CN113627950A - Method and system for extracting user transaction characteristics based on dynamic graph - Google Patents
Method and system for extracting user transaction characteristics based on dynamic graph Download PDFInfo
- Publication number
- CN113627950A CN113627950A CN202110711026.7A CN202110711026A CN113627950A CN 113627950 A CN113627950 A CN 113627950A CN 202110711026 A CN202110711026 A CN 202110711026A CN 113627950 A CN113627950 A CN 113627950A
- Authority
- CN
- China
- Prior art keywords
- time
- information
- node
- snapshot
- aggregation
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 44
- 230000002776 aggregation Effects 0.000 claims abstract description 67
- 238000004220 aggregation Methods 0.000 claims abstract description 67
- 230000004931 aggregating effect Effects 0.000 claims abstract description 28
- 238000004590 computer program Methods 0.000 claims description 18
- 238000004364 calculation method Methods 0.000 claims description 12
- 238000000605 extraction Methods 0.000 claims description 10
- 230000006870 function Effects 0.000 claims description 7
- 238000010606 normalization Methods 0.000 claims description 4
- 238000012545 processing Methods 0.000 claims description 4
- 238000010586 diagram Methods 0.000 description 16
- 230000008569 process Effects 0.000 description 4
- 238000013145 classification model Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 3
- 230000018109 developmental process Effects 0.000 description 3
- 230000011218 segmentation Effects 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 230000001360 synchronised effect Effects 0.000 description 2
- 230000006399 behavior Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000012512 characterization method Methods 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000002349 favourable effect Effects 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000006116 polymerization reaction Methods 0.000 description 1
- 239000013589 supplement Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/018—Certifying business or products
- G06Q30/0185—Product, service or business identity fraud
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/048—Activation functions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Strategic Management (AREA)
- Marketing (AREA)
- Economics (AREA)
- General Engineering & Computer Science (AREA)
- General Business, Economics & Management (AREA)
- Life Sciences & Earth Sciences (AREA)
- Development Economics (AREA)
- Technology Law (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Entrepreneurship & Innovation (AREA)
- Mathematical Physics (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Software Systems (AREA)
- Computational Linguistics (AREA)
- Biophysics (AREA)
- Computing Systems (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The application relates to a method and a system for extracting user transaction characteristics based on a dynamic graph, wherein the method comprises the following steps: acquiring a transaction rapid graph, aggregating nodes of the rapid graph and adjacent point information of the nodes in each time period, and calculating node structure information of each time period according to the information; then, aggregating all time periods to obtain a snapshot graph of the aggregation time, and calculating node structure information of node aggregation neighbors in the snapshot graph of the aggregation time; and finally, aggregating the time information of the nodes in the transaction snapshot graph to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the transaction time comprises each time period and the time after each time period is aggregated. By the method and the device, the problem that the time dimension information of the characteristics is lack of description under the condition of predicting the transaction anti-fraud is solved, and the transaction safety of the user is improved.
Description
Technical Field
The application relates to the technical field of information security, in particular to a method and a system for extracting user transaction characteristics based on a dynamic graph.
Background
With the rapid development of computer technology, the development of internet finance is also changing day by day, and although financial transactions conducted on the internet are convenient and rapid, a lot of financial fraud which is too defensive is also brought along. Therefore, in order to reduce the probability of fraud for users, in transaction anti-fraud, data of graph structures are usually used as supplements to the user transaction information features, so that the structure or feature attributes on the graph can be extracted more abundantly.
In the related art, the calculation is usually performed based on a static graph, however, this calculation method ignores an important information, i.e., a time information.
At present, an effective solution is not provided aiming at the problem that characterization time dimension information is lacked under the condition of predicting transaction anti-fraud in the related technology.
Disclosure of Invention
The embodiment of the application provides a method and a system for extracting user transaction characteristics based on a dynamic graph, which are used for at least solving the problem that time dimension information of characteristics is lacked to be drawn under the condition that anti-fraud of transactions is predicted in the related technology.
In a first aspect, an embodiment of the present application provides a method for extracting user transaction features based on a dynamic graph, where the method includes:
acquiring a transaction rapid graph, aggregating nodes of the rapid graph and adjacent point information of the nodes in each time period, and calculating node structure information of each time period according to the information;
aggregating the time periods to obtain a snapshot of the aggregation time, and calculating node structure information of the node aggregation neighbors in the snapshot of the aggregation time;
and aggregating the time information of the nodes to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the time comprises each time period and the aggregation time.
In some embodiments, the calculating node structure information of the respective time periods through the information, and calculating node structure information of a node aggregation neighboring point in the aggregation time snapshot includes:
calculating an attention coefficient between nodes in the snapshot map, and performing normalization processing on the attention coefficient to obtain a normalized attention coefficient;
and aggregating the adjacent point information of the node according to the normalized attention coefficient to obtain the node structure information.
In some embodiments, the calculating the node timing characteristic information according to the time snapshot information includes:
calculating a self-attention coefficient between the node and the rest time in each time period, and carrying out normalization processing on the self-attention coefficient to obtain a normalized self-attention coefficient;
and aggregating the time information of the node according to the normalized self-attention coefficient to obtain the time sequence characteristic information of the node.
In some of these embodiments, prior to calculating the self-attention coefficient between the node and the rest of the time at each time period, the method includes:
and selecting the aggregation time, and selecting the corresponding aggregation time according to the time period information of the node.
In some embodiments, the aggregating the time information of the nodes, and obtaining the time snapshot information includes:
and acquiring node information of the node in the snap map of each time period and node information of the node in the snap map of the aggregation time to obtain time snapshot information of the node.
In some embodiments, the obtaining the transaction snapshot map comprises:
the method comprises the steps of obtaining a group of ordered transaction dynamic snapshot graphs, and dividing the transaction snapshot graphs according to time intervals, wherein the time division intervals of the transaction snapshot graphs and the number of the transaction snapshot graphs can be set according to business requirements.
In some embodiments, after the node structure information and the node timing characteristic information are calculated, the method includes:
and adding a classifier after the calculated node characteristic information, and performing loss function calculation on the node characteristic information to obtain a loss value.
In a second aspect, an embodiment of the present application provides a system for user transaction feature extraction based on a dynamic graph, where the system includes:
the structure characteristic module is used for acquiring the transaction snap map, aggregating the nodes of the snap map and the adjacent point information of the nodes in each time period, calculating the node structure information of each time period according to the information,
aggregating the time periods to obtain a snapshot of the aggregation time, and calculating node structure information of the node aggregation neighbors in the snapshot of the aggregation time;
and the time sequence characteristic module is used for aggregating the time information of the nodes to obtain time snapshot information and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the time comprises each time period and the aggregation time.
In a third aspect, an embodiment of the present application provides an electronic device, which includes a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor, when executing the computer program, implements the method for extracting user transaction characteristics based on dynamic graphs as described in the first aspect.
In a fourth aspect, the present application provides a storage medium, on which a computer program is stored, which when executed by a processor, implements the method for user transaction feature extraction based on dynamic graph as described in the first aspect above.
Compared with the related technology, the method for extracting the user transaction characteristics based on the dynamic graph, provided by the embodiment of the application, is used for obtaining the transaction snapshot, aggregating the nodes of the snapshot and the neighbor point information of the nodes in each time period, and calculating the node structure information in each time period through the information; then, aggregating all time periods to obtain a snapshot graph of the aggregation time, and calculating node structure information of node aggregation neighbors in the snapshot graph of the aggregation time; and finally, aggregating the time information of the nodes in the transaction snapshot graph to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the transaction time comprises each time period and the time after each time period is aggregated.
The method comprises the steps of representing a transaction dynamic graph by using a group of ordered transaction fast graphs based on discrete time, aggregating node information and time information in the transaction dynamic graph in each time period, and calculating to obtain node structure characteristics and time sequence characteristics, wherein the dimension of a time interval is added when the node structure and the time sequence characteristic information are calculated, so that the influence of time on characteristic calculation can be better described; furthermore, by using the aggregation time chart, the data structure damaged due to segmentation in the transaction snapshot chart is complemented, so that the extraction of the related transaction characteristics is more comprehensive, the subsequent characteristic identification and classification are facilitated, and the prediction capability of the model is improved.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the application and together with the description serve to explain the application and not to limit the application. In the drawings:
FIG. 1 is a flow diagram of a method for dynamic graph-based user transaction feature extraction according to an embodiment of the present application;
FIG. 2 is a schematic diagram of a user transaction graph according to an embodiment of the application;
FIG. 3 is a schematic diagram of an aggregated time snapshot according to an embodiment of the present application;
fig. 4 is a schematic diagram of node time information aggregation according to an embodiment of the present application;
FIG. 5 is a block diagram of a system for dynamic graph-based user transaction feature extraction according to an embodiment of the present application;
fig. 6 is an internal structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments provided in the present application without any inventive step are within the scope of protection of the present application. Moreover, it should be appreciated that in the development of any such actual implementation, as in any engineering or design project, numerous implementation-specific decisions must be made to achieve the developers' specific goals, such as compliance with system-related and business-related constraints, which may vary from one implementation to another.
Reference in the specification to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the specification. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Those of ordinary skill in the art will explicitly and implicitly appreciate that the embodiments described herein may be combined with other embodiments without conflict.
Unless defined otherwise, technical or scientific terms referred to herein shall have the ordinary meaning as understood by those of ordinary skill in the art to which this application belongs. Reference to "a," "an," "the," and similar words throughout this application are not to be construed as limiting in number, and may refer to the singular or the plural. The present application is directed to the use of the terms "including," "comprising," "having," and any variations thereof, which are intended to cover non-exclusive inclusions; for example, a process, method, system, article, or apparatus that comprises a list of steps or modules (elements) is not limited to the listed steps or elements, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus. Reference to "connected," "coupled," and the like in this application is not intended to be limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. Reference herein to "a plurality" means greater than or equal to two. "and/or" describes an association relationship of associated objects, meaning that three relationships may exist, for example, "A and/or B" may mean: a exists alone, A and B exist simultaneously, and B exists alone. Reference herein to the terms "first," "second," "third," and the like, are merely to distinguish similar objects and do not denote a particular ordering for the objects.
The application provides a method for extracting user transaction characteristics based on a dynamic graph, and fig. 1 is a flowchart of a method for extracting user transaction characteristics based on a dynamic graph according to an embodiment of the application, and as shown in fig. 1, the flowchart includes the following steps:
step S101, acquiring a transaction rapid graph, aggregating nodes of the rapid graph and neighbor point information of the nodes in each time period, and calculating node structure information of each time period according to the information; it should be noted that the time period herein may be divided according to actual situations, and is not particularly limited.
Preferably, in the present embodiment, the time periods are divided by hour, table 1 is trade snapshot information according to an embodiment of the present application, as shown in table 1 below, the trade snapshot in the present embodiment may be divided into 3 part time snapshots, i.e., t1 ═ 5:02,5:10,5:36}, t2 ═ 6:10,6:30}, and t3 ═ 7:20,7:44,7:58}, where, optionally, the time divisions and the number of snapshots may be autonomously defined according to business requirements. The point-side information in table 1, for example, the a-b sides, is an interactive transaction between users, through which a graph of user transactions can be constructed, and fig. 2 is a schematic diagram of a user transaction graph according to an embodiment of the present application, as shown in fig. 2.
TABLE 1
| Time | Point-to-edge information | Snapshot index | Intra-snapshot index |
| 5:02 | a-b；b-c； | t1 | T1-1 |
| 5:10 | b-e；c-f； | t1 | T1-2 |
| 5:36 | a-b； | t1 | T1-3 |
| 6:10 | a-b； | t2 | T2-1 |
| 6:30 | b-d； | t2 | T2-2 |
| 7:20 | a-b；b-f | t3 | T3-1 |
| 7:44 | c-g；c-e； | t3 | T3-2 |
| 7:58 | e-f； | t3 | T3-3 |
In this embodiment, after the transaction snapshots shown in table 1 and fig. 2 are obtained, the above-mentioned t1, t2, and t3 are aggregated, the node and the neighbor point information of the node of the transaction snapshot in 3 time periods are calculated, and the node structure information of the 3 time periods is calculated through these information.
Optionally, the specific operation of calculating the node structure information of the 3 time periods includes:
s1, calculating an attention coefficient e between each node in the trading fast graphijAs shown in the following formulas 1 and 2:
eij＝σ(Aij*αT[Ws hj||Ws hj||ΦΔt]) (1)
ΦΔt＝cos(Wt*Δt) (2)
wherein, sigma represents sigmoid function, alpha, Ws、WtParameters to be learned for the model; i represents concat feature splicing; deltatRepresenting a time interval, e.g. the edge a-b of the 5:36 transaction snapshot in Table 1, time interval ΔtIf multiple events occur in the same snapshot, taking the occurrence time of the last event; a. theijThe weight representing the edge is determined by the number of events that occur in the snapshot within each time period, shown in Table 1, and the weight A of the a-b edge within the t1 time periodab2, the weight of the a-b side in the t2 time period and the t3 time period is 1;
s2, normalizing the attention coefficient to obtain a normalized attention coefficient alphaijAs shown in the following formula 3:
wherein,
a neighbor node representing a j node;
s3, according to the obtained normalized attention coefficient and the neighbor point information of the aggregation node, obtaining the node structure information X of the aggregation neighbor pointiAs shown in the following formula 4:
where σ denotes sigmoid function, hiRepresenting the initial characteristics of the inode.
In the embodiment, when the node structure characteristic information in the snapshot map is calculated, the time interval dimension is added, so that the influence of time change in the model can be better described, and the data prediction capability is improved;
step S102, aggregating all time periods to obtain a snapshot graph of the aggregation time, and calculating node structure information of node aggregation neighbors in the snapshot graph of the aggregation time;
in step S101, structural feature information of node aggregation neighbors in each time period of the transaction snapshot is calculated, however, due to the division of the transaction snapshot, some important relationships may also be split, and therefore, in order to complete a data structure that may be damaged in the snapshot, in this embodiment, each time period is aggregated, so as to obtain a snapshot of aggregation time. FIG. 3 is a diagram of an aggregated time snapshot according to an embodiment of the present application, where at time t1, the aggregated time snapshot is all events occurring within the time period t1, as shown in FIG. 3; at time t2, the aggregate snapshot is all events that occurred during the time period t1+ t 2; by analogy, at time t3, the aggregate time snapshot is all events that occurred during the time period t1+ t2+ t 3.
After the transaction snapshot with the elapsed time aggregation is obtained, the node structure feature information of the node aggregation neighboring points in the aggregation time snapshot is calculated according to the specific operation of calculating the node structure information of different time periods in step S101. It should be noted that, for a specific example of the calculation operation in this embodiment, reference may be made to the embodiment in step S101, and this embodiment is not described herein again;
step S103, aggregating the time information of the nodes to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the time comprises each time period and aggregation time;
after the aggregation of the structure information of the transaction snapshot is completed, in this embodiment, it is necessary to aggregate the time information of the node, obtain the node information of the node in the snapshot at each time period and the node information of the snapshot at the aggregation time, and obtain the time snapshot information of the node. Specifically, fig. 4 is a schematic diagram of node time information aggregation according to an embodiment of the present application, and as shown in fig. 4, information of a node in each snapshot is selected, for example, the node a is selected to include node information of t1, t2, t3, and t aggregation in a time period, where t1, t2, and t3 are node information after aggregation of neighboring points for nodes in the snapshot in each time period, and t aggregation is node information in an aggregation time snapshot. Preferably, the present embodiment calculates the node timing characteristic information according to the time information of t1, t2, t3 and t aggregation obtained as described above.
Optionally, the specific operation of calculating the node timing characteristic information in the transaction snapshot graph according to the 4 pieces of time information includes:
s1, calculating self-attention coefficients between the nodes in each time period and the rest time, for example, calculating self-attention coefficients between a node at the time point t1 and a node at the time point { t2, a node at the time point t3 and a node at the time point t aggregation);
the self-orientation coefficient in this example was calculated as shown in the following formulas 5 to 8:
Query＝XvWq (5)
Key＝XvWk (6)
wherein, XvAggregating the neighbor node characteristics for the node v in the time snapshot; wq、WkParameters to be learned; d represents a scaling factor which can be equal to the characteristic dimension of Query and can also be self-defined; mijAnd (3) evaluating whether the event occurred at the node is after the time t, and if the event occurred after the time t, not calculating the corresponding attention value. For example, when calculating the attention value of the a-node at time t1, the attention value of the a-node at time t2 cannot be calculated
And attention value at time t3
Because the event occurred at node a at time t1 has not occurred at times t2 and t3, the attention value of (1) is not reached，
S2, normalizing the self-attention coefficient to obtain a normalized self-attention coefficient
As shown in the following formula 9:
wherein i and j represent time;
s3, according to the normalized self-attention coefficient obtained by the calculation and the time information of the aggregation node, obtaining the time sequence characteristic information of the node
As shown in the following formula 10:
wherein,
representing the characteristics of node v at time i.
In some embodiments, before calculating the self-attribute coefficient between the node and the rest time in each time period, the aggregation time needs to be selected, and the corresponding aggregation time is selected according to the information of the time period in which the node is located. For example, when node information at time a at t1 is calculated, t aggregation selects the snap map with aggregation time t1 in fig. 3; if the node information at the time a of t2 is calculated, t aggregation selects the snap map of the aggregation time t2 in FIG. 3; and so on to select the polymerization time.
Preferably, after the node structure information and the node time sequence characteristic information are obtained through the calculation, a classifier is added after the node characteristic information, the transaction behavior is predicted, and the loss function calculation is performed on the node characteristic information to obtain the loss value.
In some embodiments, node features of known tags are predicted through a supervised classification model, and a loss value between a prediction result and a real tag is calculated through cross entry. Specifically, the class of a known user, such as a fraudulent user or a good user, is predicted according to a model to obtain a predicted result, cross entry is adopted to calculate a loss value between the predicted result and a real label, network parameters are continuously learned through back propagation to obtain a trained model, and the user node of the unknown class is predicted again through the model. In the embodiment, by adopting the supervised classification model, more situations of the real label can be learned, and the prediction of the model is more accurate, but in the actual situation, the acquisition of the real label is difficult and is difficult to realize.
In some embodiments, the node feature information is predicted through an unsupervised classification model, and a Loss function Loss is calculated, as shown in the following formula 11:
wherein i, j belongs to edge and indicates that there is an edge connection between i and j, and u and v belongs to neg and indicates that there is no connection between u and v and the edges are negatively sampled.
The embodiment adopts an unsupervised model, can pay more attention to information on graph structures and time changes, and pay more attention to the properties of the graph, and is favorable for the accuracy of a prediction result.
Through the steps S101 to S103, the transaction dynamic graph is represented by an ordered group of transaction rapid graphs based on discrete time, and the time dimension is added to the application of transaction anti-fraud through the dynamic graph; in addition, the aggregation time graph is used, the data structure damaged due to segmentation in the transaction snapshot is complemented, the dimension of a time interval is added when the node characteristics are calculated, the influence of time on characteristic calculation is better described, the problem that the time dimension information of the characteristics is lack of description under the condition of predicting transaction anti-fraud is solved, the transaction characteristic information in network data can be better described through the time dimension, the prediction capability of anti-fraud in model prediction is improved, and the transaction safety of a user is improved.
It should be noted that the steps illustrated in the above-described flow diagrams or in the flow diagrams of the figures may be performed in a computer system, such as a set of computer-executable instructions, and that, although a logical order is illustrated in the flow diagrams, in some cases, the steps illustrated or described may be performed in an order different than here.
The embodiment also provides a system for extracting user transaction characteristics based on a dynamic graph, which is used for implementing the above embodiments and preferred embodiments, and the description of the system that has been already made is omitted. As used hereinafter, the terms "module," "unit," "subunit," and the like may implement a combination of software and/or hardware for a predetermined function. Although the means described in the embodiments below are preferably implemented in software, an implementation in hardware, or a combination of software and hardware is also possible and contemplated.
Fig. 5 is a block diagram of a system for extracting user transaction characteristics based on a dynamic graph according to an embodiment of the present application, and as shown in fig. 5, the system includes a structural characteristic module 51 and a time sequence characteristic module 52:
the structure characteristic module 51 is configured to obtain a transaction snapshot, aggregate nodes of the snapshot in each time period and neighbor point information of the nodes, calculate node structure information in each time period according to the information, aggregate each time period to obtain a snapshot of aggregation time, and calculate node structure information of a node aggregation neighbor point in the snapshot of aggregation time; and the time sequence characteristic module 52 is configured to aggregate the time information of the nodes to obtain time snapshot information, and calculate and obtain node time sequence characteristic information according to the time snapshot information, where the time includes each time period and aggregation time.
By the system, the transaction dynamic graph is represented by an ordered group of transaction rapid graphs based on discrete time, and the time dimension is added to the application of transaction anti-fraud by using the dynamic graph; in addition, the aggregation time graph is used, the data structure damaged due to segmentation in the transaction snapshot is complemented, the dimension of a time interval is added when the node characteristics are calculated, the influence of time on characteristic calculation is better described, the problem that the time dimension information of the characteristics is lack of description under the condition of predicting transaction anti-fraud is solved, the transaction characteristic information in network data can be better described through the time dimension, the prediction capability of anti-fraud in model prediction is improved, and the transaction safety of a user is improved.
It should be noted that, for specific examples in this embodiment, reference may be made to examples described in the foregoing embodiments and optional implementations, and details of this embodiment are not described herein again.
Note that each of the modules may be a functional module or a program module, and may be implemented by software or hardware. For a module implemented by hardware, the modules may be located in the same processor; or the modules can be respectively positioned in different processors in any combination.
The present embodiment also provides an electronic device comprising a memory having a computer program stored therein and a processor configured to execute the computer program to perform the steps of any of the above method embodiments.
Optionally, the electronic apparatus may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.
In addition, in combination with the method for extracting user transaction characteristics based on a dynamic graph in the foregoing embodiment, the embodiment of the present application may provide a storage medium to implement. The storage medium having stored thereon a computer program; the computer program, when executed by a processor, implements any of the above-described embodiments of a method for dynamic graph-based user transaction feature extraction.
In one embodiment, a computer device is provided, which may be a terminal. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method for dynamic graph-based user transaction feature extraction. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.
In an embodiment, fig. 6 is a schematic internal structure diagram of an electronic device according to an embodiment of the present application, and as shown in fig. 6, there is provided an electronic device, which may be a server, and its internal structure diagram may be as shown in fig. 6. The electronic device comprises a processor, a network interface, an internal memory and a non-volatile memory connected by an internal bus, wherein the non-volatile memory stores an operating system, a computer program and a database. The processor is used for providing calculation and control capability, the network interface is used for communicating with an external terminal through network connection, the internal memory is used for providing an environment for an operating system and the running of a computer program, the computer program is executed by the processor to realize a method for extracting user transaction characteristics based on the dynamic graph, and the database is used for storing data.
Those skilled in the art will appreciate that the configuration shown in fig. 6 is a block diagram of only a portion of the configuration associated with the present application, and does not constitute a limitation on the electronic device to which the present application is applied, and a particular electronic device may include more or less components than those shown in the drawings, or may combine certain components, or have a different arrangement of components.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
It should be understood by those skilled in the art that various features of the above-described embodiments can be combined in any combination, and for the sake of brevity, all possible combinations of features in the above-described embodiments are not described in detail, but rather, all combinations of features which are not inconsistent with each other should be construed as being within the scope of the present disclosure.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (10)
1. A method for extracting user transaction characteristics based on a dynamic graph is characterized by comprising the following steps:
acquiring a transaction rapid graph, aggregating nodes of the rapid graph and adjacent point information of the nodes in each time period, and calculating node structure information of each time period according to the information;
aggregating the time periods to obtain a snapshot of the aggregation time, and calculating node structure information of the node aggregation neighbors in the snapshot of the aggregation time;
and aggregating the time information of the nodes to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the time comprises each time period and the aggregation time.
2. The method according to claim 1, wherein said calculating node structure information of each time segment according to the information, and calculating node structure information of a node aggregation neighbor in the aggregation time snapshot comprises:
calculating an attention coefficient between nodes in the snapshot map, and performing normalization processing on the attention coefficient to obtain a normalized attention coefficient;
and aggregating the adjacent point information of the node according to the normalized attention coefficient to obtain the node structure information.
3. The method of claim 1, wherein the calculating node timing characteristic information from the time snapshot information comprises:
calculating a self-attention coefficient between the node and the rest time in each time period, and carrying out normalization processing on the self-attention coefficient to obtain a normalized self-attention coefficient;
and aggregating the time information of the node according to the normalized self-attention coefficient to obtain the time sequence characteristic information of the node.
4. The method of claim 3, wherein prior to calculating the self-attention coefficient between the node and the rest of the time at each time period, the method comprises:
and selecting the aggregation time, and selecting the corresponding aggregation time according to the time period information of the node.
5. The method of claim 1, wherein aggregating the time information of the nodes to obtain time snapshot information comprises:
and acquiring node information of the node in the snap map of each time period and node information of the node in the snap map of the aggregation time to obtain time snapshot information of the node.
6. The method of claim 1, wherein obtaining the snapshot of the transaction comprises:
the method comprises the steps of obtaining a group of ordered transaction dynamic snapshot graphs, and dividing the transaction snapshot graphs according to time intervals, wherein the time division intervals of the transaction snapshot graphs and the number of the transaction snapshot graphs can be set according to business requirements.
7. The method of claim 1, wherein after the node structure information and the node timing characteristic information are calculated, the method comprises:
and adding a classifier after the calculated node characteristic information, and performing loss function calculation on the node characteristic information to obtain a loss value.
8. A system for user transaction feature extraction based on a dynamic graph, the system comprising:
the structure characteristic module is used for acquiring the transaction snap map, aggregating the nodes of the snap map and the adjacent point information of the nodes in each time period, calculating the node structure information of each time period according to the information,
aggregating the time periods to obtain a snapshot of the aggregation time, and calculating node structure information of the node aggregation neighbors in the snapshot of the aggregation time;
and the time sequence characteristic module is used for aggregating the time information of the nodes to obtain time snapshot information and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the time comprises each time period and the aggregation time.
9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to perform the method for dynamic graph-based user transaction feature extraction according to any one of claims 1 to 7.
10. A storage medium having a computer program stored thereon, wherein the computer program is configured to perform the method for dynamic graph-based user transaction feature extraction according to any one of claims 1 to 7 when executed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110711026.7A CN113627950B (en) | 2021-06-25 | 2021-06-25 | Method and system for extracting user transaction characteristics based on dynamic diagram |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110711026.7A CN113627950B (en) | 2021-06-25 | 2021-06-25 | Method and system for extracting user transaction characteristics based on dynamic diagram |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113627950A true CN113627950A (en) | 2021-11-09 |
| CN113627950B CN113627950B (en) | 2023-12-29 |
Family
ID=78378399
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110711026.7A Active CN113627950B (en) | 2021-06-25 | 2021-06-25 | Method and system for extracting user transaction characteristics based on dynamic diagram |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113627950B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114675942A (en) * | 2022-03-23 | 2022-06-28 | 支付宝(杭州)信息技术有限公司 | Group identification method and system based on dynamic graph |
| CN118115273A (en) * | 2024-03-05 | 2024-05-31 | 深圳市蜂凡科技有限公司 | User transaction data feature extraction method and system based on dynamic graph |
Citations (23)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB9324949D0 (en) * | 1993-12-06 | 1994-01-26 | Tregellas George D R | Card security |
| JPH08273075A (en) * | 1995-03-31 | 1996-10-18 | Tokyu Community-:Kk | Home security system |
| WO2000019324A1 (en) * | 1998-09-28 | 2000-04-06 | Argus Systems Group, Inc. | Trusted compartmentalized computer operating system |
| JP2007074555A (en) * | 2005-09-08 | 2007-03-22 | Sony Corp | Flicker reduction method, flicker reduction circuit and imaging apparatus |
| US20070253595A1 (en) * | 2006-04-18 | 2007-11-01 | Sorensen Associates Inc | Still Image Queue Analysis System and Method |
| US20120150699A1 (en) * | 2010-12-10 | 2012-06-14 | Roland Trapp | Inventory verification using inventory snapshots |
| US20130103570A1 (en) * | 2011-10-21 | 2013-04-25 | Discover Financial Services | System and method for determining credit quality index |
| US20130124263A1 (en) * | 2011-11-14 | 2013-05-16 | Visa International Service Association | Systems and Methods to Summarize Transaction data |
| US20130179246A1 (en) * | 2012-01-09 | 2013-07-11 | Bank Of America Corporation | Providing targeted offers based on aggregate demand and aggregate supply |
| US20160321747A1 (en) * | 2015-04-28 | 2016-11-03 | Trading Technologies International Inc. | Systems and methods to display chart bars with variable scaling and/or aggregation |
| WO2016183473A1 (en) * | 2015-05-13 | 2016-11-17 | Retailmenot, Inc. | Modulating mobile-device displays based on ambient signals to reduce the likelihood of fraud |
| US20170140382A1 (en) * | 2015-11-12 | 2017-05-18 | International Business Machines Corporation | Identifying transactional fraud utilizing transaction payment relationship graph link prediction |
| WO2017217169A1 (en) * | 2016-06-15 | 2017-12-21 | ソニー株式会社 | Information processing device, method, and program |
| CN110210227A (en) * | 2019-06-11 | 2019-09-06 | 百度在线网络技术（北京）有限公司 | Risk checking method, device, equipment and storage medium |
| US20190295114A1 (en) * | 2016-12-02 | 2019-09-26 | Stack Fintech Inc. | Digital banking platform and architecture |
| US20200005295A1 (en) * | 2017-02-10 | 2020-01-02 | Jean Louis Murphy | Secure location based electronic financial transaction methods and systems |
| JP2020009272A (en) * | 2018-07-10 | 2020-01-16 | ネットスマイル株式会社 | System, method, and program for predicting transaction market |
| CN111260462A (en) * | 2020-01-16 | 2020-06-09 | 东华大学 | Transaction fraud detection method based on heterogeneous relation network attention mechanism |
| CN111340509A (en) * | 2020-05-22 | 2020-06-26 | 支付宝(杭州)信息技术有限公司 | False transaction identification method and device and electronic equipment |
| CN111782611A (en) * | 2020-06-30 | 2020-10-16 | 北京百度网讯科技有限公司 | Prediction model modeling method, device, equipment and storage medium |
| US20210027145A1 (en) * | 2018-03-22 | 2021-01-28 | China Unionpay Co., Ltd. | Fraudulent transaction detection method based on sequence wide and deep learning |
| CN112598526A (en) * | 2021-03-04 | 2021-04-02 | 蚂蚁智信(杭州)信息技术有限公司 | Asset data processing method and device |
| CN112766172A (en) * | 2021-01-21 | 2021-05-07 | 北京师范大学 | Face continuous expression recognition method based on time sequence attention mechanism |
-
2021
- 2021-06-25 CN CN202110711026.7A patent/CN113627950B/en active Active
Patent Citations (23)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB9324949D0 (en) * | 1993-12-06 | 1994-01-26 | Tregellas George D R | Card security |
| JPH08273075A (en) * | 1995-03-31 | 1996-10-18 | Tokyu Community-:Kk | Home security system |
| WO2000019324A1 (en) * | 1998-09-28 | 2000-04-06 | Argus Systems Group, Inc. | Trusted compartmentalized computer operating system |
| JP2007074555A (en) * | 2005-09-08 | 2007-03-22 | Sony Corp | Flicker reduction method, flicker reduction circuit and imaging apparatus |
| US20070253595A1 (en) * | 2006-04-18 | 2007-11-01 | Sorensen Associates Inc | Still Image Queue Analysis System and Method |
| US20120150699A1 (en) * | 2010-12-10 | 2012-06-14 | Roland Trapp | Inventory verification using inventory snapshots |
| US20130103570A1 (en) * | 2011-10-21 | 2013-04-25 | Discover Financial Services | System and method for determining credit quality index |
| US20130124263A1 (en) * | 2011-11-14 | 2013-05-16 | Visa International Service Association | Systems and Methods to Summarize Transaction data |
| US20130179246A1 (en) * | 2012-01-09 | 2013-07-11 | Bank Of America Corporation | Providing targeted offers based on aggregate demand and aggregate supply |
| US20160321747A1 (en) * | 2015-04-28 | 2016-11-03 | Trading Technologies International Inc. | Systems and methods to display chart bars with variable scaling and/or aggregation |
| WO2016183473A1 (en) * | 2015-05-13 | 2016-11-17 | Retailmenot, Inc. | Modulating mobile-device displays based on ambient signals to reduce the likelihood of fraud |
| US20170140382A1 (en) * | 2015-11-12 | 2017-05-18 | International Business Machines Corporation | Identifying transactional fraud utilizing transaction payment relationship graph link prediction |
| WO2017217169A1 (en) * | 2016-06-15 | 2017-12-21 | ソニー株式会社 | Information processing device, method, and program |
| US20190295114A1 (en) * | 2016-12-02 | 2019-09-26 | Stack Fintech Inc. | Digital banking platform and architecture |
| US20200005295A1 (en) * | 2017-02-10 | 2020-01-02 | Jean Louis Murphy | Secure location based electronic financial transaction methods and systems |
| US20210027145A1 (en) * | 2018-03-22 | 2021-01-28 | China Unionpay Co., Ltd. | Fraudulent transaction detection method based on sequence wide and deep learning |
| JP2020009272A (en) * | 2018-07-10 | 2020-01-16 | ネットスマイル株式会社 | System, method, and program for predicting transaction market |
| CN110210227A (en) * | 2019-06-11 | 2019-09-06 | 百度在线网络技术（北京）有限公司 | Risk checking method, device, equipment and storage medium |
| CN111260462A (en) * | 2020-01-16 | 2020-06-09 | 东华大学 | Transaction fraud detection method based on heterogeneous relation network attention mechanism |
| CN111340509A (en) * | 2020-05-22 | 2020-06-26 | 支付宝(杭州)信息技术有限公司 | False transaction identification method and device and electronic equipment |
| CN111782611A (en) * | 2020-06-30 | 2020-10-16 | 北京百度网讯科技有限公司 | Prediction model modeling method, device, equipment and storage medium |
| CN112766172A (en) * | 2021-01-21 | 2021-05-07 | 北京师范大学 | Face continuous expression recognition method based on time sequence attention mechanism |
| CN112598526A (en) * | 2021-03-04 | 2021-04-02 | 蚂蚁智信(杭州)信息技术有限公司 | Asset data processing method and device |
Non-Patent Citations (10)
| Title |
|---|
| 张栗粽;王谨平;刘贵松;罗光春;卢国明;: "面向金融数据的神经网络时间序列预测模型", 计算机应用研究, no. 09 * |
| 李荆等: "基于时空建模的动态图卷积神经网络", 《北京大学学报(自然科学版)》, vol. 57, no. 4 * |
| 王成;王昌琪;: "一种面向网络支付反欺诈的自动化特征工程方法", 计算机学报, no. 10 * |
| 石拓等: "基于时序交易图注意力神经网络的以太坊恶意账户检测", 《信息网络安全》 * |
| 许佳;冯登国;苏璞睿;: "基于动态对等网层次结构的网络预警模型研究", 计算机研究与发展, no. 09 * |
| 谢林海;刘相滨;佟施;: "基于步态的身份识别技术", 计算机技术与发展, no. 09 * |
| 陈伟利等: "区块链数据分析: 现状, 趋势与挑战", 《 计算机研究与发展》, vol. 55, no. 9 * |
| 陈晋音;张敦杰;林翔;徐晓东;朱子凌;: "基于影响力最大化策略的抑制虚假消息传播的方法", 计算机科学, no. 1 * |
| 陈诗等: "时序网络中关键节点的识别方法研究进展", 《电子科技大学学报》, vol. 49, no. 2 * |
| 魏明桦;郑金贵;: "基于模糊校正的深度时序信息安全评估算法", 河海大学学报(自然科学版), no. 05 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114675942A (en) * | 2022-03-23 | 2022-06-28 | 支付宝(杭州)信息技术有限公司 | Group identification method and system based on dynamic graph |
| CN118115273A (en) * | 2024-03-05 | 2024-05-31 | 深圳市蜂凡科技有限公司 | User transaction data feature extraction method and system based on dynamic graph |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113627950B (en) | 2023-12-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11030484B2 (en) | System and method for efficient generation of machine-learning models | |
| CN112148987B (en) | Message pushing method based on target object activity and related equipment | |
| Wang et al. | Adaboost-based security level classification of mobile intelligent terminals | |
| Verstrepen et al. | Collaborative filtering for binary, positiveonly data | |
| Saha et al. | Some connectivity based cluster validity indices | |
| Ren et al. | The efficient imputation method for neighborhood-based collaborative filtering | |
| CN111814910B (en) | Abnormality detection method, abnormality detection device, electronic device, and storage medium | |
| WO2022105123A1 (en) | Text classification method, topic generation method, apparatus, device, and medium | |
| CN113627950A (en) | Method and system for extracting user transaction characteristics based on dynamic graph | |
| CN111062808B (en) | Credit card limit evaluation method, credit card limit evaluation device, computer equipment and storage medium | |
| CN108961019B (en) | User account detection method and device | |
| CN112163929B (en) | Service recommendation method, device, computer equipment and storage medium | |
| CN111611390B (en) | Data processing method and device | |
| WO2021174881A1 (en) | Multi-dimensional information combination prediction method, apparatus, computer device, and medium | |
| Yan et al. | A clustering algorithm for multi-modal heterogeneous big data with abnormal data | |
| Nielsen et al. | Efficient flexible characterization of quantum processors with nested error models | |
| CN109903169B (en) | Method, device, equipment and storage medium for settling claims and resisting fraud based on graph computing technology | |
| US20210073662A1 (en) | Machine Learning Systems and Methods for Performing Entity Resolution Using a Flexible Minimum Weight Set Packing Framework | |
| Xu et al. | Cluster-aware multiplex infomax for unsupervised graph representation learning | |
| Tang et al. | Bayesian network structure learning from big data: A reservoir sampling based ensemble method | |
| CN113011968B (en) | Account state detection method and device, storage medium and electronic equipment | |
| CN111815442B (en) | Link prediction method and device and electronic equipment | |
| Sarrias | Random parameters and spatial heterogeneity using Rchoice in R | |
| CN114090407A (en) | Interface performance early warning method based on linear regression model and related equipment thereof | |
| Clémençon et al. | Building confidence regions for the ROC surface |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |