CN115170319A

CN115170319A - Abnormal account detection method, and method and device for constructing graph neural network model

Info

Publication number: CN115170319A
Application number: CN202210884201.7A
Authority: CN
Inventors: 陈李龙; 徐林嘉
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2022-07-25
Filing date: 2022-07-25
Publication date: 2022-10-11

Abstract

The invention relates to the field of finance, and particularly provides an abnormal account detection method, a graph neural network model construction method and a device, wherein the abnormal account detection method comprises the following steps: acquiring attribute information of a target account; putting the attribute information of the target account into a pre-constructed graph neural network model, wherein the graph neural network model completes construction of a transaction graph generated based on the transaction information of the account; calculating to obtain an abnormal score of the target account according to the graph neural network model; and determining the target account as a normal account or an abnormal account according to the abnormal score. The method and the device can improve the detection efficiency and accuracy of the abnormal account.

Description

Abnormal account detection method, and method and device for constructing graph neural network model

Technical Field

The invention relates to the field of finance, in particular to an abnormal account detection method, a graph neural network model construction method and a graph neural network model construction device.

Background

Because the online transaction belongs to a non-face-to-face online transaction form, a bank cannot confirm whether an individual operating the online transaction is the person owning the account, and the uncertainty and the confidentiality of the transaction cause that the bank performs various anti-money laundering measures such as identity recognition and the like on the account to have a large discount effect. Meanwhile, with the development of big data technology, it is relatively easy to accumulate relevant basic information and transaction records of transaction accounts, but marking each fund transaction as normal or abnormal consumes huge manpower and material resources, and even cannot be completed at all.

The mainstream machine learning technology still has a deficiency in the aspect of fund transaction abnormity detection, in the scene, the fund transaction quantity is huge, and the traditional supervised machine learning needs to construct label information for each transaction for machine learning model learning, so that a great amount of manpower and material resources are undoubtedly consumed.

Therefore, there is a need for an abnormal account detection method, which can improve the detection efficiency and accuracy of the abnormal account.

Disclosure of Invention

The embodiment of the invention aims to provide an abnormal account detection method, a graph neural network model construction method and a graph neural network model construction device, so as to improve the abnormal account detection efficiency and accuracy.

To achieve the above object, in one aspect, an embodiment herein provides an abnormal account detection method, including:

acquiring attribute information of a target account;

putting the attribute information of the target account into a pre-constructed graph neural network model, wherein the graph neural network model completes construction of a transaction graph generated based on the transaction information of the account;

calculating to obtain an abnormal score of the target account according to the graph neural network model;

and determining the target account as a normal account or an abnormal account according to the abnormal score.

Preferably, the calculating the abnormality score of the target account according to the graph neural network model further includes:

calculating to obtain a local anomaly score and a global anomaly score of the target account according to the graph neural network model;

and linearly adding the local abnormality score and the global abnormality score of the target account to obtain the abnormality score of the target account.

Preferably, the calculating the local anomaly score and the global anomaly score of the target account according to the graph neural network model further includes:

obtaining an embedded matrix of a target node corresponding to a target account by using the graph neural network model;

calculating to obtain an embedded vector of a target node by using the graph neural network model;

and obtaining the local abnormal score and the global abnormal score of the target node according to the embedded matrix and the embedded vector of the target node.

Preferably, the obtaining the local anomaly score of the target node according to the embedded matrix and the embedded vector of the target node further includes:

hiding attribute information of a target account in a transaction graph;

calculating to obtain a local embedded vector after the target node is hidden according to the embedded matrix of the target node;

and calculating to obtain the local abnormal score of the target node according to the local embedded vector after the target node is hidden, the local embedded vector after the other nodes except the node in the transaction subgraph of the target node are hidden, and the embedded vector of the target node.

Preferably, the obtaining the global anomaly score of the target node according to the embedded matrix and the embedded vector of the target node further includes:

hiding attribute information of a target account in a transaction graph;

calculating to obtain a global embedded vector after the target node is hidden according to the embedded matrix of the target node;

and calculating to obtain the global abnormal score of the target node according to the global embedded vector after the target node is hidden, the global embedded vector after other nodes except the node in the transaction subgraph of the target node are hidden, and the embedded vector of the target node.

Preferably, the method for constructing the neural network model of the graph includes:

obtaining a transaction graph according to transaction information between accounts, wherein nodes in the transaction graph are used for representing attribute information of the accounts;

generating a transaction sub-graph for each node based on the transaction graph;

processing the transaction subgraph of each node by using an initial graph neural network model to obtain a target function;

and training the target function to obtain a graph neural network model.

Preferably, the processing the transaction subgraph of each node by using the initial graph neural network model to obtain the target function further includes:

respectively coding the transaction subgraph of each node by using an initial graph neural network model to obtain an initial embedded matrix of each node;

calculating by using an initial graph neural network model to obtain an initial embedded vector of each node;

obtaining a local comparison learning item and a global comparison learning item of each node according to the initial embedding matrix and the initial embedding vector of each node;

and obtaining the target function according to the local comparison learning item and the global comparison learning item of each node.

Preferably, the obtaining a local contrast learning term of each node according to the initial embedding matrix and the initial embedding vector of each node further includes:

hiding attribute information of an account corresponding to each node in the transaction graph;

calculating to obtain an initial local embedding vector after each node is hidden according to the initial embedding matrix of each node;

constructing a positive sample pair based on local contrast of each node by using the hidden initial local embedding vector of each node and the initial embedding vector of each node;

constructing a negative sample pair of each node based on local comparison by using the hidden initial local embedded vector of each other node except the node in the transaction subgraph of each node and the initial embedded vector of each node;

and constructing and obtaining a local comparison learning item of each node by utilizing the positive sample pair and the negative sample pair of each node based on local comparison.

Preferably, the obtaining a global contrast learning term of each node according to the initial embedding matrix and the initial embedding vector of each node further includes:

calculating to obtain an initial global embedding vector after each node is hidden according to the initial embedding matrix of each node;

constructing a positive sample pair based on global contrast of each node by using the hidden initial global embedded vector of each node and the initial embedded vector of each node;

constructing a negative sample pair of each node based on global comparison by using the hidden initial global embedded vector of each other node except the node in the transaction subgraph of each node and the initial embedded vector of each node;

and constructing and obtaining a global comparison learning item of each node by utilizing the positive sample pair and the negative sample pair of each node based on global comparison.

On the other hand, embodiments herein further provide a method for constructing a neural network model, where the neural network model is applied to any one of the above abnormal account detection methods, and the method includes:

and training the target function to obtain a graph neural network model.

In another aspect, an abnormal account detection apparatus is provided in an embodiment herein, including:

the acquisition module is used for acquiring the attribute information of the target account;

the investment module is used for investing the attribute information of the target account into a pre-constructed graph neural network model, wherein the graph neural network model is constructed and completed based on a transaction graph generated by the transaction information of the account;

the calculation module is used for calculating the abnormal score of the target account according to the graph neural network model;

and the determining module is used for determining the target account as a normal account or an abnormal account according to the abnormal score.

In yet another aspect, embodiments herein also provide a computer device comprising a memory, a processor, and a computer program stored on the memory, the computer program, when executed by the processor, performing the instructions of any one of the methods described above.

In yet another aspect, embodiments herein also provide a computer-readable storage medium having stored thereon a computer program, which when executed by a processor of a computer device, performs the instructions of any one of the methods described above.

According to the technical scheme provided by the embodiment, the abnormal account detection can be performed by using the graph neural network model, the abnormal score of the target node can be obtained according to the graph neural network model, and the target account can be further determined to be a normal account or an abnormal account through the abnormal score, so that the detection efficiency and accuracy of the abnormal account are improved.

In order to make the aforementioned and other objects, features and advantages of the present invention comprehensible, preferred embodiments accompanied with figures are described in detail below.

Drawings

In order to more clearly illustrate the embodiments or technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 shows a schematic flow chart of an abnormal account detection method provided in an embodiment of the present disclosure;

fig. 2 is a schematic flow chart illustrating that the transaction subgraph of each node is processed by using the initial graph neural network model to obtain an objective function according to the embodiment of the present disclosure;

FIG. 3 is a schematic flow chart diagram for obtaining local comparison learning terms of each node according to an embodiment of the present disclosure;

FIG. 4 is a schematic flow chart diagram for obtaining a global contrast learning term for each node according to an embodiment of the present disclosure;

fig. 5 illustrates a flow diagram for calculating an anomaly score for a target account provided by an embodiment herein;

FIG. 6 illustrates a schematic flow chart provided in an embodiment herein for calculating a local anomaly score and a global anomaly score for a target account;

fig. 7 illustrates a flow diagram for obtaining a local anomaly score of a target node provided by an embodiment herein;

FIG. 8 illustrates a flowchart for obtaining a global anomaly score for a target node provided by an embodiment herein;

fig. 9 is a schematic block diagram illustrating an abnormal account detection apparatus provided in an embodiment of the present disclosure;

fig. 10 shows a schematic structural diagram of a computer device provided in an embodiment herein.

Description of the figures the symbols:

100. an acquisition module;

200. a throw-in module;

300. a calculation module;

400. a determination module;

1002. a computer device;

1004. a processor;

1006. a memory;

1008. a drive mechanism;

1010. an input/output module;

1012. an input device;

1014. an output device;

1016. a presentation device;

1018. a graphical user interface;

1020. a network interface;

1022. a communication link;

1024. a communication bus.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the scope of protection given herein.

In order to solve the above problem, embodiments herein provide a graph neural network model construction method. Fig. 1 is a schematic flow chart diagram of a method for building a neural network model according to an embodiment of the present disclosure, and the present disclosure provides the method operation steps according to the embodiment or the flow chart diagram, but may include more or less operation steps based on conventional or non-creative labor. The order of steps recited in the embodiments is merely one manner of performing the steps in a multitude of sequences, and does not represent a unique order of performance. In the actual implementation of the system or the device product, the method according to the embodiments or shown in the drawings can be executed in sequence or in parallel.

It should be noted that the terms "first," "second," and the like in the description and claims herein and in the above-described drawings are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments herein described are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, apparatus, article, or device that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or device.

Referring to fig. 1, disclosed herein is an abnormal account detection method including:

s101: acquiring attribute information of a target account;

s102: putting the attribute information of the target account into a pre-constructed graph neural network model, wherein the graph neural network model completes construction of a transaction graph generated based on the transaction information of the account;

s103: calculating to obtain an abnormal score of the target account according to the graph neural network model;

s104: and determining the target account as a normal account or an abnormal account according to the abnormal score.

The target account is an account which needs to be subjected to anomaly detection, and the attribute information of the account may include multiple dimensions, for example, transaction information of the account, information of a customer to which the account belongs, and status information of the account. Wherein the transaction information of the account may include: the number of transactions, transaction amount, payment amount, collection amount, number of cross-line transfers, number of cash withdrawals, number of consumptions, number of third party payments, etc. of the account over the historical period. The information of the customer to which the account belongs may include: customer gender, age, marital status, educational status, work status, etc. The status information of the account may include: time of opening, current status of the account, etc.

The construction method of the graph neural network model comprises the following steps:

step 1.1: obtaining a transaction graph according to transaction information between accounts, wherein nodes in the transaction graph are used for representing attribute information of the accounts;

step 1.2: generating a transaction sub-graph for each node based on the transaction graph;

step 1.3: processing the transaction subgraph of each node by using an initial graph neural network model to obtain a target function;

step 1.4: and training the target function to obtain a graph neural network model.

Referring to fig. 2, the processing the transaction subgraph of each node by using the initial graph neural network model to obtain the objective function further includes:

s201: respectively coding the transaction subgraph of each node by using an initial graph neural network model to obtain an initial embedded matrix of each node;

s202: calculating by using an initial graph neural network model to obtain an initial embedded vector of each node;

s203: obtaining a local contrast learning item and a global contrast learning item of each node according to the initial embedding matrix and the initial embedding vector of each node;

s204: and obtaining the target function according to the local comparison learning item and the global comparison learning item of each node.

If the transaction relationship exists between the two accounts, the edge exists between the two corresponding nodes, and if the transaction relationship does not exist between the two accounts, no edge exists between the two corresponding nodes, and the nodes in the transaction graph are used for representing the attribute information of the accounts.

From this, a transaction map can be derived as follows:

G＝{A,X}(1)

wherein G is a transaction diagram, and X belongs to R ^s×d X is a node in the transaction graph, s is the number of nodes in the transaction graph, d is the dimension number of the attribute information of the account, A belongs to {0,1}, A is an adjacency matrix of the graph, and A is a dimension number of the attribute information of the account _p,q =1 denotes that there is an edge between node p and node q, A _p,q =0 indicates that there is no edge between node p and node q.

Based on the transaction graph, a transaction sub-graph of each node can be generated, each target node is used as a center, the transaction graph is sampled by a fixed number k to generate surrounding contexts, and then the transaction sub-graph of each node can be obtained:

G ⁱ ＝{A ⁱ ,X ⁱ } (2)

wherein i represents the ith node, G ⁱ A transaction sub-graph representing the ith node, A ⁱ Is the adjacency matrix of the transaction subgraph of the ith node. X ⁱ ∈R ^k×d The number of the nodes in the transaction sub-graph of the ith node is k, and the number of the attributes of the account corresponding to the ith node is d.

Further, the initial graph neural network model can be used to encode the transaction subgraph of each node, and the initial embedding matrix of each node is obtained, as follows:

H ⁱ ＝f(A ⁱ ,X ⁱ ) (3)

wherein H ⁱ Is the initial embedded matrix of the ith node, and f () is the initial neural network model.

And then calculating an initial embedding vector of each node by using the initial graph neural network model as follows:

z ⁱ ＝f(x ⁱ ) (4)

wherein z is ⁱ Is the initial embedded vector of the ith node.

And finally, reflecting the abnormal condition of each node by utilizing the consistency between each node and the transaction subgraph where the node is located, specifically, obtaining a local comparison learning item and a global comparison learning item of each node according to the initial embedding matrix and the initial embedding vector of each node, locally comparing the local consistency between the embedding of each node in the transaction subgraph where the node is located and the embedding of each node by the local comparison learning item, and globally comparing the global consistency between the embedding of each node in the transaction subgraph where the node is located and the embedding of each node by the global comparison learning item.

The local comparison learning item and the global comparison learning item of each node are minimized through the minimization objective function to obtain an optimized graph neural network model, abnormal account detection can be carried out through the graph neural network model, the abnormal score of each node can be obtained according to the graph neural network model, the account corresponding to each node can be further determined to be a normal account or an abnormal account through the abnormal score, and therefore the detection efficiency and accuracy of the abnormal account are improved.

In this embodiment, referring to fig. 3, the obtaining the local contrast learning term of each node according to the initial embedding matrix and the initial embedding vector of each node further includes:

s301: hiding attribute information of an account corresponding to each node in the transaction graph;

s302: calculating to obtain an initial local embedding vector after each node is hidden according to the initial embedding matrix of each node;

s303: constructing a positive sample pair based on local contrast of each node by using the hidden initial local embedding vector of each node and the initial embedding vector of each node;

s304: constructing a negative sample pair based on local comparison of each node by using the hidden initial local embedding vector of each other node except the node in the transaction subgraph of each node and the initial embedding vector of each node;

s305: and constructing and obtaining a local comparison learning item of each node by utilizing the positive sample pair and the negative sample pair of each node based on local comparison.

Each node in the transaction graph represents attribute information of one account, and in order to prevent the attribute information of the account corresponding to the node from generating information leakage in the construction process of the graph neural network model, the attribute information of the account corresponding to each node can be hidden.

The specific method of hiding may be to take each node as a starting node in the transaction subgraph of the node, and take the starting node as a zero vector, that is:

wherein X ⁱ For the transaction subgraph of the ith node, X ⁱ [1,:]And the initial node in the transaction sub-graph of the ith node is the ith node, and the initial node in the transaction sub-graph of the ith node is a zero vector.

For all nodes in the transaction graph, attribute information of an account corresponding to each node in the transaction graph is hidden.

According to the initial embedding matrix of each node, an initial local embedding vector after each node is hidden can be calculated as follows:

wherein the content of the first and second substances,

for the initial local embedding vector after hiding the ith node, H ⁱ For the initial embedded matrix of the ith node, [1,:]representing the starting node in the transaction sub-graph for the ith node.

And further obtaining a positive sample pair of the ith node based on local comparison:

for all nodes in the transaction sub-graph of the ith node (including the ith node v) _i And v is divided _i Other nodes v than the first _j Where j =1 … k and j ≠ i, k is the number of nodes in the transaction subgraph of the ith node), the ith node v _i Is hidden except for the ith node v _i Other nodes v than the first _j The attribute information of the corresponding account is also hidden.

It should be explained that the node v _i And node v _j Are all nodes in the transaction graph, only at node v _i In the transaction sub-graph of (1), node v _j Relatively speaking, other nodes. For example, the transaction graph has a plurality of nodes, where two nodes a and B having a transaction relationship have respective transaction subgraphs, where node B is the other node in the transaction subgraph of node a, and node a is the other node in the transaction subgraph of node B. For nodes A and B, both have corresponding initial embedded matrixes and initial embedded vectors, and the attribute information of accounts corresponding to both are hidden, and the hiding method is to take the node A or B as a starting node in a transaction sub-graph of the node and take the starting node as a zero vector.

Since each node in the transaction graph (including node v) has been generated _i And with respect to node v _i Node v being other node _j ) And the initial embedded matrix, and that each node (including node v) in the transaction graph has been paired in S201 and S202 _i And with respect to node v _i Node v being other node _j ) Hiding the attribute information of the corresponding account, and calculating to obtain each node (including the node v) _i And with respect to node v _i Node v being other node _j ) The initial local embedded vector after concealment.

Although node v _i And node v _j The hidden initial local embedding vector can be obtained by the above equation (5), but for the node v _i And node v _j To distinguish, node v can be divided into _i Initial local embedding vector passing after hiding

Indicates that it is to be relative to node v _i Node v being other node _j Initial local embedding vector passing after hiding

To indicate.

Then obtaining a negative sample pair of the ith node based on local comparison

Further, a local comparison learning term of each node is constructed and obtained by using the positive sample pair and the negative sample pair of each node based on local comparison, and specifically, the local comparison learning term of each node is obtained by the following formula:

wherein the content of the first and second substances,

for the local contrast learning term of the ith node, θ (m, n) is a similarity measure function for measuring the similarity between m and n,

for the positive sample pairs based on local contrast for the ith node,

for the i-th node based on locally contrasted negative sample pairs,

initial local embedding vector after hiding for ith node, z ⁱ For the initial embedded vector of the ith node,

the initial local embedding vector after hiding for the jth other node.

In this embodiment, referring to fig. 4, the obtaining a global contrast learning term for each node according to the initial embedding matrix and the initial embedding vector for each node further includes:

s401: hiding attribute information of an account corresponding to each node in the transaction graph;

s402: calculating to obtain an initial global embedding vector after each node is hidden according to the initial embedding matrix of each node;

s403: constructing a positive sample pair based on global contrast of each node by using the hidden initial global embedded vector of each node and the initial embedded vector of each node;

s404: constructing a negative sample pair of each node based on global comparison by using the hidden initial global embedded vector of each other node except the node in the transaction subgraph of each node and the initial embedded vector of each node;

s405: and constructing and obtaining a global comparison learning item of each node by utilizing the positive sample pair and the negative sample pair of each node based on global comparison.

The repetition of S401 to S405 and S301 to S305 in the above description is not repeated herein, wherein an initial global embedding vector after each node in the transaction graph is hidden can be obtained by calculation according to the initial embedding matrix of each node, as follows:

wherein the content of the first and second substances,

an initial global embedded vector after hiding the ith node, k is the number of nodes in a transaction subgraph of the ith node, H ⁱ For the initial embedding matrix for the ith node, [ u,:]representing the u-th node in the transaction sub-graph of the i-th node,

for transactions of the ith nodeThe sum of vectors for all nodes in the graph.

And further obtaining a positive sample pair of the ith node based on global comparison:

to node v _i And node v _j To distinguish, the node v can be divided into _i Hidden initial global embedded vector pass

Indicates that with respect to node v, it will be _i Node v being other node _j Hidden initial global embedded vector pass

To indicate.

Then obtaining a negative sample pair of the ith node based on global contrast

Further, a global contrast learning item of each node is constructed and obtained by using the positive sample pair and the negative sample pair of each node based on global contrast, and specifically, the global contrast learning item of each node is obtained by the following formula:

wherein the content of the first and second substances,

is a global contrast learning term of the ith node, theta (m, n) is a similarity measure function for measuring the similarity between m and n,

for the positive sample pair based on global contrast for the ith node,

for the ith node based on the negative example pair of the global contrast,

initial global embedding vector after hiding for ith node, z ⁱ For the initial embedded vector of the ith node,

the initial global embedded vector after hiding for the jth other node.

According to the local comparison learning item and the global comparison learning item of each node, an objective function is obtained as follows:

wherein, L is an objective function, and s is the number of nodes in the transaction graph.

The objective function may be minimized by an optimization method, such as a gradient descent method, to obtain an optimized graph neural network model.

Specifically, referring to fig. 5, the calculating the abnormality score of the target account according to the graph neural network model further includes:

s501: calculating to obtain a local anomaly score and a global anomaly score of the target account according to the graph neural network model;

s502: and linearly adding the local abnormal score and the global abnormal score of the target account to obtain the abnormal score of the target account.

Referring to fig. 6, wherein said calculating the local anomaly score and the global anomaly score of the target account according to the graph neural network model further comprises:

s601: obtaining an embedded matrix of a target node corresponding to a target account by using the graph neural network model;

s602: calculating to obtain an embedded vector of a target node by using the graph neural network model;

s603: and obtaining the local abnormal score and the global abnormal score of the target node according to the embedded matrix and the embedded vector of the target node.

According to the above formula (3), the relationship between the neural network model and the embedding matrix can be obtained as follows:

H ^i' ＝f'(A ⁱ ,X ⁱ ) (10)

wherein H ^i' And f' () is an embedded matrix of the ith node, and a graph neural network model.

According to the above formula (4), the relationship between the neural network model and the embedded vector can be obtained as follows:

z ^i' ＝f'(x ⁱ ) (11)

wherein z is ^i' Is the embedded vector of the ith node.

By the above equations (10) and (11), the embedding matrix and the embedding vector of the target node corresponding to the target account can be obtained.

In this embodiment, referring to fig. 7, the obtaining a local anomaly score of a target node according to the embedded matrix and the embedded vector of the target node further includes:

s701: hiding attribute information of a target account in a transaction graph;

s702: calculating to obtain a local embedded vector after the target node is hidden according to the embedded matrix of the target node;

s703: and calculating to obtain the local abnormal score of the target node according to the local embedded vector after the target node is hidden, the local embedded vector after the other nodes except the node in the transaction subgraph of the target node are hidden, and the embedded vector of the target node.

The methods of S701 to S702 are similar to the above method, and are not described herein again, and after obtaining the local embedded vector after the target node is hidden, the local embedded vector is used for the purpose of aligning the node v _i With nodes v other than the node _j To distinguish, the node v can be divided into _i Hidden local embedding vector pass

Indicates that it is to be relative to node v _i Node v being other node _j Hidden local embedding vector pass

To indicate.

For S703, specifically, the local anomaly score of the target node is calculated by the following formula:

wherein the content of the first and second substances,

is the local anomaly score of the target node, theta (m, n) is a similarity measure function for measuring the similarity between m and n,

the hidden local embedded vector for the target node,

locally embedded vectors after concealment for other nodes, z ^i' Is the embedded vector of the target node.

In this embodiment, referring to fig. 8, the obtaining a global anomaly score of the target node according to the embedded matrix and the embedded vector of the target node further includes:

s801: hiding attribute information of a target account in a transaction graph;

s802: calculating to obtain a global embedded vector after the target node is hidden according to the embedded matrix of the target node;

s803: and calculating to obtain the global abnormal score of the target node according to the global embedded vector after the target node is hidden, the global embedded vector after other nodes except the node in the transaction subgraph of the target node are hidden, and the embedded vector of the target node.

The methods of S801 to S802 are similar to the above methods, and are not described herein again, and after obtaining the global embedded vector after the target node is hidden, the node v is paired to _i With nodes v other than the node _j To distinguish, node v can be divided into _i Hidden global embedded vector pass

To indicate.

For S803, the global anomaly score of each node is calculated by the following formula:

wherein the content of the first and second substances,

is the global anomaly score of the target node, theta (m, n) is a similarity measure function for measuring the similarity between m and n,

the hidden global embedded vector for the target node,

global embedded vector after hiding for other nodes, z ^i' Is an embedded vector of nodes.

Further, the local abnormality score and the global abnormality score of the target node are linearly added through the following formula to obtain the abnormality score of the target node:

wherein, y ⁱ And alpha is a hyper-parameter and is an arbitrary number between 0 and 1, wherein the abnormal score of the target node is shown.

The larger the abnormality score of the target node is, the higher the abnormality degree of the node is, and when the abnormality score is larger than a set threshold, the account corresponding to the node may be determined to be an abnormal account. The abnormal account detection can be carried out by utilizing the graph neural network model, the abnormal score of the target node can be obtained according to the graph neural network model, and the target account can be further determined to be a normal account or an abnormal account through the abnormal score, so that the detection efficiency and accuracy of the abnormal account are improved.

Based on the above abnormal account detection method, an embodiment herein further provides a method for constructing a neural network model, where the neural network model is applied to the abnormal account detection method, and the method includes:

and training the target function to obtain a graph neural network model.

The construction method of the neural network model in the figure is the same as the construction method of the step 1.1 to the step 1.4, and therefore repeated parts are not described again.

It should be noted that, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, presented data, etc.) referred to in the present application are information and data authorized by the user or sufficiently authorized by each party. In addition, the technical scheme described in the embodiment of the application can be used for acquiring, storing, using, processing and the like of data, which all conform to relevant regulations of national laws and regulations.

Based on the above-mentioned method for constructing the neural network model, the embodiment herein further provides an abnormal account detection device. The apparatus may include systems (including distributed systems), software (applications), modules, components, servers, clients, etc. that employ the methods described herein in embodiments, in conjunction with any necessary apparatus to implement hardware. Based on the same innovative concepts, embodiments herein provide an apparatus as described in the following embodiments. Since the implementation scheme of the apparatus for solving the problem is similar to that of the method, the specific apparatus implementation in the embodiment of the present disclosure may refer to the implementation of the foregoing method, and repeated details are not repeated. As used hereinafter, the term "unit" or "module" may be a combination of software and/or hardware that implements a predetermined function. Although the means described in the embodiments below are preferably implemented in software, an implementation in hardware, or a combination of software and hardware is also possible and contemplated.

Specifically, fig. 9 is a schematic block diagram of an embodiment of an abnormal account detection apparatus provided in an embodiment of the present disclosure, and referring to fig. 9, the abnormal account detection apparatus provided in the embodiment of the present disclosure includes: the system comprises an acquisition module 100, an input module 200, a calculation module 300 and a determination module 400.

An obtaining module 100, configured to obtain attribute information of a target account;

the input module 200 is configured to input the attribute information of the target account into a pre-constructed neural network model of the graph, where the neural network model of the graph completes construction of the transaction graph generated based on the transaction information of the account;

a calculating module 300, configured to calculate an abnormal score of the target account according to the graph neural network model;

a determining module 400, configured to determine, according to the abnormal score, that the target account is a normal account or an abnormal account.

Referring to fig. 10, based on the above-described neural network model building method or the abnormal account detection method, a computer device 1002 is further provided in an embodiment of the present disclosure, where the above-described method runs on the computer device 1002. Computer device 1002 may include one or more processors 1004, such as one or more Central Processing Units (CPUs) or Graphics Processors (GPUs), each of which may implement one or more hardware threads. The computer device 1002 may also comprise any memory 1006 for storing any kind of information, such as code, settings, data, etc., and in a particular embodiment a computer program on the memory 1006 and executable on the processor 1004, the computer program when executed by the processor 1004 may perform instructions according to the above described method. For example, and without limitation, the memory 1006 may include any one or more of the following in combination: any type of RAM, any type of ROM, flash memory devices, hard disks, optical disks, etc. More generally, any memory may use any technology to store information. Further, any memory may provide volatile or non-volatile retention of information. Further, any memory may represent fixed or removable components of computer device 1002. In one case, when the processor 1004 executes the associated instructions, which are stored in any memory or combination of memories, the computer device 1002 can perform any of the operations of the associated instructions. The computer device 1002 also includes one or more drive mechanisms 1008, such as a hard disk drive mechanism, an optical disk drive mechanism, or the like, for interacting with any memory.

Computer device 1002 may also include an input/output module 1010 (I/O) for receiving various inputs (via input device 1012) and for providing various outputs (via output device 1014). One particular output mechanism may include a presentation device 1016 and an associated graphical user interface 1018 (GUI). In other embodiments, input/output module 1010 (I/O), input device 1012, and output device 1014 may also be excluded, as only one computer device in a network. Computer device 1102 can also include one or more network interfaces 1020 for exchanging data with other devices via one or more communication links 1022. One or more communication buses 1024 couple the above-described components together.

Communication link 1022 may be implemented in any manner, such as over a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. Communications link 1022 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

Corresponding to the methods in fig. 1-8, the embodiments herein also provide a computer-readable storage medium having stored thereon a computer program, which, when executed by a processor, performs the steps of the above-described method.

Embodiments herein also provide computer readable instructions, wherein when executed by a processor, a program thereof causes the processor to perform the method as shown in fig. 1-8.

It should be understood that, in various embodiments herein, the sequence numbers of the above-mentioned processes do not mean the execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments herein.

It should also be understood that, in the embodiments herein, the term "and/or" is only one kind of association relation describing an associated object, meaning that three kinds of relations may exist. For example, a and/or B, may represent: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates that the former and latter related objects are in an "or" relationship.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the examples described in connection with the embodiments disclosed herein may be embodied in electronic hardware, computer software, or combinations of both, and that the components and steps of the examples have been described in a functional general in the foregoing description for the purpose of illustrating clearly the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided herein, it should be understood that the disclosed system, apparatus, and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may also be an electric, mechanical or other form of connection.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments herein.

In addition, functional units in the embodiments herein may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present invention may be implemented in a form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the methods described in the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The principles and embodiments of the present disclosure are explained in detail by using specific embodiments, and the above description of the embodiments is only used to help understanding the method and its core idea; meanwhile, for the general technical personnel in the field, according to the idea of this document, there may be changes in the concrete implementation and the application scope, in summary, this description should not be understood as the limitation of this document.

Claims

1. An abnormal account detection method, comprising:

acquiring attribute information of a target account;

2. The abnormal account detection method of claim 1, wherein the calculating the abnormal score of the target account according to the neural network model further comprises:

3. The abnormal account detection method of claim 2, wherein the calculating the local abnormal score and the global abnormal score of the target account according to the neural network model further comprises:

4. The abnormal account detection method of claim 3, wherein obtaining the local abnormal score of the target node according to the embedded matrix and the embedded vector of the target node further comprises:

hiding attribute information of a target account in a transaction graph;

and calculating to obtain a local abnormal score of the target node according to the local embedded vector after the target node is hidden, the local embedded vectors after the other nodes except the node in the transaction subgraph of the target node are hidden, and the embedded vector of the target node.

5. The abnormal account detection method of claim 3, wherein obtaining the global abnormal score of the target node according to the embedded matrix and the embedded vector of the target node further comprises:

hiding attribute information of a target account in a transaction graph;

6. The abnormal account detection method of claim 1, wherein the method for constructing the neural network model comprises:

and training the target function to obtain a graph neural network model.

7. The abnormal account detection method of claim 6, wherein the processing the transaction sub-graph of each node by using the initial graph neural network model to obtain the objective function further comprises:

8. The abnormal account detection method of claim 7, wherein the obtaining the local comparison learning term of each node according to the initial embedding matrix and the initial embedding vector of each node further comprises:

constructing a negative sample pair based on local comparison of each node by using the hidden initial local embedding vector of each other node except the node in the transaction subgraph of each node and the initial embedding vector of each node;

9. The abnormal account detection method of claim 7, wherein the obtaining of the global contrast learning term of each node according to the initial embedding matrix and the initial embedding vector of each node further comprises:

constructing a positive sample pair of each node based on global comparison by using the hidden initial global embedded vector of each node and the initial embedded vector of each node;

10. A method for constructing a neural network model, wherein the neural network model is applied to the abnormal account detection method of any one of claims 1 to 9, and comprises the following steps:

and training the target function to obtain a graph neural network model.

11. An abnormal account detection apparatus, comprising:

12. A computer device comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program, when executed by the processor, performs the instructions of the method of any one of claims 1-10.

13. A computer-readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor of a computer device, is adapted to carry out the instructions of the method according to any one of claims 1-10.