CN113627950B - Method and system for extracting user transaction characteristics based on dynamic diagram - Google Patents
Method and system for extracting user transaction characteristics based on dynamic diagram Download PDFInfo
- Publication number
- CN113627950B CN113627950B CN202110711026.7A CN202110711026A CN113627950B CN 113627950 B CN113627950 B CN 113627950B CN 202110711026 A CN202110711026 A CN 202110711026A CN 113627950 B CN113627950 B CN 113627950B
- Authority
- CN
- China
- Prior art keywords
- time
- information
- snapshot
- node
- transaction
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 39
- 238000010586 diagram Methods 0.000 title abstract description 26
- 230000002776 aggregation Effects 0.000 claims abstract description 56
- 238000004220 aggregation Methods 0.000 claims abstract description 56
- 230000004931 aggregating effect Effects 0.000 claims abstract description 31
- 238000004590 computer program Methods 0.000 claims description 17
- 238000004364 calculation method Methods 0.000 claims description 12
- 238000000605 extraction Methods 0.000 claims description 12
- 238000003860 storage Methods 0.000 claims description 9
- 238000010606 normalization Methods 0.000 claims description 8
- 238000012545 processing Methods 0.000 claims description 8
- 230000006870 function Effects 0.000 claims description 7
- 230000008901 benefit Effects 0.000 description 3
- 238000013145 classification model Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 3
- 230000018109 developmental process Effects 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 230000011218 segmentation Effects 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 230000001360 synchronised effect Effects 0.000 description 2
- 108010001267 Protein Subunits Proteins 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000012512 characterization method Methods 0.000 description 1
- 230000000295 complement effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000006116 polymerization reaction Methods 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 239000013589 supplement Substances 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/018—Certifying business or products
- G06Q30/0185—Product, service or business identity fraud
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/048—Activation functions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Abstract
The application relates to a method and a system for extracting user transaction characteristics based on a dynamic diagram, wherein the method comprises the following steps: acquiring a transaction snapshot, aggregating nodes of the snapshot in each time period and adjacent point information of the nodes, and calculating node structure information of each time period through the information; next, aggregating each time period to obtain a snapshot map of the aggregation time, and calculating node structure information of node aggregation adjacent points in the snapshot map of the aggregation time; and finally, aggregating time information of nodes in the transaction snapshot graph to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the transaction time comprises each time period and time after aggregating each time period. According to the method and the device for predicting the transaction fraud, the problem that the time dimension information of the features is lack to be described under the condition that the transaction fraud is predicted is solved, and the transaction safety of the user is improved.
Description
Technical Field
The present application relates to the field of information security technologies, and in particular, to a method and system for extracting user transaction characteristics based on dynamic graphs.
Background
With the rapid development of computer technology, the development of internet finance is also day-to-day, and although the financial transaction is convenient and rapid, there are many financial fraud which are not well-controlled. Thus, to reduce the chance of a user being fraudulently deceptively challenged, the data of the graph structure is typically used as a supplement to the user's transaction information features, enabling a richer extraction of the structural or feature attributes on the graph.
In the related art, calculation is generally performed based on a static diagram, but this calculation method ignores an important piece of information, i.e., instant information.
At present, under the condition of predicting transaction anti-fraud, the problem of lack of characterization of time dimension information of features is solved, and an effective solution is not proposed.
Disclosure of Invention
The embodiment of the application provides a method and a system for extracting user transaction characteristics based on a dynamic graph, which at least solve the problem that the time dimension information of characteristics is lack to be described under the condition of predicting transaction anti-fraud in the related technology.
In a first aspect, an embodiment of the present application provides a method for extracting user transaction characteristics based on a dynamic graph, where the method includes:
acquiring a transaction snapshot, aggregating nodes of the snapshot in each time period and adjacent point information of the nodes, and calculating node structure information of each time period through the information;
aggregating the time periods to obtain a snapshot map of aggregation time, and calculating node structure information of node aggregation adjacent points in the snapshot map of the aggregation time;
and aggregating the time information of the nodes to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the time comprises the time periods and the aggregation time.
In some embodiments, the calculating the node structure information of each time period according to the information, and calculating the node structure information of the node aggregation neighboring point in the aggregation time snapshot graph includes:
calculating the saturation coefficients among nodes in the snapshot map, and carrying out normalization processing on the saturation coefficients to obtain normalized saturation coefficients;
and aggregating the adjacent point information of the nodes according to the normalized attribute coefficient to obtain the node structure information.
In some embodiments, the calculating node timing characteristic information according to the time snapshot information includes:
calculating self-saturation coefficients between the node and the rest time in each time period, and carrying out normalization processing on the self-saturation coefficients to obtain normalized self-saturation coefficients;
and according to the normalized self-attribute coefficient, aggregating the time information of the node to obtain the time sequence characteristic information of the node.
