CN117763486A - financial network anomaly detection method based on graph data structure and characteristics - Google Patents
financial network anomaly detection method based on graph data structure and characteristics Download PDFInfo
- Publication number
- CN117763486A CN117763486A CN202410198158.8A CN202410198158A CN117763486A CN 117763486 A CN117763486 A CN 117763486A CN 202410198158 A CN202410198158 A CN 202410198158A CN 117763486 A CN117763486 A CN 117763486A
- Authority
- CN
- China
- Prior art keywords
- representing
- feature
- financial network
- graph
- module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 84
- 238000000034 method Methods 0.000 claims abstract description 38
- 238000012549 training Methods 0.000 claims abstract description 36
- 230000002159 abnormal effect Effects 0.000 claims abstract description 35
- 238000010586 diagram Methods 0.000 claims abstract description 19
- 125000004122 cyclic group Chemical group 0.000 claims abstract description 15
- 230000008569 process Effects 0.000 claims abstract description 11
- 238000002372 labelling Methods 0.000 claims abstract description 9
- 239000011159 matrix material Substances 0.000 claims description 84
- 230000006870 function Effects 0.000 claims description 40
- 239000013598 vector Substances 0.000 claims description 32
- 230000005856 abnormality Effects 0.000 claims description 16
- 238000004364 calculation method Methods 0.000 claims description 15
- 238000010606 normalization Methods 0.000 claims description 14
- 238000012545 processing Methods 0.000 claims description 13
- 238000012360 testing method Methods 0.000 claims description 12
- 238000013528 artificial neural network Methods 0.000 claims description 11
- 230000009466 transformation Effects 0.000 claims description 8
- 230000004913 activation Effects 0.000 claims description 6
- 238000012795 verification Methods 0.000 claims description 6
- 230000007246 mechanism Effects 0.000 claims description 5
- 230000002779 inactivation Effects 0.000 claims description 3
- 230000000306 recurrent effect Effects 0.000 claims description 3
- 238000012163 sequencing technique Methods 0.000 claims description 3
- 230000001419 dependent effect Effects 0.000 description 2
- 230000004927 fusion Effects 0.000 description 2
- 238000007781 pre-processing Methods 0.000 description 2
- 230000004931 aggregating effect Effects 0.000 description 1
- 230000002547 anomalous effect Effects 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000007418 data mining Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000009499 grossing Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000005065 mining Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000000547 structure data Methods 0.000 description 1
Landscapes
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention provides a financial network anomaly detection method based on a graph data structure and characteristics, which belongs to the technical field of financial network anomaly detection and comprises the following steps: step S1, acquiring a large amount of historical diagram data of a financial network, carrying out standardized pretreatment on each historical diagram data, and constructing a data set after labeling; step S2, a financial network anomaly detection model is established based on the graph structure coding module, the cyclic graph attention module, the deep graph network module, the characteristic stacking module and the prediction output module; step S3, training a financial network anomaly detection model based on the data set, and continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process; and S4, detecting the abnormal financial network by using the trained abnormal financial network detection model. The invention has the advantages that: the accuracy of detecting the abnormal financial network is greatly improved.
Description
Technical Field
The invention relates to the technical field of financial network anomaly detection, in particular to a financial network anomaly detection method based on a graph data structure and characteristics.
Background
Graph data (graph structure data) can be applied to a plurality of real scenes, such as a communication network, a financial network, a social network and the like, and abnormal detection of the graph data is an important task of graph data mining, and has wide application in the real world, for example, in the social network, a user and a connection between users can be regarded as graph data, and false accounts, abnormal user behaviors or unusual social modes can be detected through graph abnormal detection, so that the reliability of the social network and the safety of a user experience network are improved; in the financial risk management aspect, financial users and users' transactions can be seen as graph data, graph anomaly detection can be used to identify anomalous transactions and fraudulent activity, thereby reducing financial losses, etc.
In the task of detecting the abnormality of the graph data, how to generate the effective node representation and accurately judge that the abnormal node existing in the graph data is the main target of graph abnormality detection. In the graph data, part of abnormal nodes are connected with each other to form a group structure, and the other part of abnormal nodes are scattered in normal nodes to form context abnormal nodes, and the characteristics of the context abnormal nodes and the characteristics of surrounding normal nodes are greatly different, namely, homogeneity assumption is not followed. Because the graph neural network updates node characteristics by aggregating the characteristics of neighbor nodes, the occurrence of these group structural anomalies and contextual anomalies makes the graph neural network unsatisfactory for application to graph anomaly detection tasks. In addition, in the existing graph neural network modeling process, most of deep semantic information belonging to the shallow model cannot fully mine graph data, long-distance dependent information of the graph data cannot be captured, the expression capacity of the model is limited, and the accuracy of abnormal detection of the financial network is affected.
Therefore, how to provide a method for detecting abnormal financial network based on graph data structure and characteristics, so as to improve the accuracy of detecting abnormal financial network, is a technical problem to be solved urgently.
Disclosure of Invention
The invention aims to solve the technical problem of providing a financial network anomaly detection method based on a graph data structure and characteristics, so as to improve the accuracy of financial network anomaly detection.
The invention is realized in the following way: a financial network anomaly detection method based on graph data structure and characteristics comprises the following steps:
step S1, acquiring a large amount of historical diagram data of a financial network, carrying out standardized pretreatment on each historical diagram data, and constructing a data set after labeling;
Step S2, a financial network anomaly detection model is established based on the graph structure coding module, the cyclic graph attention module, the deep graph network module, the characteristic stacking module and the prediction output module;
the graph structure coding module is used for extracting an adjacent matrix and a feature vector of each node from graph data, carrying out standardization processing on the adjacent matrix to obtain a standard adjacent matrix, and outputting a structure feature set comprising a plurality of structure features based on the standard adjacent matrix and the feature vector;
The cyclic graph attention module is used for calculating the attention value of each structural feature by utilizing a self-attention mechanism of the shared weight, calculating the ordering feature of each node after descending order of the attention value, processing each ordering feature by using a standard cyclic neural network, and adding residual connection to obtain the attention feature;
the deep layer graph network module is used for extracting an adjacent matrix and a feature vector of each node from graph data, calculating initial input based on the adjacent matrix and the feature vector, calculating network output of each layer of network through a continuous residual error method and the initial input, and obtaining deep layer features based on the network output and an information enhancement matrix;
The feature stacking module is used for performing feature stacking of the same dimension on the attention features and the deep features to obtain stacking features;
the prediction output module is used for outputting a financial network abnormality detection result after performing linear transformation and normalization on the stacking characteristics;
Step S3, training a financial network anomaly detection model based on the data set, and continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process;
And S4, detecting the abnormal financial network by using the trained abnormal financial network detection model.
further, in the step S2, the formula for performing the normalization processing on the adjacency matrix by the graph structure coding module is as follows:；
Wherein,representing a standard adjacency matrix; /(I)Representing an adjacency matrix plus self-loops,/>，/>Representing adjacency matrix,/>R represents a real number, N represents the number of nodes of the graph data,/>Representing the identity matrix; /(I)Representation/>a degree matrix of (2);
the formula for outputting the structure feature set comprising a plurality of structure features based on the standard adjacency matrix and the feature vector is as follows:；
Wherein,Representing a set of structural features,/>D represents a feature dimension,/>，/>Representing an nth structural feature; /(I)Representing a learnable weight matrix,/>；/>Representing feature vectors,/>。
further, in the step S2, the calculation formula of the attention score of the attention module of the cyclic graph is:；
Wherein,representing the attention score from node j to node i; /(I)Representing an activation function; /(I)Representing a matrix of learnable parameters,/>R represents a real number; /(I)Representing a matrix of learnable parameters,/>D represents a feature dimension; /(I)representing an ith structural feature; /(I)represents the j-th structural feature; the I represents a stitching operation;
the formula for descending order of the attention scores is as follows:=；
Wherein,representing the attention scores after descending order sorting; /(I)representing a descending order ranking function; /(I)Represents the attention score from node Q to node i, Q is the number of first-order neighbor nodes of node i,/>，/>A first-order neighbor node set representing node i;
The calculation formula of the sequencing feature is as follows:；
Wherein,representing the ordering attribute of node i,/>；/>Representing an exponential function; /(I)Representing the Q-th structural feature;
The calculation formula of the attention characteristic is as follows:；
Wherein,representing the attention characteristics of the ith node,/>；/>representing a recurrent neural network; /(I)representing the ith structural feature,/>。
Further, in the step S2, the calculation formula of the initial input of the deep map network module is:；
Wherein,representing the initial input, also being the network output of the first layer network; /(I)Representing an adjacency matrix; /(I)Representing the feature vector; /(I)Representing a matrix of learnable parameters,/>R represents a real number, and d represents a characteristic dimension;
the formula for calculating the network output of each layer of network through the continuous residual error method and the initial input is as follows:；
Wherein,representing the/>, in a deep graph network moduleNetwork output of layer,/>Is an integer greater than 0;
the calculation formula of the deep layer characteristics is as follows:；/>；
Wherein,representing deep features; /(I)representing an activation function; y represents an information enhancement matrix; /(I)representing hyper-parameters,/>；/>Representing a matrix of learnable parameters,/>N represents the number of nodes of the graph data; d represents the degree matrix of the adjacency matrix.
Further, in the step S2, the formula of feature stacking for the same dimension of the attention feature and the deep feature by the feature stacking module is as follows:；
Wherein Z represents a stacking feature,r represents a real number, N represents the number of nodes of the graph data, and d represents a characteristic dimension; /(I)Representing a multi-layer perceptron; /(I)Representing a splicing operation; /(I)Representing a attention feature; /(I)Representing deep features.
further, in the step S2, the formula of the prediction output module for performing linear transformation and normalization on the stacking feature is:；
Wherein,representing the result of detecting the abnormality of the financial network,/>R represents a real number, and N represents the number of nodes of the graph data; /(I)Representing a normalization function; z represents a stacking feature; /(I)Representing weight vector,/>D represents a feature dimension; b represents bias,/>。
Further, the loss function is a cross entropy loss function, and the formula is:；
Wherein,representing a loss value; /(I)representing a cross entropy loss function; y represents a label of node labeling of graph data,/>，/>A label representing an nth node; p represents the result of the financial network anomaly detection,，/>And the financial network abnormality detection result of the nth node is represented.
further, the super parameters at least comprise a random inactivation rate, a weight attenuation rate and a learning rate.
Further, training the financial network anomaly detection model based on the data set specifically includes:
Based on 5:3:2 dividing the data set into a training set, a verification set and a test set, training a financial network anomaly detection model by using the training set, and continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process until a preset convergence condition is met;
After the trained financial network anomaly detection model is verified by the verification set, the verified financial network anomaly detection model is tested by the test set, and if the test is passed, the training of the financial network anomaly detection model is finished; if the test does not pass, the training set is expanded to continue training the financial network anomaly detection model.
The invention has the advantages that:
The method comprises the steps of carrying out standardized preprocessing and labeling on a large number of historical diagram data of a financial network, constructing a data set, then creating a financial network anomaly detection model based on a diagram structure coding module, a cyclic diagram attention module, a deep diagram network module, a characteristic stacking module and a prediction output module, training the financial network anomaly detection model based on the data set, continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process, and finally carrying out financial network anomaly detection by utilizing the trained financial network anomaly detection model; the graph structure coding module is used for extracting an adjacent matrix and a feature vector of each node from graph data, carrying out standardization processing on the adjacent matrix to obtain a standard adjacent matrix, and outputting a structure feature set comprising a plurality of structure features based on the standard adjacent matrix and the feature vector; the circulation diagram attention module is used for calculating the attention value of each structural feature by utilizing a self-attention mechanism of the shared weight, calculating the ordering feature of each node after descending order of each attention value, processing each ordering feature by using a standard circulation neural network, and adding residual connection to obtain the attention feature; the deep layer graph network module is used for extracting an adjacent matrix and a feature vector of each node from graph data, calculating initial input based on the adjacent matrix and the feature vector, calculating network output of each layer of network through a continuous residual error method and the initial input, and obtaining deep layer features based on the network output and the information enhancement matrix; the feature stacking module is used for carrying out feature stacking of the same dimension on the attention features and the deep features to obtain stacking features; the prediction output module is used for outputting a financial network abnormality detection result after performing linear transformation and normalization on the stacking characteristics; the method has the advantages that long-distance dependency information in the graph data is captured through the joint graph structure coding module and the cycle graph attention module, meanwhile, deep semantic information of the graph data is mined and extracted through the deep graph network module, stacked characteristics (node representation) are generated through stacking and fusion of the information through the characteristic stacking module, abnormal nodes can be captured more accurately, characteristic representations of normal nodes and abnormal nodes can be distinguished more effectively, and accordingly accuracy of financial network abnormality detection is improved greatly.
Drawings
The invention will be further described with reference to examples of embodiments with reference to the accompanying drawings.
FIG. 1 is a flow chart of a method for detecting anomalies in a financial network based on graph data structures and features of the present invention.
Fig. 2 is a schematic diagram of the structure of the abnormality detection model of the financial network according to the present invention.
Detailed Description
The technical scheme in the embodiment of the application has the following overall thought: the method comprises the steps of constructing a financial network anomaly detection model comprising a graph structure coding module, a circulating graph attention module, a deep layer graph network module, a characteristic stacking module and a prediction output module, and using the model for detecting financial network anomalies, namely, combining the graph structure coding module and the circulating graph attention module to capture long-distance dependency information in graph data, simultaneously combining the deep layer graph network module to mine and extract deep semantic information of the graph data, and generating stacking characteristics by stacking and fusing the information through the characteristic stacking module, so that anomaly nodes can be captured more accurately, and characteristic representations of normal nodes and anomaly nodes can be distinguished more effectively, so that the accuracy of financial network anomaly detection is improved.
referring to fig. 1 to 2, a preferred embodiment of a financial network anomaly detection method based on graph data structures and features of the present invention includes the following steps:
step S1, acquiring a large amount of historical diagram data of a financial network, carrying out standardized pretreatment on each historical diagram data, and constructing a data set after labeling; the history map data is represented as g= (a, X);
In specific implementation, a public data set elipic can be selected, the elipic is part of transaction data obtained from a real bitcoin transaction network, nodes represent bitcoin transactions, the nodes are divided into legal and illegal categories, and edges represent bitcoin flows during transactions;
Step S2, a financial network anomaly detection model is established based on the graph structure coding module, the cyclic graph attention module, the deep graph network module, the characteristic stacking module and the prediction output module;
the graph structure coding module is used for extracting an adjacent matrix and a feature vector of each node from graph data, carrying out standardization processing on the adjacent matrix to obtain a standard adjacent matrix, and outputting a structure feature set comprising a plurality of structure features based on the standard adjacent matrix and the feature vector; i.e., for incorporating structural information into node features;
the cyclic graph attention module is used for calculating the attention value of each structural feature by utilizing a self-attention mechanism of the shared weight, sorting all the attention values in a descending order, calculating the sorting feature of each node, processing all the sorting features by using a standard cyclic neural network for better capturing the long-distance dependency information of graph data, and adding residual connection to obtain the attention feature; i.e., long-range dependency information for capturing the graph network data;
The deep layer graph network module is used for extracting an adjacent matrix and a feature vector of each node from graph data, calculating initial input based on the adjacent matrix and the feature vector, calculating network output of each layer of network through a continuous residual error method and the initial input, and obtaining deep layer features based on the network output and an information enhancement matrix; the deep semantic features of the input graph data are extracted by using a continuous residual error method and an information enhancement matrix, so that abnormal information existing in the graph data is captured, and the robustness in abnormal detection is improved;
The feature stacking module is used for performing feature stacking of the same dimension on the attention features and the deep features to obtain stacking features; the method is used for fusing long-distance dependent information and deep semantic information of the map network map;
the prediction output module is used for outputting a financial network abnormality detection result after performing linear transformation and normalization on the stacking characteristics;
Step S3, training a financial network anomaly detection model based on the data set, and continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process;
And S4, detecting the abnormal financial network by using the trained abnormal financial network detection model.
In the step S2, the formula for the graph structure encoding module to perform the normalization processing on the adjacency matrix is as follows:；
Wherein,representing a standard adjacency matrix; /(I)Representing an adjacency matrix plus self-loops,/>，/>Representing adjacency matrix,/>R represents a real number, N represents the number of nodes of the graph data,/>Representing the identity matrix; /(I)Representation/>A degree matrix of (2); if there is an edge between node i and node j, then/>Otherwise/>；
the formula for outputting the structure feature set comprising a plurality of structure features based on the standard adjacency matrix and the feature vector is as follows:；
Wherein,Representing a set of structural features,/>D represents a feature dimension,/>，/>Representing an nth structural feature; /(I)Representing a learnable weight matrix,/>；/>Representing feature vectors,/>。
In the step S2, the calculation formula of the attention score of the attention module of the cyclic graph is as follows:；
Wherein,representing the attention score from node j to node i; /(I)Representing an activation function; /(I)Representing a matrix of learnable parameters,/>R represents a real number; /(I)Representing a matrix of learnable parameters,/>D represents a feature dimension; /(I)representing an ith structural feature; /(I)represents the j-th structural feature; the I represents a stitching operation;
the formula for descending order of the attention scores is as follows:=；
Wherein,representing the attention scores after descending order sorting; /(I)representing a descending order ranking function; /(I)Represents the attention score from node Q to node i, Q is the number of first-order neighbor nodes of node i,/>，/>A first-order neighbor node set representing node i;
The calculation formula of the sequencing feature is as follows:；
Wherein,representing the ordering attribute of node i,/>；/>Representing an exponential function; /(I)Representing the Q-th structural feature;
The calculation formula of the attention characteristic is as follows:；
Wherein,representing the attention characteristics of the ith node,/>；/>representing a recurrent neural network; /(I)representing the ith structural feature,/>。
In the step S2, the calculation formula of the initial input of the deep map network module is as follows:；
Wherein,representing the initial input, also being the network output of the first layer network; /(I)Representing an adjacency matrix; /(I)Representing the feature vector; /(I)Representing a matrix of learnable parameters,/>R represents a real number, and d represents a characteristic dimension;
the formula for calculating the network output of each layer of network through the continuous residual error method and the initial input is as follows:；
Wherein,representing the/>, in a deep graph network moduleNetwork output of layer,/>Is an integer greater than 0; that is, the residual connection method is used to add the output characteristics of each layer with the output characteristics of the previous layers in the process of message transmission;
the calculation formula of the deep layer characteristics is as follows:；/>；
Wherein,representing deep features; /(I)representing an activation function; y represents an information enhancement matrix for relieving the problem of over-smoothing caused by mining depth abnormal information; /(I)representing hyper-parameters,/>；/>Representing a matrix of learnable parameters,/>N represents the number of nodes of the graph data; d represents the degree matrix of the adjacency matrix.
in the step S2, the formula of feature stacking for the same dimension of the attention feature and the deep feature by the feature stacking module is as follows:；
Wherein Z represents a stacking feature,r represents a real number, N represents the number of nodes of the graph data, and d represents a characteristic dimension; /(I)Representing a multi-layer perceptron; /(I)Representing a splicing operation; /(I)Representing a attention feature; /(I)Representing deep features.
In the step S2, the formula for performing linear transformation and normalization on the stacking feature by the prediction output module is as follows:；
Wherein,representing the result of detecting the abnormality of the financial network,/>R represents a real number, and N represents the number of nodes of the graph data; /(I)Representing a normalization function; z represents a stacking feature; /(I)Representing weight vector,/>D represents a feature dimension; b represents bias,/>。
The loss function is a cross entropy loss function, and the formula is:；
Wherein,representing a loss value; /(I)representing a cross entropy loss function; y represents a label of node labeling of graph data,/>，/>A label representing an nth node; p represents the result of the financial network anomaly detection,，/>And the financial network abnormality detection result of the nth node is represented.
the super-parameters at least comprise a random inactivation rate, a weight attenuation rate and a learning rate.
The training of the financial network anomaly detection model based on the data set specifically comprises the following steps:
Based on 5:3:2 dividing the data set into a training set, a verification set and a test set, training a financial network anomaly detection model by using the training set, and continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process until a preset convergence condition is met;
After the trained financial network anomaly detection model is verified by the verification set, the verified financial network anomaly detection model is tested by the test set, and if the test is passed, the training of the financial network anomaly detection model is finished; if the test does not pass, the training set is expanded to continue training the financial network anomaly detection model.
The invention adopts two widely used measurement indexes AUC-ROC and AUC-PR to evaluate the performance of the financial network anomaly detection model, the detection accuracy of the financial network anomaly detection model in the AUC-ROC and AUC-PR of the financial network data set Elliptic is 91.3% and 81.4%, which exceeds the latest model, namely, the invention has better accuracy, generalization and reliability, shows better performance in complex and high-dimensional graph data, and can fully utilize the complex structure information and node characteristics of the graph data to generate effective node representation.
in summary, the invention has the advantages that:
The method comprises the steps of carrying out standardized preprocessing and labeling on a large number of historical diagram data of a financial network, constructing a data set, then creating a financial network anomaly detection model based on a diagram structure coding module, a cyclic diagram attention module, a deep diagram network module, a characteristic stacking module and a prediction output module, training the financial network anomaly detection model based on the data set, continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process, and finally carrying out financial network anomaly detection by utilizing the trained financial network anomaly detection model; the graph structure coding module is used for extracting an adjacent matrix and a feature vector of each node from graph data, carrying out standardization processing on the adjacent matrix to obtain a standard adjacent matrix, and outputting a structure feature set comprising a plurality of structure features based on the standard adjacent matrix and the feature vector; the circulation diagram attention module is used for calculating the attention value of each structural feature by utilizing a self-attention mechanism of the shared weight, calculating the ordering feature of each node after descending order of each attention value, processing each ordering feature by using a standard circulation neural network, and adding residual connection to obtain the attention feature; the deep layer graph network module is used for extracting an adjacent matrix and a feature vector of each node from graph data, calculating initial input based on the adjacent matrix and the feature vector, calculating network output of each layer of network through a continuous residual error method and the initial input, and obtaining deep layer features based on the network output and the information enhancement matrix; the feature stacking module is used for carrying out feature stacking of the same dimension on the attention features and the deep features to obtain stacking features; the prediction output module is used for outputting a financial network abnormality detection result after performing linear transformation and normalization on the stacking characteristics; the method has the advantages that long-distance dependency information in the graph data is captured through the joint graph structure coding module and the cycle graph attention module, meanwhile, deep semantic information of the graph data is mined and extracted through the deep graph network module, stacked characteristics (node representation) are generated through stacking and fusion of the information through the characteristic stacking module, abnormal nodes can be captured more accurately, characteristic representations of normal nodes and abnormal nodes can be distinguished more effectively, and accordingly accuracy of financial network abnormality detection is improved greatly.
While specific embodiments of the invention have been described above, it will be appreciated by those skilled in the art that the specific embodiments described are illustrative only and not intended to limit the scope of the invention, and that equivalent modifications and variations of the invention in light of the spirit of the invention will be covered by the claims of the present invention.
Claims (9)
1. A financial network anomaly detection method based on graph data structure and characteristics is characterized in that: the method comprises the following steps:
step S1, acquiring a large amount of historical diagram data of a financial network, carrying out standardized pretreatment on each historical diagram data, and constructing a data set after labeling;
Step S2, a financial network anomaly detection model is established based on the graph structure coding module, the cyclic graph attention module, the deep graph network module, the characteristic stacking module and the prediction output module;
the graph structure coding module is used for extracting an adjacent matrix and a feature vector of each node from graph data, carrying out standardization processing on the adjacent matrix to obtain a standard adjacent matrix, and outputting a structure feature set comprising a plurality of structure features based on the standard adjacent matrix and the feature vector;
The cyclic graph attention module is used for calculating the attention value of each structural feature by utilizing a self-attention mechanism of the shared weight, calculating the ordering feature of each node after descending order of the attention value, processing each ordering feature by using a standard cyclic neural network, and adding residual connection to obtain the attention feature;
the deep layer graph network module is used for extracting an adjacent matrix and a feature vector of each node from graph data, calculating initial input based on the adjacent matrix and the feature vector, calculating network output of each layer of network through a continuous residual error method and the initial input, and obtaining deep layer features based on the network output and an information enhancement matrix;
The feature stacking module is used for performing feature stacking of the same dimension on the attention features and the deep features to obtain stacking features;
the prediction output module is used for outputting a financial network abnormality detection result after performing linear transformation and normalization on the stacking characteristics;
Step S3, training a financial network anomaly detection model based on the data set, and continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process;
And S4, detecting the abnormal financial network by using the trained abnormal financial network detection model.
2. The method for detecting abnormal condition of financial network based on graph data structure and characteristics according to claim 1, wherein: in the step S2, the formula for the graph structure encoding module to perform the normalization processing on the adjacency matrix is as follows:；
Wherein,representing a standard adjacency matrix; /(I)Representing an adjacency matrix plus self-loops,/>，/>Representing adjacency matrix,/>R represents a real number, N represents the number of nodes of the graph data,/>Representing the identity matrix; /(I)Representation/>a degree matrix of (2);
the formula for outputting the structure feature set comprising a plurality of structure features based on the standard adjacency matrix and the feature vector is as follows:；
Wherein,Representing a set of structural features,/>D represents a feature dimension,/>，/>Representing an nth structural feature; /(I)Representing a learnable weight matrix,/>；/>Representing feature vectors,/>。
3. The method for detecting abnormal condition of financial network based on graph data structure and characteristics according to claim 1, wherein: in the step S2, the calculation formula of the attention score of the attention module of the cyclic graph is as follows:；
Wherein,representing the attention score from node j to node i; /(I)Representing an activation function; /(I)Representing a matrix of learnable parameters,/>R represents a real number; /(I)Representing a matrix of learnable parameters,/>D represents a feature dimension; /(I)representing an ith structural feature; /(I)represents the j-th structural feature; the I represents a stitching operation;
the formula for descending order of the attention scores is as follows:=/>；
Wherein,representing the attention scores after descending order sorting; /(I)representing a descending order ranking function; /(I)Represents the attention score from node Q to node i, Q is the number of first-order neighbor nodes of node i,/>，/>A first-order neighbor node set representing node i;
The calculation formula of the sequencing feature is as follows:；
Wherein,representing the ordering attribute of node i,/>；/>Representing an exponential function; /(I)Representing the Q-th structural feature;
The calculation formula of the attention characteristic is as follows:；
Wherein,representing the attention characteristics of the ith node,/>；/>representing a recurrent neural network; /(I)representing the ith structural feature,/>。
4. The method for detecting abnormal condition of financial network based on graph data structure and characteristics according to claim 1, wherein: in the step S2, the calculation formula of the initial input of the deep map network module is as follows:；
Wherein,representing the initial input, also being the network output of the first layer network; /(I)Representing an adjacency matrix; /(I)Representing the feature vector; /(I)Representing a matrix of learnable parameters,/>R represents a real number, and d represents a characteristic dimension;
the formula for calculating the network output of each layer of network through the continuous residual error method and the initial input is as follows:；
Wherein,representing the/>, in a deep graph network moduleNetwork output of layer,/>Is an integer greater than 0;
the calculation formula of the deep layer characteristics is as follows:；/>；
Wherein,representing deep features; /(I)representing an activation function; y represents an information enhancement matrix; /(I)The super-parameter is represented by a parameter,；/>Representing a matrix of learnable parameters,/>N represents the number of nodes of the graph data; d represents the degree matrix of the adjacency matrix.
5. The method for detecting abnormal condition of financial network based on graph data structure and characteristics according to claim 1, wherein: in the step S2, the formula of feature stacking for the same dimension of the attention feature and the deep feature by the feature stacking module is as follows:；
Wherein Z represents a stacking feature,r represents a real number, N represents the number of nodes of the graph data, and d represents a characteristic dimension; /(I)Representing a multi-layer perceptron; /(I)Representing a splicing operation; /(I)Representing a attention feature; /(I)Representing deep features.
6. the method for detecting abnormal condition of financial network based on graph data structure and characteristics according to claim 1, wherein: in the step S2, the formula for performing linear transformation and normalization on the stacking feature by the prediction output module is as follows:；
Wherein,representing the result of detecting the abnormality of the financial network,/>R represents a real number, and N represents the number of nodes of the graph data;Representing a normalization function; z represents a stacking feature; /(I)Representing weight vector,/>D represents a feature dimension; b represents bias,/>。
7. the method for detecting abnormal condition of financial network based on graph data structure and characteristics according to claim 1, wherein: the loss function is a cross entropy loss function, and the formula is:；
Wherein,representing a loss value; /(I)representing a cross entropy loss function; y represents a label of node labeling of graph data,/>，/>A label representing an nth node; p represents the result of the financial network anomaly detection,，/>And the financial network abnormality detection result of the nth node is represented.
8. the method for detecting abnormal condition of financial network based on graph data structure and characteristics according to claim 1, wherein: the super-parameters at least comprise a random inactivation rate, a weight attenuation rate and a learning rate.
9. the method for detecting abnormal condition of financial network based on graph data structure and characteristics according to claim 1, wherein: the training of the financial network anomaly detection model based on the data set specifically comprises the following steps:
Based on 5:3:2 dividing the data set into a training set, a verification set and a test set, training a financial network anomaly detection model by using the training set, and continuously optimizing a loss function, an optimizer function and super parameters of the financial network anomaly detection model in the training process until a preset convergence condition is met;
After the trained financial network anomaly detection model is verified by the verification set, the verified financial network anomaly detection model is tested by the test set, and if the test is passed, the training of the financial network anomaly detection model is finished; if the test does not pass, the training set is expanded to continue training the financial network anomaly detection model.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410198158.8A CN117763486A (en) | 2024-02-22 | 2024-02-22 | financial network anomaly detection method based on graph data structure and characteristics |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410198158.8A CN117763486A (en) | 2024-02-22 | 2024-02-22 | financial network anomaly detection method based on graph data structure and characteristics |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117763486A true CN117763486A (en) | 2024-03-26 |
Family
ID=90326147
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410198158.8A Pending CN117763486A (en) | 2024-02-22 | 2024-02-22 | financial network anomaly detection method based on graph data structure and characteristics |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117763486A (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108038700A (en) * | 2017-12-22 | 2018-05-15 | 上海前隆信息科技有限公司 | A kind of anti-fraud data analysing method and system |
| US20190311367A1 (en) * | 2015-06-20 | 2019-10-10 | Quantiply Corporation | System and method for using a data genome to identify suspicious financial transactions |
| CN113792089A (en) * | 2021-09-16 | 2021-12-14 | 平安银行股份有限公司 | Illegal behavior detection method, device, equipment and medium based on artificial intelligence |
| CN116467666A (en) * | 2023-04-28 | 2023-07-21 | 浙江大学 | Graph anomaly detection method and system based on integrated learning and active learning |
| CN116992377A (en) * | 2022-05-01 | 2023-11-03 | 罗伯特·博世有限公司 | Method and system for graph level anomaly detection |
| CN117272204A (en) * | 2023-09-22 | 2023-12-22 | 中国电信股份有限公司 | Abnormal data detection method, device, storage medium and electronic equipment |
-
2024
- 2024-02-22 CN CN202410198158.8A patent/CN117763486A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20190311367A1 (en) * | 2015-06-20 | 2019-10-10 | Quantiply Corporation | System and method for using a data genome to identify suspicious financial transactions |
| CN108038700A (en) * | 2017-12-22 | 2018-05-15 | 上海前隆信息科技有限公司 | A kind of anti-fraud data analysing method and system |
| CN113792089A (en) * | 2021-09-16 | 2021-12-14 | 平安银行股份有限公司 | Illegal behavior detection method, device, equipment and medium based on artificial intelligence |
| CN116992377A (en) * | 2022-05-01 | 2023-11-03 | 罗伯特·博世有限公司 | Method and system for graph level anomaly detection |
| CN116467666A (en) * | 2023-04-28 | 2023-07-21 | 浙江大学 | Graph anomaly detection method and system based on integrated learning and active learning |
| CN117272204A (en) * | 2023-09-22 | 2023-12-22 | 中国电信股份有限公司 | Abnormal data detection method, device, storage medium and electronic equipment |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Wang et al. | Heterogeneous network representation learning approach for ethereum identity identification | |
| CN108053318B (en) | Method and device for identifying abnormal transactions | |
| CN110414780B (en) | Fraud detection method based on generation of financial transaction data against network | |
| CN111612041A (en) | Abnormal user identification method and device, storage medium and electronic equipment | |
| CN102012918A (en) | System and method for excavating and executing rule | |
| CN111292195A (en) | Risk account identification method and device | |
| CN112819024B (en) | Model processing method, user data processing method and device and computer equipment | |
| CN112148997B (en) | Training method and device for multi-modal countermeasure model for disaster event detection | |
| CN113918367A (en) | Large-scale system log anomaly detection method based on attention mechanism | |
| CN116996325B (en) | Network security detection method and system based on cloud computing | |
| CN113628059A (en) | Associated user identification method and device based on multilayer graph attention network | |
| CN116628597A (en) | Heterogeneous graph node classification method based on relationship path attention | |
| CN113343123B (en) | Training method and detection method for generating confrontation multiple relation graph network | |
| CN110956543A (en) | Method for detecting abnormal transaction | |
| CN113268370A (en) | Root cause alarm analysis method, system, equipment and storage medium | |
| CN116074092B (en) | Attack scene reconstruction system based on heterogram attention network | |
| CN117763486A (en) | financial network anomaly detection method based on graph data structure and characteristics | |
| CN114841705B (en) | Anti-fraud monitoring method based on scene recognition | |
| CN115310606A (en) | Deep learning model depolarization method and device based on data set sensitive attribute reconstruction | |
| CN115603955A (en) | Abnormal access object identification method, device, equipment and medium | |
| CN114066075A (en) | Customer loss prediction method based on deep learning | |
| Zhang et al. | A fault diagnosis model of pumping unit based on bp neural network | |
| CN117291615B (en) | Visual contrast analysis method and device for overcoming anti-fraud based on network payment | |
| Murkute et al. | Credit Card Fraud Detection Using Machine Learning Techniques | |
| Dong et al. | Rumor Detection with Adversarial Training and Supervised Contrastive Learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |