a learning minority combination detection means, and the fraud prediction model learning unit 13 and the fraud prediction model output unit 14 are examples of a learning means.

[0037] (Fraud Prediction Model Generation Process) Next, the fraud prediction model generation process will be described. Fig. 9 is a flowchart of the fraud prediction model generation process performed by the learning device 100. This process is realized by the processor 112 shown in Fig. 5 executing a prepared program and operating as each element shown in Fig. 6.

[0038] First, learning data and setting information are input to the learning device 100. The learning data and setting information are input to the data acquiring unit 11. The data acquiring unit 11 outputs the learning data and setting information to the minority combination counting unit 12 (steps S11 and S12).

[0039] Next, the minority combination counting unit 12 determines whether or not a combination of attribute values ​​included in the training data is a minority combination. Then, the minority combination counting unit 12 adds a minority combination link to the training data based on the determination result. The minority combination counting unit 12 outputs the training data including the minority combination link to the fraud prediction model training unit 13 (step S13).

[0040] The fraud prediction model learning unit 13 generates a fraud prediction model based on the training data including the minority combination links input from the minority combination counting unit 12. Specifically, the fraud prediction model learning unit 13 generates a fraud prediction model that has learned the relationship between the access information and minority combinations included in the training data and fraudulent accesses. The fraud prediction model learning unit 13 outputs the generated fraud prediction model to the fraud prediction model output unit 14 (step S14).

[0041] The fraud prediction model output unit 14 outputs the fraud prediction model acquired from the fraud prediction model learning unit 13 to the prediction device 200 (described later) (step S15). Then, the fraud prediction model generation process ends.

[0042] [Prediction Device] (Overall Configuration) FIG. 10 shows the overall configuration of a prediction device 200 according to this embodiment. Judgment data is input to the prediction device 200. The prediction device 200 first determines whether the input judgment data contains a minority combination. If a minority combination is present, the prediction device 200 adds a minority combination link between the attribute values. The prediction device 200 then uses a fraud prediction model to predict whether the access related to the judgment data is fraudulent access, and outputs the result. The fraud prediction model used by the prediction device 200 is the fraud prediction model generated by the learning device 100. By taking into account the minority combination, the prediction device 200 is able to detect new fraud that is not present in the fraud examples in the training data.

[0043] 11 is a block diagram showing the hardware configuration of the prediction device 200. As shown in the figure, the prediction device 200 includes an interface (IF) 211, a processor 212, a memory 213, a recording medium 214, a database (DB) 215, an input unit 216, and a display unit 217.

[0044] The IF 211 inputs and outputs data to and from an external device. Specifically, the prediction device 200 acquires judgment data through the IF 211.

[0045] The processor 212 is a computer such as a CPU (Central Processing Unit), and executes a program prepared in advance to control the entire prediction device 200. Specifically, the processor 212 executes fraud detection using a fraud prediction model.

[0046] The memory 213 is configured by a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The memory 213 is also used as a working memory while the processor 212 is executing various processes.

[0047] The recording medium 214 is a non-volatile, non-transitory recording medium such as a disk-shaped recording medium or a semiconductor memory, and is configured to be detachable from the prediction device 200. The recording medium 214 records various programs to be executed by the processor 212. When the prediction device 200 executes various processes, the programs recorded on the recording medium 214 are loaded into the memory 213 and executed by the processor 212.

[0048] The DB 215 stores the judgment data input via the IF 211, the results of the prediction of unauthorized access by the prediction device 200, and the like.

[0049] The input unit 216 is, for example, a keyboard, a mouse, etc., and is used by the user to give instructions and input when fraud detection using the fraud prediction model is performed. The display unit 217 is, for example, a liquid crystal display, etc., and displays an operation screen for the user and prediction results generated by the prediction device 200.

[0050] 12 is a block diagram showing the functional configuration of the prediction device 200. Functionally, the prediction device 200 includes a data acquisition unit 21, a minority combination counting unit 22, an incorrect prediction unit 23, and a prediction result output unit 24.

[0051] Determination data and setting information are input to the prediction device 200. The setting information is specified by the user. The setting information has the same content as the setting information specified when the fraud prediction model was generated. For example, if the setting information when the fraud prediction model was generated included using the occurrence rate as a method for calculating decimal combinations and setting the threshold to TH1, the setting information at the time of prediction will include using the occurrence rate as a method for calculating decimal combinations and setting the threshold to TH1, as was the case when the fraud prediction model was generated. The determination data and setting information are input to the data acquisition unit 21. The data acquisition unit 21 outputs the determination data and setting information to the minority combination counting unit 22.

[0052] The minority combination counting unit 22 determines whether a combination of attribute values ​​included in the judgment data is a minority combination. For example, the minority combination counting unit 22 extracts two attribute values ​​from the multiple attribute values ​​included in the judgment data. Then, the minority combination counting unit 22 calculates the appearance rate and chi-square value of the attribute value combination according to the setting information. The minority combination counting unit 22 determines whether the attribute value combination is a minority combination based on the calculated values. Then, if the minority combination counting unit 22 determines that the attribute value combination is a minority combination, it adds a minority combination link to the judgment data. The minority combination counting unit 22 outputs the judgment data including the minority combination link to the fraud prediction unit 23.

[0053] The fraud prediction unit 23 acquires judgment data including minority combination links from the minority combination counting unit 22. Then, the fraud prediction unit 23 predicts whether or not the access related to the judgment data is fraudulent access using the fraud prediction model generated by the learning device 100. The fraud prediction unit 23 outputs the prediction result to the prediction result output unit 24.

[0054] The prediction result output unit 24 generates display data based on the prediction result acquired from the fraud prediction unit 23 and outputs it to the display unit 217 of the prediction device 200.

[0055] In the above configuration, the data acquisition unit 21 is an example of a means for acquiring data to be judged, the minority combination counting unit 22 is an example of a means for detecting minority combinations for judgment, and the fraud prediction unit 23 and the prediction result output unit 24 are examples of a fraud detection means.

[0056] 13 is a block diagram showing the functional configuration of a learning device according to Embodiment 2. The learning device 300 includes a learning data acquisition unit 311, a learning small number combination detection unit 312, and a learning unit 313.

[0057] 14 is a flowchart of processing by the learning device of the second embodiment. The learning data acquisition means 311 acquires, as learning data, graph data in which attribute values ​​are represented as nodes and which includes multiple attribute values ​​and links indicating relationships between the attribute values ​​(step S31). The learning minority combination detection means 312 adds minority combination links indicating the minority of combinations between attribute values ​​included in the learning data that have a minority of combinations (step S32). The learning means 313 uses the learning data including the minority combination links to train a fraud prediction model that predicts whether or not fraud is occurring (step S33).

[0058] According to the learning device 300 of the second embodiment, it is possible to generate a machine learning model that can detect new fraudulent behavior that is not present in the fraudulent behavior examples in the training data.

[0059] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0060] (Supplementary Note 1) A learning device comprising: a learning data acquisition means for acquiring, as learning data, graph data in which attribute values ​​are represented as nodes and which includes a plurality of attribute values ​​and links indicating relationships between the attribute values; a learning minority combination detection means for adding a minority combination link indicating that the number of combinations is small between attribute values ​​in the learning data in which the number of combinations of attribute values ​​is small; and a learning means for learning a fraud prediction model that predicts the presence or absence of fraud using the learning data including the minority combination link.

[0061] (Supplementary Note 2) The learning device according to Supplementary Note 1, wherein the minority combination detection means assigns the minority combination link between attribute values ​​whose appearance rate of the combination of attribute values ​​is equal to or less than a predetermined threshold.

[0062] (Supplementary Note 3) The learning device according to Supplementary Note 1, wherein the minority combination detection means assigns the minority combination link between attribute values ​​where the actual frequency of the combination of attribute values ​​is greater than the expected frequency and the chi-squared value between the actual frequency and the expected frequency is equal to or greater than a predetermined threshold.

[0063] (Supplementary Note 4) The learning device according to Supplementary Note 1, wherein the fraud prediction model is a model that has learned the relationship between graph data including the small number of combination links and the presence or absence of fraud.

[0064] (Supplementary Note 5) A prediction device comprising: a data-to-be-determined acquisition means for acquiring, as data-to-be-determined, graph data including a plurality of attribute values, each represented as a node, and links indicating relationships between the attribute values; a judgment-use minority combination detection means for adding a minority combination link indicating a minority of combinations between attribute values ​​included in the data-to-be-determined, the minority of combinations indicating a minority of combinations; and a fraud prediction means for predicting fraud in the data-to-be-determined including the minority combination link, using a fraud prediction model trained by the learning device described in Supplementary Note 1.

[0065] (Supplementary Note 6) The prediction device according to Supplementary Note 5, wherein the learning small number combination detection means and the judgment small number combination detection means use the same method and the same threshold to detect combinations of attribute values ​​with a small number of combinations.

[0066] (Supplementary Note 7) A learning method comprising: acquiring graph data as training data, in which attribute values ​​are represented as nodes and the graph data includes a plurality of attribute values ​​and links indicating the relationships between the attribute values; adding a few-combination link indicating that the number of combinations is small between attribute values ​​included in the training data that have a small number of combinations; and using the training data including the few-combination link to train a fraud prediction model that predicts whether or not fraud has occurred.

[0067] (Supplementary Note 8) A recording medium having recorded thereon a program that causes a computer to execute a process of: representing attribute values ​​as nodes, acquiring graph data including a plurality of attribute values ​​and links indicating the relationships between the attribute values ​​as training data; adding a few combination links indicating that the number of combinations is small between attribute values ​​included in the training data that have a small number of combinations; and using the training data including the few combination links to train a fraud prediction model that predicts whether or not fraud has occurred.

[0068] Although the present disclosure has been described above with reference to the embodiments and examples, the present disclosure is not limited to the above-described embodiments and examples. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure.

[0069] REFERENCE SIGNS LIST 11 Data acquisition unit 12 Few combination count unit 13 Fraud prediction model learning unit 14 Fraud prediction model output unit 21 Data acquisition unit 22 Few combination count unit 23 Fraud prediction unit 24 Prediction result output unit 100 Learning device 200 Prediction device

Claims

1. a training data acquiring means for acquiring, as training data, graph data including a plurality of attribute values ​​represented as nodes and links indicating relationships between the attribute values; a learning small combination detection means for adding a small combination link indicating that the number of combinations is small between attribute values ​​that have a small number of combinations of attribute values ​​included in the learning data; a learning means for learning a fraud prediction model that predicts whether or not fraud is present, using learning data including the small number of combination links; A learning device comprising:

2. 2. The learning device according to claim 1, wherein the minority combination detection means assigns the minority combination link between attribute values ​​whose appearance rate of the combination of attribute values ​​is equal to or less than a predetermined threshold.

3. 2. The learning device according to claim 1, wherein the minority combination detection means assigns the minority combination link between attribute values ​​when the actual measured frequency of the combination of attribute values ​​is greater than the expected frequency and the chi-squared value between the actual measured frequency and the expected frequency is equal to or greater than a predetermined threshold.

4. The learning device according to claim 1 , wherein the fraud prediction model is a model that learns the relationship between graph data including the small number of combination links and the presence or absence of fraud.

5. a determination target data acquiring means for acquiring, as determination target data, graph data in which attribute values ​​are represented as nodes and which include a plurality of attribute values ​​and links indicating relationships between the attribute values; a determination small combination detection means for adding a small combination link indicating that the number of combinations is small between attribute values ​​that have a small number of combinations of attribute values ​​included in the determination target data; a fraud prediction means for predicting fraud in the determination target data including the small number of combination links using a fraud prediction model trained by the learning device according to claim 1; A prediction device comprising:

6. The prediction device according to claim 5 , wherein the learning small number of combinations detection means and the judgment small number of combinations detection means use the same method and the same threshold value to detect combinations of attribute values ​​with a small number of combinations.

7. A computer-implemented learning method, comprising: Graph data is acquired as training data, in which attribute values ​​are represented as nodes and the graph data includes a plurality of attribute values ​​and links indicating relationships between the attribute values; adding a few combination links indicating that the number of combinations is small between attribute values ​​that have a small number of combinations of attribute values ​​included in the learning data; A learning method for learning a fraud prediction model that predicts whether or not fraud occurs, using learning data including the small number of combination links.

8. Graph data is acquired as training data, in which attribute values ​​are represented as nodes and the graph data includes a plurality of attribute values ​​and links indicating relationships between the attribute values; adding a few combination links indicating that the number of combinations is small between attribute values ​​that have a small number of combinations of attribute values ​​included in the learning data; A program that causes a computer to execute a process of learning a fraud prediction model that predicts whether or not fraud is present, using learning data that includes the small number of combination links.