In some of these embodiments, prior to calculating the self-saturation coefficient between the node and the rest of the time for each time period, the method includes:
and selecting the aggregation time, and selecting the corresponding aggregation time according to the time period information of the node.
In some embodiments, the aggregating the time information of the nodes to obtain time snapshot information includes:
and acquiring node information of the nodes in the snapshot graphs of each time period and node information of the nodes in the snapshot graphs of the aggregation time to obtain time snapshot information of the nodes.
In some of these embodiments, the obtaining a transaction snapshot map includes:
and acquiring a group of ordered transaction dynamic snapshot graphs, wherein the transaction snapshot graphs are divided according to time intervals, and the time division intervals of the transaction snapshot graphs and the quantity of the transaction snapshot graphs can be set according to business requirements.
In some of these embodiments, after calculating the node structure information and the node timing characteristic information, the method includes:
and adding a classifier after the calculated node characteristic information, and carrying out loss function calculation on the node characteristic information to obtain a loss value.
In a second aspect, embodiments of the present application provide a system for dynamic graph-based user transaction feature extraction, the system comprising:
a structural feature module, configured to obtain a transaction snapshot, aggregate nodes of the snapshot in each time period and adjacent point information of the nodes, calculate node structure information of each time period according to the information,
aggregating the time periods to obtain a snapshot map of aggregation time, and calculating node structure information of node aggregation adjacent points in the snapshot map of the aggregation time;
the time sequence feature module is used for aggregating the time information of the nodes to obtain time snapshot information, and calculating the time sequence feature information of the nodes according to the time snapshot information, wherein the time comprises the time periods and the aggregation time.
In a third aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the method for extracting user transaction characteristics based on dynamic graphs according to the first aspect.
In a fourth aspect, embodiments of the present application provide a storage medium having stored thereon a computer program which, when executed by a processor, implements a method for dynamic graph-based user transaction feature extraction as described in the first aspect above.
Compared with the related art, the method for extracting the user transaction characteristics based on the dynamic graph, provided by the embodiment of the application, acquires the transaction snapshot graph, aggregates nodes of the snapshot graph and adjacent point information of the nodes in each time period, and calculates node structure information of each time period through the information; next, aggregating each time period to obtain a snapshot map of the aggregation time, and calculating node structure information of node aggregation adjacent points in the snapshot map of the aggregation time; and finally, aggregating time information of nodes in the transaction snapshot graph to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the transaction time comprises each time period and time after aggregating each time period.
According to the method, a transaction dynamic diagram is represented by a group of ordered transaction snapshot diagrams based on discrete time, node information and time information in the transaction dynamic diagram of each time period are aggregated, node structural characteristics and time sequence characteristics are obtained through calculation, and as the dimension of a time interval is added when the node structural and time sequence characteristic information is calculated, the influence of time on characteristic calculation can be better described, in addition, the time dimension is added into the application of financial transaction anti-fraud through the dynamic diagram, the problem that the description of the time dimension information of the characteristics is lacking under the condition of predicting the transaction anti-fraud is solved, the prediction capability of the anti-fraud can be better described through the time dimension, and the transaction safety of a user is improved; further, by using the aggregation time diagram, the data structure of the transaction snapshot diagram, which is damaged due to segmentation, is complemented, so that the extraction of related transaction features is more comprehensive, the subsequent feature identification and classification are facilitated, and the prediction capability of the model is improved.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute an undue limitation to the application. In the drawings:
FIG. 1 is a flow chart of a method of dynamic graph-based user transaction feature extraction in accordance with an embodiment of the present application;
FIG. 2 is a schematic diagram of a user transaction graph according to an embodiment of the present application;
FIG. 3 is a schematic diagram of an aggregate time snapshot according to an embodiment of the present application;
FIG. 4 is a schematic diagram of node time information aggregation in accordance with an embodiment of the present application;
FIG. 5 is a block diagram of a system for dynamic graph-based user transaction feature extraction in accordance with an embodiment of the present application;
fig. 6 is a schematic diagram of an internal structure of an electronic device according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described and illustrated below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the present application. All other embodiments, which can be made by one of ordinary skill in the art without undue burden on the person of ordinary skill in the art based on the embodiments provided herein, are intended to be within the scope of the present application. Moreover, it should be appreciated that while such a development effort might be complex and lengthy, it would nevertheless be a routine undertaking of design, fabrication, or manufacture for those of ordinary skill having the benefit of this disclosure, and thus should not be construed as having the benefit of this disclosure.
Reference in the specification to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the application. The appearances of such phrases in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is to be expressly and implicitly understood by those of ordinary skill in the art that the embodiments described herein can be combined with other embodiments without conflict.
Unless defined otherwise, technical or scientific terms used herein should be given the ordinary meaning as understood by one of ordinary skill in the art to which this application belongs. Reference to "a," "an," "the," and similar terms herein do not denote a limitation of quantity, but rather denote the singular or plural. The terms "comprising," "including," "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, article, or apparatus that comprises a list of steps or modules (elements) is not limited to only those steps or elements but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus. The terms "connected," "coupled," and the like in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The term "plurality" as used herein means greater than or equal to two. "and/or" describes an association relationship of an association object, meaning that there may be three relationships, e.g., "a and/or B" may mean: a exists alone, A and B exist together, and B exists alone. The terms "first," "second," "third," and the like, as used herein, are merely distinguishing between similar objects and not representing a particular ordering of objects.
The application provides a method for extracting user transaction characteristics based on a dynamic graph, and fig. 1 is a flowchart of a method for extracting user transaction characteristics based on the dynamic graph according to an embodiment of the application, as shown in fig. 1, and the flowchart includes the following steps:
step S101, acquiring a transaction snapshot, aggregating nodes of the snapshot in each time period and adjacent point information of the nodes, and calculating node structure information of each time period according to the information; it should be noted that the time period may be divided according to practical situations, and is not limited in particular.
Preferably, the time period is divided per hour, table 1 is transaction snapshot map information according to an embodiment of the present application, and as shown in table 1 below, the transaction snapshot map in the embodiment may be divided into 3 portions of time snapshots, where t1= {5:02,5:10,5:36}, t2= {6:10,6:30}, t3= {7:20,7:44,7:58}, respectively, and optionally, the time division interval and the snapshot number may be defined autonomously according to the service requirement. The point side information, such as a-b sides, in table 1 is an interactive transaction between users, through which a graph of the user transaction can be constructed, and fig. 2 is a schematic diagram of the user transaction graph according to an embodiment of the present application, as shown in fig. 2.
TABLE 1
| Time | Point side information | Snapshot index | Snapshot in-index |
| 5:02 | a-b；b-c； | t1 | T1-1 |
| 5:10 | b-e；c-f； | t1 | T1-2 |
| 5:36 | a-b； | t1 | T1-3 |
| 6:10 | a-b； | t2 | T2-1 |
| 6:30 | b-d； | t2 | T2-2 |
| 7:20 | a-b；b-f | t3 | T3-1 |
| 7:44 | c-g；c-e； | t3 | T3-2 |
| 7:58 | e-f； | t3 | T3-3 |
In this embodiment, after the transaction snapshot shown in table 1 and fig. 2 is obtained, the node and the adjacent point information of the node of the transaction snapshot in the above t1, t2, and t3 are aggregated in 3 time periods, and the node structure information of the 3 time periods is calculated from these information.
Optionally, the specific operation of calculating the node structure information of the 3 time periods includes:
s1, calculating an attribute coefficient e among nodes in a transaction snapshot map ij As shown in the following formulas 1 and 2:
e ij ＝σ(A ij *α T [W s h j ||W s h j ||Φ Δt ]) (1)
Φ Δt ＝cos(W t *Δ t ) (2)
wherein sigma represents a sigmoid function, alpha, W s 、W t Parameters to be learned for the model; the || represents concat feature stitching; delta t Representing the time interval, e.g., the edge a-b in the transaction snapshot at time 5:36 in Table 1, time interval delta t =60-36=24, if multiple events occur in the same snapshot, taking the occurrence time of the last event; a is that ij The weights representing edges are determined by the number of events that occur in the snapshot during each time period, as shown in Table 1, the weights A for the a-b edges during time period t1 ab The weights of the a-b sides in the t2 period and the t3 period are 1;
s2, carrying out normalization processing on the saturation coefficient to obtain a normalized saturation coefficient alpha ij As shown in the following formula 3:
wherein,representing neighbor nodes of the j node;
s3, aggregating the adjacent point information of the nodes according to the obtained normalized attribute coefficient to obtain node structure information X of the aggregated adjacent points i As shown in the following formula 4:
wherein σ represents a sigmoid function, h i Representing the initial characteristics of the inode.
According to the embodiment, when node structure feature information in the snapshot graph is calculated, the time interval dimension is added, so that the influence of time variation in a model can be better described, and the prediction capability of data is improved;
step S102, aggregating each time period to obtain a snapshot map of aggregation time, and calculating node structure information of node aggregation adjacent points in the snapshot map of the aggregation time;
the structural feature information of the node aggregation neighbors in each time period of the transaction snapshot is calculated through step S101, however, some important relationships may be cut due to the division of the transaction snapshot, so in order to complement the data structure which may be destroyed in the snapshot, in this embodiment, each time period is aggregated to obtain the snapshot of the aggregation time. FIG. 3 is a schematic diagram of an aggregate time snapshot, as shown in FIG. 3, at time t1, which is all events occurring within the time t1 period, according to an embodiment of the present application; at time t2, the aggregate snapshot is all events that occur within the t1+t2 time period; similarly, at time t3, the aggregate time snapshot is all events that occur within the t1+t2+t3 time period.
After the transaction snapshot map aggregated by the elapsed time is obtained, according to the specific operation of calculating the node structure information of different time periods in step S101, the node structure feature information of the node aggregation neighboring points in the aggregated time snapshot map is calculated. It should be noted that, the specific calculation operation example in the embodiment may refer to the embodiment in step S101, and this embodiment is not described herein again;
step S103, aggregating time information of the nodes to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the time comprises each time period and aggregation time;
after the structure information of the transaction snapshot map is aggregated, the embodiment needs to aggregate the time information of the nodes, obtain the node information in the snapshot map of each time period of the nodes, and obtain the node information in the snapshot map of the aggregation time, so as to obtain the time snapshot information of the nodes. Specifically, fig. 4 is a schematic view of node time information aggregation according to an embodiment of the present application, as shown in fig. 4, information of one node in each snapshot is selected, for example, node a is selected to include node information of t1, t2, t3 and t aggregation in time periods, where time t1, t2 and t3 are respectively node information after nodes in each time period aggregate neighboring points in the snapshot, and t aggregation is the node information in the aggregated time snapshot map. Preferably, the present embodiment calculates the node timing characteristic information according to the time information of the t1, t2, t3 and t aggregation obtained above.
Optionally, the specific operation of calculating the node timing characteristic information in the transaction snapshot map according to the 4 pieces of time information includes:
s1, calculating self-saturation coefficients between the node under each time period and the rest time, for example, calculating self-saturation coefficients between a node at the time t1 and a node at the time { t2, a node at the time t3 and a node at the time t aggregation;
in this embodiment, self-saturation coefficients are calculated as shown in the following formulas 5 to 8:
Query＝X v W q (5)
Key＝X v W k (6)
wherein X is v Aggregating node characteristics of neighbors for node v in the time snapshot; w (W) q 、W k Is a parameter to be learned; d represents a scaling factor, which can be equal to the characteristic dimension of Query, and can be customized; m is M ij For evaluating whether an event occurring at a node is after time t, if the event occurs after time t, the corresponding value of the degree is not calculated. For example, when calculating the value of the attribute of the a node at the time t1, the value of the attribute at the time t2 of the a node cannot be calculatedAnd t3 time of the value of attention->Since the event occurring at node a at time t1 has not occurred at times t2 and t3, therefore +.>
S2, carrying out normalization processing on the self-saturation coefficient to obtain a normalized self-saturation coefficientAs shown in the following formula 9:
wherein i and j represent moments;
s3, according to the normalized self-attribute coefficient obtained by calculation, aggregating time information of the nodes to obtain node time sequence characteristic informationAs shown in the following formula 10:
wherein,the characteristic of node v at time i is shown.
In some of these embodiments, before calculating the self-propagation coefficient between the node and the rest of the time for each time period, the aggregation time needs to be selected, and the corresponding aggregation time is selected according to the time period information in which the node is located. For example, when calculating node a information at time t1, t aggregation selects the snapshot map of aggregation time t1 in fig. 3; if node a information at the time t2 is calculated, t aggregation selects the snapshot of aggregation time t2 in fig. 3; and so on to select the polymerization time.
Preferably, after the node structure information and the node time sequence characteristic information are obtained through the calculation, a classifier is added after the node characteristic information, prediction of transaction behaviors is performed, and loss function calculation is performed on the node characteristic information to obtain a loss value.
In some of these embodiments, the node characteristics of known tags are predicted by a supervised classification model, and the loss value between the predicted result and the true tags is calculated by cross-section. Specifically, the category of a user, such as a fraudulent user or a good user, is known, prediction is performed according to a model to obtain a predicted result, a cross-score entry is adopted to calculate a loss value between the predicted result and a real label, network parameters are continuously learned through back propagation to obtain a trained model, and the user nodes of an unknown category are predicted again through the model. The supervised classification model is adopted in the embodiment, so that more situations of the real label can be learned, the prediction of the model is more accurate, but in the actual situation, the acquisition of the real label is difficult, and the real label is difficult to realize.
In some embodiments, the node characteristic information is predicted by an unsupervised classification model, and a Loss function Loss is calculated as shown in the following formula 11:
wherein i, j epsilon edge represents that there is edge connection between i and j, u, v epsilon neg represents that there is no connection between u and v, and the edge is a negative sampling edge.
The embodiment adopts an unsupervised model, and can pay more attention to the information on the graph structure and time change, pay more attention to the properties of the graph, and is beneficial to the accuracy of the prediction result.
Through the steps S101 to S103, the present application represents a transaction dynamic graph with a set of ordered transaction snapshot graphs based on discrete time, and adds a time dimension to the application of transaction anti-fraud by using the dynamic graph; in addition, the aggregation time diagram is used for complementing the data structure destroyed due to segmentation in the transaction snapshot, and the dimension of the time interval is added when the node characteristics are calculated, so that the influence of time on characteristic calculation is better described, the problem that the time dimension information of the characteristics is lack to be described under the condition of predicting transaction fraud is solved, the transaction characteristic information in network data can be better described through the time dimension, the prediction capability of the model for fraud is improved, and the transaction safety of users is improved.
It should be noted that the steps illustrated in the above-described flow or flow diagrams of the figures may be performed in a computer system, such as a set of computer-executable instructions, and that, although a logical order is illustrated in the flow diagrams, in some cases, the steps illustrated or described may be performed in an order other than that illustrated herein.
The embodiment also provides a system for extracting user transaction characteristics based on a dynamic diagram, which is used for implementing the above embodiment and the preferred implementation, and is not described again. As used below, the terms "module," "unit," "sub-unit," and the like may be a combination of software and/or hardware that implements a predetermined function. While the means described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.
FIG. 5 is a block diagram of a system for dynamic graph-based user transaction feature extraction, including a structural feature module 51 and a timing feature module 52, as shown in FIG. 5, according to an embodiment of the present application:
the structural feature module 51 is configured to obtain a transaction snapshot, aggregate node information of the snapshot and neighbor point information of the node in each time period, calculate node structure information of each time period according to the node information, aggregate each time period, obtain a snapshot of an aggregate time, and calculate node structure information of node aggregation neighbor points in the snapshot of the aggregate time; the time sequence feature module 52 is configured to aggregate time information of the nodes, obtain time snapshot information, and calculate node time sequence feature information according to the time snapshot information, where the time includes each time period and aggregate time.
With the system, the application represents a transaction dynamic graph by using a group of ordered transaction snapshot graphs based on discrete time, and adds a time dimension into a transaction anti-fraud application by using the dynamic graph; in addition, the aggregation time diagram is used for complementing the data structure destroyed due to segmentation in the transaction snapshot, and the dimension of the time interval is added when the node characteristics are calculated, so that the influence of time on characteristic calculation is better described, the problem that the time dimension information of the characteristics is lack to be described under the condition of predicting transaction fraud is solved, the transaction characteristic information in network data can be better described through the time dimension, the prediction capability of the model for fraud is improved, and the transaction safety of users is improved.
It should be noted that, specific examples in this embodiment may refer to examples described in the foregoing embodiments and alternative implementations, and this embodiment is not repeated herein.
The above-described respective modules may be functional modules or program modules, and may be implemented by software or hardware. For modules implemented in hardware, the various modules described above may be located in the same processor; or the above modules may be located in different processors in any combination.
The present embodiment also provides an electronic device comprising a memory having stored therein a computer program and a processor arranged to run the computer program to perform the steps of any of the method embodiments described above.
Optionally, the electronic apparatus may further include a transmission device and an input/output device, where the transmission device is connected to the processor, and the input/output device is connected to the processor.
In addition, in combination with the method for extracting the transaction characteristics of the user based on the dynamic graph in the embodiment, the embodiment of the application can be realized by providing a storage medium. The storage medium has a computer program stored thereon; the computer program, when executed by a processor, implements the method of dynamic graph-based user transaction feature extraction of any of the above embodiments.
In one embodiment, a computer device is provided, which may be a terminal. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method of dynamic graph-based user transaction feature extraction. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, can also be keys, a track ball or a touch pad arranged on the shell of the computer equipment, and can also be an external keyboard, a touch pad or a mouse and the like.
In one embodiment, fig. 6 is a schematic diagram of an internal structure of an electronic device according to an embodiment of the present application, and as shown in fig. 6, an electronic device is provided, which may be a server, and an internal structure diagram thereof may be as shown in fig. 6. The electronic device includes a processor, a network interface, an internal memory, and a non-volatile memory connected by an internal bus, where the non-volatile memory stores an operating system, computer programs, and a database. The processor is used for providing computing and control capability, the network interface is used for communicating with an external terminal through network connection, the internal memory is used for providing environment for the operation of an operating system and a computer program, the computer program is executed by the processor to realize a method for extracting user transaction characteristics based on dynamic graphs, and the database is used for storing data.
It will be appreciated by those skilled in the art that the structure shown in fig. 6 is merely a block diagram of a portion of the structure associated with the present application and is not limiting of the electronic device to which the present application is applied, and that a particular electronic device may include more or fewer components than shown, or may combine certain components, or have a different arrangement of components.
Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the various embodiments provided herein may include non-volatile and/or volatile memory. The nonvolatile memory can include Read Only Memory (ROM), programmable ROM (PROM), electrically Programmable ROM (EPROM), electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double Data Rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link DRAM (SLDRAM), memory bus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), among others.
It should be understood by those skilled in the art that the technical features of the above-described embodiments may be combined in any manner, and for brevity, all of the possible combinations of the technical features of the above-described embodiments are not described, however, they should be considered as being within the scope of the description provided herein, as long as there is no contradiction between the combinations of the technical features.
The above examples merely represent a few embodiments of the present application, which are described in more detail and are not to be construed as limiting the scope of the invention. It should be noted that it would be apparent to those skilled in the art that various modifications and improvements could be made without departing from the spirit of the present application, which would be within the scope of the present application. Accordingly, the scope of protection of the present application is to be determined by the claims appended hereto.
Claims (8)
1. A method for extracting user transaction characteristics based on dynamic graphs, the method comprising:
acquiring a transaction snapshot, aggregating nodes of the snapshot in each time period and adjacent point information of the nodes, and calculating node structure information of each time period through the information;
aggregating the time periods to obtain a snapshot map of aggregation time, and calculating node structure information of node aggregation adjacent points in the snapshot map of the aggregation time;
aggregating the time information of the nodes to obtain time snapshot information, and calculating to obtain node time sequence characteristic information according to the time snapshot information, wherein the time comprises the time periods and the aggregation time;
the calculating the node structure information of each time period through the information, and the calculating the node structure information of the node aggregation adjacent points in the aggregation time snapshot comprises the following steps:
calculating the saturation coefficients among nodes in the snapshot map, and carrying out normalization processing on the saturation coefficients to obtain normalized saturation coefficients;
according to the normalized attribute coefficient, aggregating the adjacent point information of the node to obtain the node structure information;
the calculating the node time sequence characteristic information according to the time snapshot information comprises the following steps:
calculating self-saturation coefficients between the node and the rest time in each time period, and carrying out normalization processing on the self-saturation coefficients to obtain normalized self-saturation coefficients;
and according to the normalized self-attribute coefficient, aggregating the time information of the node to obtain the time sequence characteristic information of the node.
2. The method of claim 1, wherein prior to calculating the self-propagation coefficient between the node and the rest of the time for each time period, the method comprises:
and selecting the aggregation time, and selecting the corresponding aggregation time according to the time period information of the node.
3. The method of claim 1, wherein aggregating the time information of the nodes to obtain time snapshot information comprises:
and acquiring node information of the nodes in the snapshot graphs of each time period and node information of the nodes in the snapshot graphs of the aggregation time to obtain time snapshot information of the nodes.
4. The method of claim 1, wherein the obtaining a transaction snapshot map comprises:
and obtaining a group of ordered transaction dynamic snapshot graphs, wherein the transaction snapshot graphs are divided according to time intervals, and the time division intervals of the transaction snapshot graphs and the quantity of the transaction snapshot graphs are set according to business requirements.
5. The method according to claim 1, wherein after calculating the node structure information and the node timing characteristic information, the method comprises:
and adding a classifier after the calculated node characteristic information, and carrying out loss function calculation on the node characteristic information to obtain a loss value.
6. A system for dynamic graph-based user transaction feature extraction, the system comprising:
a structural feature module, configured to obtain a transaction snapshot, aggregate nodes of the snapshot in each time period and adjacent point information of the nodes, calculate node structure information of each time period according to the information,
aggregating the time periods to obtain a snapshot map of aggregation time, and calculating node structure information of node aggregation adjacent points in the snapshot map of the aggregation time;
the time sequence feature module is used for aggregating the time information of the nodes to obtain time snapshot information, and calculating to obtain the time sequence feature information of the nodes according to the time snapshot information, wherein the time comprises the time periods and the aggregation time;
the structural feature module is specifically used for:
calculating the saturation coefficients among nodes in the snapshot map, and carrying out normalization processing on the saturation coefficients to obtain normalized saturation coefficients; according to the normalized attribute coefficient, aggregating the adjacent point information of the node to obtain the node structure information;
the time sequence characteristic die body is used for:
calculating self-saturation coefficients between the node and the rest time in each time period, and carrying out normalization processing on the self-saturation coefficients to obtain normalized self-saturation coefficients;
and according to the normalized self-attribute coefficient, aggregating the time information of the node to obtain the time sequence characteristic information of the node.
7. An electronic device comprising a memory and a processor, wherein the memory has stored therein a computer program, the processor being arranged to run the computer program to perform the method of dynamic graph-based user transaction feature extraction of any of claims 1 to 5.
8. A storage medium having stored therein a computer program, wherein the computer program is arranged to perform the method of dynamic graph-based user transaction feature extraction of any of claims 1 to 5 at run-time.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110711026.7A CN113627950B (en) | 2021-06-25 | 2021-06-25 | Method and system for extracting user transaction characteristics based on dynamic diagram |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110711026.7A CN113627950B (en) | 2021-06-25 | 2021-06-25 | Method and system for extracting user transaction characteristics based on dynamic diagram |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113627950A CN113627950A (en) | 2021-11-09 |
| CN113627950B true CN113627950B (en) | 2023-12-29 |
Family
ID=78378399
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110711026.7A Active CN113627950B (en) | 2021-06-25 | 2021-06-25 | Method and system for extracting user transaction characteristics based on dynamic diagram |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113627950B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114675942A (en) * | 2022-03-23 | 2022-06-28 | 支付宝(杭州)信息技术有限公司 | Group identification method and system based on dynamic graph |
Citations (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB9324949D0 (en) * | 1993-12-06 | 1994-01-26 | Tregellas George D R | Card security |
| JPH08273075A (en) * | 1995-03-31 | 1996-10-18 | Tokyu Community-:Kk | Home security system |
| WO2000019324A1 (en) * | 1998-09-28 | 2000-04-06 | Argus Systems Group, Inc. | Trusted compartmentalized computer operating system |
| JP2007074555A (en) * | 2005-09-08 | 2007-03-22 | Sony Corp | Flicker reduction method, flicker reduction circuit and imaging apparatus |
| WO2016183473A1 (en) * | 2015-05-13 | 2016-11-17 | Retailmenot, Inc. | Modulating mobile-device displays based on ambient signals to reduce the likelihood of fraud |
| WO2017217169A1 (en) * | 2016-06-15 | 2017-12-21 | ソニー株式会社 | Information processing device, method, and program |
| CN110210227A (en) * | 2019-06-11 | 2019-09-06 | 百度在线网络技术（北京）有限公司 | Risk checking method, device, equipment and storage medium |
| JP2020009272A (en) * | 2018-07-10 | 2020-01-16 | ネットスマイル株式会社 | System, method, and program for predicting transaction market |
| CN111260462A (en) * | 2020-01-16 | 2020-06-09 | 东华大学 | Transaction fraud detection method based on heterogeneous relation network attention mechanism |
| CN111340509A (en) * | 2020-05-22 | 2020-06-26 | 支付宝(杭州)信息技术有限公司 | False transaction identification method and device and electronic equipment |
| CN111782611A (en) * | 2020-06-30 | 2020-10-16 | 北京百度网讯科技有限公司 | Prediction model modeling method, device, equipment and storage medium |
| CN112598526A (en) * | 2021-03-04 | 2021-04-02 | 蚂蚁智信(杭州)信息技术有限公司 | Asset data processing method and device |
| CN112766172A (en) * | 2021-01-21 | 2021-05-07 | 北京师范大学 | Face continuous expression recognition method based on time sequence attention mechanism |
Family Cites Families (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP2008458A4 (en) * | 2006-04-18 | 2009-05-06 | Sorensen Associates Inc | Still image queue analysis system and method |
| US8756123B2 (en) * | 2010-12-10 | 2014-06-17 | Sap Ag | Inventory verification using inventory snapshots |
| US20130103570A1 (en) * | 2011-10-21 | 2013-04-25 | Discover Financial Services | System and method for determining credit quality index |
| US20130124263A1 (en) * | 2011-11-14 | 2013-05-16 | Visa International Service Association | Systems and Methods to Summarize Transaction data |
| US20130179246A1 (en) * | 2012-01-09 | 2013-07-11 | Bank Of America Corporation | Providing targeted offers based on aggregate demand and aggregate supply |
| US10037574B2 (en) * | 2015-04-28 | 2018-07-31 | Trading Technologies International, Inc. | Systems and methods to display chart bars with variable scaling and/or aggregation |
| US20170140382A1 (en) * | 2015-11-12 | 2017-05-18 | International Business Machines Corporation | Identifying transactional fraud utilizing transaction payment relationship graph link prediction |
| WO2018098598A1 (en) * | 2016-12-02 | 2018-06-07 | Stack Fintech Inc. | Digital banking platform and architecture |
| WO2018145195A1 (en) * | 2017-02-10 | 2018-08-16 | Murphy Jean Louis | Secure location based electronic financial transaction methods and systems |
| CN110298663B (en) * | 2018-03-22 | 2023-04-28 | 中国银联股份有限公司 | Fraud transaction detection method based on sequence wide and deep learning |
-
2021
- 2021-06-25 CN CN202110711026.7A patent/CN113627950B/en active Active
Patent Citations (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB9324949D0 (en) * | 1993-12-06 | 1994-01-26 | Tregellas George D R | Card security |
| JPH08273075A (en) * | 1995-03-31 | 1996-10-18 | Tokyu Community-:Kk | Home security system |
| WO2000019324A1 (en) * | 1998-09-28 | 2000-04-06 | Argus Systems Group, Inc. | Trusted compartmentalized computer operating system |
| JP2007074555A (en) * | 2005-09-08 | 2007-03-22 | Sony Corp | Flicker reduction method, flicker reduction circuit and imaging apparatus |
| WO2016183473A1 (en) * | 2015-05-13 | 2016-11-17 | Retailmenot, Inc. | Modulating mobile-device displays based on ambient signals to reduce the likelihood of fraud |
| WO2017217169A1 (en) * | 2016-06-15 | 2017-12-21 | ソニー株式会社 | Information processing device, method, and program |
| JP2020009272A (en) * | 2018-07-10 | 2020-01-16 | ネットスマイル株式会社 | System, method, and program for predicting transaction market |
| CN110210227A (en) * | 2019-06-11 | 2019-09-06 | 百度在线网络技术（北京）有限公司 | Risk checking method, device, equipment and storage medium |
| CN111260462A (en) * | 2020-01-16 | 2020-06-09 | 东华大学 | Transaction fraud detection method based on heterogeneous relation network attention mechanism |
| CN111340509A (en) * | 2020-05-22 | 2020-06-26 | 支付宝(杭州)信息技术有限公司 | False transaction identification method and device and electronic equipment |
| CN111782611A (en) * | 2020-06-30 | 2020-10-16 | 北京百度网讯科技有限公司 | Prediction model modeling method, device, equipment and storage medium |
| CN112766172A (en) * | 2021-01-21 | 2021-05-07 | 北京师范大学 | Face continuous expression recognition method based on time sequence attention mechanism |
| CN112598526A (en) * | 2021-03-04 | 2021-04-02 | 蚂蚁智信(杭州)信息技术有限公司 | Asset data processing method and device |
Non-Patent Citations (10)
| Title |
|---|
| 一种面向网络支付反欺诈的自动化特征工程方法;王成;王昌琪;;计算机学报(第10期);全文 * |
| 区块链数据分析: 现状, 趋势与挑战;陈伟利等;《 计算机研究与发展》;第55卷(第9期);全文 * |
| 基于动态对等网层次结构的网络预警模型研究;许佳;冯登国;苏璞睿;;计算机研究与发展(第09期);全文 * |
| 基于影响力最大化策略的抑制虚假消息传播的方法;陈晋音;张敦杰;林翔;徐晓东;朱子凌;;计算机科学(第S1期);全文 * |
| 基于时序交易图注意力神经网络的以太坊恶意账户检测;石拓等;《信息网络安全》;全文 * |
| 基于时空建模的动态图卷积神经网络;李荆等;《北京大学学报(自然科学版)》;第57卷(第4期);全文 * |
| 基于模糊校正的深度时序信息安全评估算法;魏明桦;郑金贵;;河海大学学报(自然科学版)(第05期);全文 * |
| 基于步态的身份识别技术;谢林海;刘相滨;佟施;;计算机技术与发展(第09期);全文 * |
| 时序网络中关键节点的识别方法研究进展;陈诗等;《电子科技大学学报》;第49卷(第2期);全文 * |
| 面向金融数据的神经网络时间序列预测模型;张栗粽;王谨平;刘贵松;罗光春;卢国明;;计算机应用研究(第09期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113627950A (en) | 2021-11-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10452998B2 (en) | Cognitive blockchain automation and management | |
| Laber et al. | Dynamic treatment regimes: Technical challenges and applications | |
| Dasu et al. | Exploratory data mining and data cleaning | |
| CN108615119B (en) | Abnormal user identification method and equipment | |
| US9875294B2 (en) | Method and apparatus for classifying object based on social networking service, and storage medium | |
| WO2019169704A1 (en) | Data classification method, apparatus, device and computer readable storage medium | |
| CN111080360B (en) | Behavior prediction method, model training method, device, server and storage medium | |
| CN111415167B (en) | Network fraud transaction detection method and device, computer storage medium and terminal | |
| CN111611390B (en) | Data processing method and device | |
| CN113627950B (en) | Method and system for extracting user transaction characteristics based on dynamic diagram | |
| Wu et al. | Discovering temporal patterns for event sequence clustering via policy mixture model | |
| CN115545103A (en) | Abnormal data identification method, label identification method and abnormal data identification device | |
| Yang et al. | β-Skeleton depth functions and medians | |
| CN115730125A (en) | Object identification method and device, computer equipment and storage medium | |
| Araujo et al. | Tensorcast: forecasting and mining with coupled tensors | |
| CN112784168A (en) | Information push model training method and device, and information push method and device | |
| Lu et al. | Computational creativity based video recommendation | |
| CN115878882A (en) | Hierarchical representation learning of user interests | |
| Alghamedy et al. | Imputing trust network information in NMF-based collaborative filtering | |
| CN113537363B (en) | Abnormal object detection method and device, electronic equipment and storage medium | |
| CN112016123B (en) | Verification method and device of privacy protection algorithm and electronic equipment | |
| Halvorsen et al. | How attacker knowledge affects privacy risks: an analysis using probabilistic programming | |
| Mosso et al. | Latent association mining in binary data | |
| CN117312397B (en) | Talent supply chain management method and system based on big data | |
| US20230252419A1 (en) | Systems and methods for predictive scoring |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |