CN115293247A - Method for establishing risk identification model, risk identification method and corresponding device - Google Patents
Method for establishing risk identification model, risk identification method and corresponding device Download PDFInfo
- Publication number
- CN115293247A CN115293247A CN202210859441.1A CN202210859441A CN115293247A CN 115293247 A CN115293247 A CN 115293247A CN 202210859441 A CN202210859441 A CN 202210859441A CN 115293247 A CN115293247 A CN 115293247A
- Authority
- CN
- China
- Prior art keywords
- network
- node
- risk identification
- behavior
- moments
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/049—Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
Abstract
The embodiment of the specification provides a method for establishing a risk identification model, a method for identifying risks and a corresponding device. The method comprises the following steps: acquiring a heterogeneous network graph of N moments constructed by using network behavior data of a user at the N moments, wherein part of nodes are marked with a label indicating whether a preset type risk exists; training by using the heterogeneous network diagram at the N moments to obtain the risk identification model, wherein the risk identification model comprises a diagram neural network, a pulse neural network, a splicing network and a mapping network; the training targets include: minimizing a difference between a risk identification result of the risk identification model for the node and the label. The risk identification method and the risk identification device combine the impulse neural network with the impulse neural network, and provide a risk identification model based on the impulse neural network to capture the structure and the time sequence information of the dynamic graph data, so that the risk identification based on the user network behavior data is more accurate.
Description
Technical Field
One or more embodiments of the present disclosure relate to the technical field of artificial intelligence, and in particular, to a method for establishing a risk identification model, a risk identification method, and a corresponding apparatus.
Background
With the increasing development of internet technology, users have various risks in various behaviors using the internet, and the demand for network security is higher and higher. In an actual risk control scenario, the graph neural network model is a deep neural network model which is widely applied at present. The graph neural network shows a strong learning and characterization capability in modeling the incidence relation between nodes in the graph structure. However, the current characterization learning based on the graph neural network is limited to processing static graph data, and most graph data changes in structure and property with the lapse of time in a real scene. Taking a financial wind-control scenario as an example, the transaction data is continuously generated, resulting in a graph structure that continuously changes over time. Therefore, the existing risk identification based on the graph neural network model cannot capture the structure and time sequence information of the dynamic graph data, so that the accuracy of the risk identification is low.
Disclosure of Invention
In view of this, one or more embodiments of the present specification disclose a method for establishing a risk identification model, a method for risk identification, and a corresponding apparatus, so as to improve accuracy of risk identification.
According to a first aspect, the present disclosure provides a method of building a risk identification model, the method comprising:
the method comprises the steps that a heterogeneous network graph of N moments, which is constructed by using network behavior data of a user at the N moments, is obtained, the heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, the edges are determined according to behavior relations between the behavior bodies and the behavior objects, and N is a positive integer greater than 1; some nodes in the nodes are marked with labels for judging whether the preset type risks exist or not;
training by utilizing the heterogeneous network diagrams at the N moments to obtain the risk identification model, wherein the risk identification model comprises a diagram neural network, a pulse neural network, a splicing network and a mapping network; the graph neural network obtains first characterization vectors of each node at the N moments by using the heterogeneous network graphs at the N moments; the pulse neural network accumulates and updates the membrane voltage by using the first characterization vectors of the nodes at the N moments to obtain pulse sequences of the nodes at the N moments; the splicing network splices the pulse sequences of the node at the N moments respectively aiming at each node to obtain a second characterization vector of the node; the mapping network is used for determining a risk identification result of each node by using the second characterization vector of each node; the training targets include: minimizing a difference between a risk identification result of the risk identification model for the node and the label.
According to an implementable manner of an embodiment of the application, the graph neural network adopts a graph sampling and aggregation GraphSAGE network;
for each time t in the N times, the GraphSAGE network samples the neighbor nodes of the node v from the heterogeneous network graph at the time t and samples the neighbor nodes of the node v from the updated graph data at the time t-1 compared with the heterogeneous network graph at the time t for each node v; and the graph SAGE determines a first characterization vector of the node v at the time t by using the information of the node v and the sampled neighbor nodes thereof.
According to an implementation manner of the embodiment of the present application, the accumulating and updating the membrane voltage by using the first characterization vector of each node at the N time instants to obtain the pulse sequence of each node at the N time instants includes:
the pulse neural network utilizes a first characterization vector of a node v at the time t and the membrane voltage at the time t-1 to accumulate the membrane voltage, and leaks partial membrane voltage based on leakage parameters to obtain the membrane voltage at the time t;
if the membrane voltage at the time t reaches the voltage threshold value at the time t, generating a pulse and setting the membrane voltage as an initial value;
the information whether the node v generates pulses at N times constitutes a pulse train of the node v at N times.
According to an implementation manner in the embodiment of the present application, the voltage threshold at time t is obtained from the voltage threshold at time t-1 and whether a pulse is generated at time t.
According to an implementation manner in the embodiment of the present application, in the training process, each iteration updates the model parameters of the risk identification model by using the values of the loss function until a preset training end condition is satisfied, where the model parameters include the leakage parameters.
According to an implementation manner in the embodiment of the present application, when updating the model parameters in the training process, an approximate step function is used to replace a step function adopted by the impulse neural network to perform gradient calculation, where the approximate step function includes a Sigmoid function.
In a second aspect, a method for risk identification is provided, the method comprising:
the method comprises the steps that a heterogeneous network graph of N moments, which is constructed by using network behavior data of a user at the N moments, is obtained, the heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, the edges are determined according to behavior relations between the behavior bodies and the behavior objects, and N is a positive integer greater than 1;
inputting the information of the heterogeneous network graph and the target node at the N moments into a risk identification model to obtain a risk identification result of the target node by the risk identification model;
wherein the risk identification model is pre-established using the method of the first aspect.
In a third aspect, an apparatus for establishing a risk identification model is provided, the apparatus comprising:
the graph acquiring unit is configured to acquire an N-moment heterogeneous network graph constructed by using network behavior data of a user at N moments, wherein the heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, the edges are determined according to behavior relations between the behavior bodies and the behavior objects, and N is a positive integer greater than 1; some nodes in the nodes are marked with labels for judging whether the preset type risks exist or not;
the model training unit is configured to train by using the heterogeneous network diagram at the N moments to obtain the risk identification model, wherein the risk identification model comprises a diagram neural network, a pulse neural network, a splicing network and a mapping network; the graph neural network obtains first characterization vectors of each node at the N moments by using the heterogeneous network graphs at the N moments; the pulse neural network accumulates and updates the membrane voltage by using the first characterization vectors of the nodes at the N moments to obtain pulse sequences of the nodes at the N moments; the splicing network splices the pulse sequences of the node at the N moments respectively aiming at each node to obtain a second characterization vector of the node; the mapping network is used for determining a risk identification result of each node by using the second characterization vector of each node; the training targets include: minimizing a difference between a risk identification result of the risk identification model for the node and the label.
In a fourth aspect, an apparatus for risk identification is provided, the apparatus comprising:
the graph acquiring unit is configured to acquire an N-moment heterogeneous network graph constructed by using network behavior data of a user at N moments, wherein the heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, the edges are determined according to behavior relations between the behavior bodies and the behavior objects, and N is a positive integer greater than 1;
the risk identification unit is configured to input the information of the heterogeneous network graph and the target node at the N moments into a risk identification model and obtain a risk identification result of the target node by the risk identification model;
wherein the risk identification model is pre-established using the apparatus of the third aspect.
According to a fourth aspect, the present disclosure provides a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of the first or second aspect above.
According to the specific embodiments provided by the present application, the present application can have the following technical effects:
1) The risk identification method and the risk identification device combine the impulse neural network with the impulse neural network, and provide a risk identification model based on the impulse neural network to capture the structure and the time sequence information of the dynamic graph data, so that the risk identification based on the user network behavior data is more accurate.
2) According to the method, the graph neural network adopts the GraphSAGE network, the sampling mode of the GraphSAGE network is improved, and for each node v, the neighbor nodes of the node v are sampled from the heterogeneous network graph at the time t and the neighbor nodes of the node v are sampled from the updated graph data of the heterogeneous network graph at the time t-1 compared with the heterogeneous network graph at the time t, so that the dynamic graph data are adapted, and the dynamic evolution information of the nodes under the graph structure is better captured.
3) The pulse neural network has few model parameters and simple calculation process, and only relates to simple voltage charging and discharging, so compared with an RNN framework, the calculation efficiency is greatly improved.
4) The characterization vector of the node output by the impulse neural network is an impulse sequence with discrete coefficients, so that the calculation and storage efficiency is greatly improved compared with real value storage.
5) According to the method, the pulse neural network adopts a leakage integral discharge mode, the voltage threshold value can be dynamically adjusted, and the leakage parameters can be learned, so that the capability of the pulse neural network for capturing time sequence information is enhanced, and the pulse neural network can better converge in the training process.
Drawings
In order to more clearly illustrate the embodiments or technical solutions in the prior art of the present invention, the drawings used in the embodiments or technical solutions in the prior art description will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and other drawings can be obtained by those skilled in the art without creative efforts.
FIG. 1 illustrates an exemplary system architecture diagram to which embodiments of the disclosure may be applied;
FIG. 2 is a flowchart of a method for establishing a risk identification model according to an embodiment of the present disclosure;
FIG. 3 is a schematic diagram of a risk identification model provided in an embodiment of the present application;
fig. 4 is a structural diagram of an apparatus for establishing a risk identification model according to an embodiment of the present application;
fig. 5 is a block diagram of a risk identification device according to an embodiment of the present application.
Detailed Description
The scheme provided by the specification is described below with reference to the accompanying drawings.
The terminology used in the embodiments of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in the examples of the present invention and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
It should be understood that the term "and/or" as used herein is merely an association relationship that describes an associated object, meaning that three relationships may exist, e.g., a and/or B may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates a relationship in which the front and rear associated objects are an "or".
The word "if," as used herein, may be interpreted as "at … …" or "at … …" or "in response to a determination" or "in response to a detection," depending on context. Similarly, the phrase "if determined" or "if detected (a stated condition or event)" may be interpreted as "when determined" or "in response to determining" or "when detected (a stated condition or event)" or "in response to detecting (a stated condition or event)" depending on the context.
Based on the scenario of the motion map data, motion map characterization learning has become an important research direction in recent years. Dynamic graph characterization learning adds a time dimension to static graph data modeling to enable simultaneous characterization of structural and timing information of dynamic graph data.
The existing implementation mode for learning the dynamic graph characteristics mainly applies the static graph neural network model to the dynamic graph scene in an improved mode, and additionally considers the time dimension. A typical approach is to combine an Recurrent Neural Network (RNN) architecture with an atlas architecture, while modeling the atlas structure and time information. However, this method has the following disadvantages:
1) The RNN model has large parameter quantity and complex calculation, and is difficult to be applied to large-scale dynamic graph data scenes such as risk identification.
2) The representation vectors of each node obtained by RNN are real values, and the requirement for storage is high.
In view of this, the present application provides a completely new modeling concept of risk identification model. To facilitate an understanding of the present application, a system architecture upon which the present application is based will first be described. FIG. 1 illustrates an exemplary system architecture to which embodiments of the disclosure may be applied. The system mainly comprises a device for establishing a risk identification model and a risk identification device. The device for establishing the risk identification model acquires batch user network behavior data from the data warehouse and analyzes the user network behavior data so as to establish the risk identification model.
And the risk identification device carries out risk identification on the target node in the graph data by using the trained risk identification model.
The risk identification model establishing device and the risk identification device in the system can be realized at a server side. The server side can be a single server, a server group formed by a plurality of servers, or a cloud server. The cloud Server is also called a cloud computing Server or a cloud host, and is a host product in a cloud computing service system, so as to solve the defects of large management difficulty and weak service expansibility in the conventional physical host and Virtual Private Server (VPs) service. Besides being implemented on the server side, the method can also be implemented on a computer terminal with powerful computing power.
It should be understood that the number of risk identification means, risk identification means and data repositories in fig. 1 is illustrative only. There may be any number of risk identification model building devices, risk identification devices, and data repositories, as desired for an implementation.
Fig. 2 is a flowchart of a method for establishing a risk identification model according to an embodiment of the present disclosure. It will be appreciated that the method may be performed by the means for establishing a risk identification model in the system shown in figure 1. Referring to fig. 2, the method includes:
step 202: acquiring a heterogeneous network graph of N moments, which is constructed by using network behavior data of a user at the N moments, wherein the heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, the edges are determined according to behavior relations between the behavior bodies and the behavior objects, and N is a positive integer greater than 1; some of the nodes are labeled with a label indicating whether a preset type risk exists.
Step 204: training by using the heterogeneous network diagram at N moments to obtain a risk identification model, wherein the risk identification model comprises a diagram neural network, a pulse neural network, a splicing network and a mapping network; the graph neural network obtains first characterization vectors of each node at N moments by using the heterogeneous network graphs at the N moments; the impulse neural network accumulates and updates the membrane voltage by using the first characterization vectors of each node at N moments to obtain an impulse sequence of each node at the N moments; the splicing network splices the pulse sequences of the node at N moments respectively aiming at each node to obtain a second characterization vector of the node; the mapping network is used for determining the risk identification result of each node by using the second feature vector of each node; the training targets include: and minimizing the difference between the risk identification result of the risk identification model to the node and the label.
As can be seen from the technical contents provided by the above embodiments, the present application combines an impulse neural network with an impulse neural network, and proposes a risk identification model based on the impulse neural network to capture structure and timing information of dynamic graph data, so that risk identification based on user network behavior data is more accurate.
In addition, the pulse neural network has few model parameters and simple calculation process, and only relates to simple voltage charging and discharging, so compared with an RNN framework, the calculation efficiency is greatly improved.
The characterization vectors of the nodes output by the impulse neural network are sparse and discrete pulse sequences, so that the calculation and storage efficiency is greatly improved compared with real value storage.
It should be noted that the terms "first", "second", and the like in this application are not limited in terms of size, order, quantity, and the like, and are used only for distinguishing in terms of names, for example, the term "first token vector" and the term "second token vector" are used for distinguishing two token vectors.
The respective steps shown in fig. 2 will be explained below.
First, the above step 202, that is, acquiring a heterogeneous network graph of N time instants constructed by using network behavior data of a user at N time instants, will be described in detail with reference to an embodiment.
During the process of using the network, the user is recorded with a large amount of network behavior data by the server side, and the network behavior data is usually recorded in the data warehouse and represents the association between a large amount of behavior subjects and behavior objects. Meanwhile, the behavior data of the user is changed along with the time, so that the network behavior data of the user at each moment can be obtained, and the network abnormal picture at each moment is constructed on the basis of the network behavior data.
The risk identification that is usually performed is scenario-specific, as are the types of behavior bodies, behavior objects, and network behaviors that are to be attended to and analyzed in a scenario. Therefore, the behavior body, the behavior object and the network behavior of the behavior body type, the behavior object type and the network behavior type corresponding to the target scene can be obtained from the data warehouse to construct the heterogeneous network diagram. This way of building a heterogeneous network graph based on a particular scenario may greatly reduce the size of the graph data. The heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, and the edges are determined according to network behavior relations between the behavior bodies and the behavior objects.
The main body type, the behavior object type and the network behavior type corresponding to the target scene can be set in advance according to experience.
Taking the risk of network transaction as an example, the action subject may be an account, a bank card, etc. The action object may also be an account, a bank card, etc., and may also be a red envelope id, etc. That is, the behavioral subjects and behavioral objects are subjects and objects related to financial classes. The edges between the nodes can be the payment behavior, the deposit and withdrawal behavior, the contract binding behavior, the red envelope receiving and sending behavior and other behavior relations which are related to the finance class and occur between the behavior main body and the behavior object.
Taking the risk of cyber-friend fraud as an example, the behavioral entity may be a social network account, a real-time communication instrument account, a financial account, a host address, a client identification, and so on. The edges between nodes may be an action of sending a friend request, an action of adding a friend, a chat action, a transfer action, an action of sending and receiving a red envelope, an action of sending a link, and the like.
In the embodiment of the application, when the risk identification model is established, the used heterogeneous network graphs at the N moments are all pre-established in the manner described above. N is a positive integer greater than 1, that is, a heterogeneous network graph at a plurality of continuous time points needs to be constructed. Because the risk identification model is established in the embodiment of the application in a monitoring and learning manner, part of nodes in the heterogeneous network graph need to be labeled, and the labeled part of nodes are used as sample nodes. The tagged content is a label of whether a preset type of risk exists, e.g., a risky user tagged as fraud, a non-risky user.
For example, if some users are frequently complained, the users can be considered as known risk users, and corresponding nodes are determined and labeled in the heterogeneous network graph. For another example, some existing detection tools with high accuracy are used to detect that some users are risky users, or some risky users may be identified by a manual identification method, and corresponding nodes are determined and labeled in the heterogeneous network.
Similarly, there are also some users who are explicitly non-risky users. For example, obtaining a message from some official channel indicates that some users are highly recommended or approved, or are highly reputable users, such as users with a large amount of charitable behaviors, users who promote city construction, users who are rated as models, and the like, which are determined to be known safe users, and corresponding nodes are determined and labeled in the heterogeneous network. For another example, some existing high-accuracy detection tools can detect that some users are safe users, or some safe users can be identified in a manual identification manner, and corresponding nodes are determined and labeled in the heterogeneous network.
The above step 204, i.e., "training to obtain a risk identification model by using a heterogeneous network graph at N times" is described in detail below with reference to an embodiment.
As shown in fig. 3, the risk identification model provided in the embodiment of the present application mainly includes a graph neural network, a pulse neural network, a stitching network, and a mapping network.
The input of the graph neural network is a heterogeneous network graph of N moments. After the heterogeneous network graph at a time is input into the graph neural network, the graph neural network may output a first characterization vector of each node at the time. For the N moments, the graph neural network obtains first characterization vectors of each node at the N moments by respectively using the heterogeneous network graphs at the N moments.
As one of realizable ways, the Graph neural network employed in the embodiments of the present application may be a Graph Sample and aggregate network, but may be other Graph neural networks such as a Graph convolution network, a Graph attention network, a Graph transform network, and the like, in addition.
The GraphSAGE network samples neighbors by using the connection information between the nodes, and then continuously fuses the information of the neighboring nodes together through an aggregation function. The traditional GraphSAGE network is only suitable for static graph data, and in order to better adapt to a dynamic graph data structure, the sampling mode of the GraphSAGE network is improved by adopting dynamic neighbor sampling based on time sequence. Specifically, for each time t in the N times, the GraphSAGE network samples the neighbor nodes of the node v from the heterogeneous network graph at the time t and samples the neighbor nodes of the node v from the update graph data at the time t-1 compared with the heterogeneous network graph at the time t for each node v; then the
And determining a first characterization vector of the node v at the time t by using the information of the node v and the sampled neighbor nodes thereof.
For example, a set of neighbors sampled at time t for node v
The following formula can be used:
wherein SAMPLER represents the function used for sampling,
for a heterogeneous network graph at time t,
and comparing the data of the updating graph at the t-1 moment with the data of the heterogeneous network graph at the t moment. For the initial moment of time, it is,
the dynamic evolution information of the nodes under the graph structure can be better captured through the sampling mode.
And based on the sampled neighbor set of the node v, the GraphSAGE network carries out aggregation processing to obtain a first characterization vector of the node v.
And the pulse neural network accumulates and updates the membrane voltage by using the first characterization vectors of the nodes at the N moments to obtain the pulse sequences of the nodes at the N moments.
The impulse neural network is a new generation artificial neural network derived from biological inspiration, is different from the traditional artificial neural network adopting real numerical calculation, and carries out information exchange and processing through discrete impulse signals. The impulse neural network is a computationally efficient neural network, the neurons of the impulse neural network are in an active state only when receiving or transmitting impulse signals, and the neurons are in a suppressed state in most of the time, so that the computational efficiency of the network can be remarkably improved, and the energy consumption can be reduced. In addition, the impulse neural network can capture the change condition of the impulse at different moments, so the impulse neural network is naturally suitable for modeling time sequence data, and the application applies the impulse neural network to dynamic graph data for the first time.
As one of the realizable ways, the impulse neural network employed in the embodiments of the present application may be a leaky integrate-and-discharge network. For ease of understanding, the principle of the leaky integral discharge network will first be briefly described. The main idea is to simulate the charging and discharging process of the neuron by a capacitor connected in parallel with a resistor. The membrane voltage dynamic process of the leakage integral discharge network comprises three parts:
1) And (6) charging. When an external current enters the model at each moment, the neuron starts to charge cumulatively, releasing (leaking) part of the mode voltage.
2) And (4) discharging. When the membrane voltage reaches a voltage threshold, the neuron generates a pulse.
3) And (4) resetting. When a neuron generates a pulse, the membrane voltage enters a reset state or an initial state.
The membrane voltage dynamics of the leak integral discharge model can be described by the following differential equation:
wherein V is membrane voltage, C is capacitance, R is resistance, V reset To reset or initialize the voltage, I (t) is the current input to the leaky integrator-discharge network at time t.
wherein tau is m And = RC is a super parameter and can be used for controlling the attenuation/increase speed of the membrane voltage. V t The membrane voltage at time t.
In the embodiment of the application, the first characterization vector of the node v at the time t is equivalent to the I (t), that is, the impulse neural network performs membrane voltage accumulation by using the first characterization vector of the node v at the time t and the membrane voltage at the time t-1, and simultaneously leaks partial membrane voltage based on the leakage parameter to obtain the membrane voltage at the time t; if the membrane voltage at the time t reaches the voltage threshold value at the time t, generating a pulse and setting the membrane voltage as an initial value; the information whether the node v generates pulses at N times constitutes a pulse train of the node v at N times.
The traditional leakage integral discharge model only considers the charge and discharge and reset processes of voltage, and although a voltage attenuation term is added, the situation of real neuron dynamic change is still difficult to accurately simulate.
Based on the above problems, in this embodiment, a conventional leakage integral discharge model is improved, and not only the dynamic change condition of the leakage parameter is considered, but also the voltage threshold of the membrane voltage is considered to be dynamically adjusted, so that better fitting capability and generalization capability are given to the risk identification model. After considering the above process, the dynamic process of the leakage integrated discharge network can be expressed as:
where f is a charge function, as shown in equation (3), and the leakage parameter τ m The optimization can be updated as the model is trained. Theta is a discharge function, and a step function is adopted; o is t And (3) the value of the pulse generated by the model at the time t is 0 or 1, and whether the pulse is generated is indicated. Tau is th And gamma is a parameter factor for controlling the dynamic adjustment of the voltage threshold.
Is the voltage threshold at time t-1.
By optimizing the impulse neural network, the risk identification model has better dynamic time sequence capturing capability and generalization capability.
The above process can be represented as follows:
wherein the content of the first and second substances,
w is a learnable weight matrix for the characterization vector output by the k layer at the time t by the node v. The AGG () is an aggregation function adopted by the graph neural network, and may be an aggregation function such as a mean value, a summation, and the like. δ () is a function of the impulse neural network with the input being the output of the graph neural network and the output being the generated impulse.
Considering that the output of the impulse neural network is a discrete boolean value, the above equation (5) can be further simplified to improve the computational efficiency:
wherein W [. Cndot.) is the mask Summation (Masked Summation) calculation operation. W [ h ] refers to the fact that the vector h is used for conducting masking processing on the matrix W, and then vectors obtained after the masking processing are added. For example:
h＝[0 1 0 1]
the vector h masks the matrix W, namely, the row vector of the matrix W corresponding to the position of the element 0 in the vector h is masked, and only the row vector of the matrix W corresponding to the position of the element 1 in the vector h is reserved. The masking process yields two vectors: 0.5.0.1.8.1.0 and 0.2.0.1.3.2, the two vectors are added to obtain the vector 0.7.0.2.1.1.2. It can be seen that the result after the mask summation process is consistent with the result of hW (vector and matrix multiplication). However, since the mask summation process only involves matrix addition and boolean mask operation, the computation efficiency is much higher than that of matrix multiplication, and the operation time can be greatly reduced.
The splicing network is used for splicing the pulse sequences of the node at N moments respectively aiming at each node to obtain a second characterization vector of the node. This can be expressed, for example, as:
wherein z is v And K is the total layer number of the impulse neural network. CONCAT () is the splicing process.
The mapping network is used for determining the risk identification result of each node by using the second characterization vector of each node. The mapping network may be a classification network, a regression network, or the like. The risk identification result is whether a label with a preset type of risk exists, for example, a user with a fraud risk, namely a fraud risk user, or a user without the fraud risk, namely a non-fraud risk user.
The training targets of the model comprise: and minimizing the difference between the risk identification result of the risk identification model to the node and the label. The loss function may be constructed according to the training targets, for example, if the mapping network employs a classification network, a cross entropy loss function may be employed, and if the mapping network employs a regression network, a mean square error loss function may be employed. And updating the model parameters by using the value of the loss function in each iteration in a mode such as gradient descent and the like until a preset training end condition is met. The training end condition may include, for example, that a value of the loss function is less than or equal to a preset loss function threshold, the number of iterations reaches a preset number threshold, and the like.
In the model training process, the impulse neural network adopts an inconductible step function, so that the gradient descent of the impulse neural network cannot be directly carried out to update parameters. To solve this problem, embodiments of the present application may perform gradient calculation using an approximate step function instead of the step function used by the impulse neural network. I.e. the gradient of the approximate step function is calculated for parameter updating when propagating in the backward direction, while the step function is still used when propagating in the forward direction.
As one of the realizable manners, the above-mentioned approximate step function may adopt Sigmoid function, whose expression is:
σ(αx)＝1/(1+exp(-αx)) (8)
in the back propagation process, the reciprocal calculation formula adopted when calculating the gradient is as follows:
σ(αx)′＝α·σ(αx)·(1-σ(αx)) (9)
wherein x is the membrane voltage. Alpha is a hyperparameter used to control the degree of smoothing of the function. When alpha is larger, the smoother the approximate step function is, the worse the approximate effect is; when α is small, the more sharp the approximate step function is, the better the approximation effect is, but the problems of gradient explosion and gradient disappearance easily occur at both ends. Therefore, an appropriate α is selected, and an empirical value or an experimental value can be used.
In addition, the updated model parameters comprise parameters of a graph neural network, an impulse neural network and a mapping network, and particularly, leakage parameters in the impulse neural network are updated and optimized along with a model training process, so that the model has better dynamic time sequence capturing capability and generalization capability.
It should be noted that, in the process of risk identification model training, what is input into the risk identification model is mainly an adjacency matrix and a node feature matrix of the heterogeneous network graph. The node characteristic data adopted in the node characteristic matrix may be, for example, a node type, a registration duration, and related attribute information of a corresponding user. The characteristics of the edges, such as behavior type, behavior time, behavior location, behavior times, etc., may be fused when determining the node characteristics. Since the present application does not make any changes to this section, it will not be described in detail here.
After the training of the risk identification model is completed, the trained risk identification model can be used for risk identification, namely, the trained risk identification model is used for risk identification of a target node in a dynamic heterogeneous network graph. For example, after acquiring the N-moment heterogeneous network graphs constructed by using the network behavior data of the user at the N moments, inputting the information of the target node and the information of the N-moment heterogeneous network graphs into a risk identification model, and outputting a risk identification result for the target node by the risk identification model, for example, whether the target node has a preset type of risk.
Taking the network transaction risk as an example, the heterogeneous network graph obtained according to the user network behavior data comprises nodes such as an account, a bank card, a red packet id and the like. The edges between the nodes are the payment behavior, the deposit and withdrawal behavior, the signing and binding behavior, the red envelope receiving and sending behavior and other behavior relations related to finance, which occur among accounts, bank cards, red envelope ids and the like. And respectively acquiring the heterogeneous network diagrams at the N moments, wherein the heterogeneous network diagrams at the N moments represent dynamic changes of diagram data in time sequence. Nodes in the heterogeneous network graph that have been explicitly non-risky users and risky users are then labeled. The risk recognition model is trained by utilizing the labeled heterogeneous network diagram, and the risk recognition model captures the structure and time sequence information of dynamic diagram data based on the combination of the diagram neural network and the impulse neural network, so that the risk recognition model can more accurately recognize risks.
After the training is finished and a risk identification model is obtained, the risk identification model can carry out risk identification on the target node by using the heterogeneous network graph at the N moments and the information of the target node so as to determine whether the target node is a non-risk user.
The foregoing is a detailed description of the methods provided by the present disclosure, and has described specific embodiments herein. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.
The apparatus provided by the present disclosure is described in detail below. Fig. 4 is a block diagram of an apparatus for creating a risk identification model according to an embodiment of the present disclosure, and as shown in fig. 4, the apparatus 400 may include: a graph acquisition unit 401 and a model training unit 402. The main functions of each component unit are as follows:
a graph obtaining unit 401 configured to obtain an N-time heterogeneous network graph constructed by using network behavior data of a user at N times, where the heterogeneous network graph includes nodes and edges, the nodes include a behavior body and a behavior object, the edges are determined according to a behavior relationship between the behavior body and the behavior object, and N is a positive integer greater than 1; some of the nodes are labeled with a label of whether a preset type risk exists.
A model training unit 402 configured to train with the heterogeneous network graph at N times to obtain a risk identification model, where the risk identification model includes a graph neural network, a pulse neural network, a stitching network, and a mapping network; the graph neural network obtains first eigenvectors of each node at N moments by using the heterogeneous network graph at the N moments; the pulse neural network accumulates and updates the membrane voltage by using the first characterization vectors of the nodes at N moments to obtain pulse sequences of the nodes at the N moments; the splicing network splices the pulse sequences of the node at N moments respectively aiming at each node to obtain a second characterization vector of the node; the mapping network is used for determining the risk identification result of each node by using the second characterization vector of each node; the training targets include: and minimizing the difference between the risk identification result of the risk identification model to the node and the label.
As one of the realizable ways, the graph neural network adopts a GraphSAGE network;
for each time t in the N times, the GraphSAGE network samples the neighbor nodes of the node v from the heterogeneous network graph at the time t and samples the neighbor nodes of the node v from the updated graph data at the time t-1 compared with the heterogeneous network graph at the time t aiming at each node v; and the GraphSAGE determines a first characterization vector of the node v at the time t by using the information of the node v and the sampled neighbor nodes thereof. The dynamic evolution information of the nodes under the graph structure can be better captured through the sampling mode.
As one of the realizable modes, the pulse neural network adopts a leakage integral point model, namely, a first characterization vector of a node v at the time t and the membrane voltage at the time t-1 are utilized to accumulate the membrane voltage, and meanwhile, the partial membrane voltage is leaked on the basis of a leakage parameter to obtain the membrane voltage at the time t; if the membrane voltage at the time t reaches the voltage threshold value at the time t, generating a pulse and setting the membrane voltage as an initial value; the information whether the node v generates pulses at N times constitutes a pulse train of the node v at N times.
As one of the realizable ways, the voltage threshold at time t is obtained by the voltage threshold at time t-1 and whether or not a pulse is generated at time t.
As one of the realizable manners, the model training unit 402 updates the model parameters of the risk identification model by using the values of the loss function in each iteration during the training process until the preset training end condition is satisfied, where the model parameters include the leakage parameters.
It can be seen that, in the embodiment of the application, a traditional leakage integral discharge model is improved, dynamic change conditions of leakage parameters are considered, and dynamic adjustment of a voltage threshold of a membrane voltage is considered, so that better fitting capability and generalization capability of a risk identification model are given.
As one of the realizable manners, when the model training unit 402 updates the model parameters in the training process, the step function adopted by the impulse neural network is replaced with an approximate step function to perform gradient calculation, where the approximate step function includes a Sigmoid function.
Based on the risk identification model established as described above, fig. 5 shows a structure diagram of a risk identification apparatus according to an embodiment of the present disclosure, and as shown in fig. 5, the apparatus 500 may include: a graph acquisition unit 501 and a risk identification unit 502. The main functions of each component unit are as follows:
the graph obtaining unit 501 is configured to obtain an N-time heterogeneous network graph constructed by using network behavior data of a user at N times, where the heterogeneous network graph includes nodes and edges, the nodes include behavior bodies and behavior objects, the edges are determined according to behavior relationships between the behavior bodies and the behavior objects, and N is a positive integer greater than 1.
And a risk identification unit 502 configured to input the information of the target node and the heterogeneous network graph at the N moments into the risk identification model, and obtain a risk identification result of the target node by the risk identification model.
The embodiments in the present specification are described in a progressive manner, and portions that are similar to each other in the embodiments are referred to each other, and each embodiment focuses on differences from other embodiments. In particular, as for the apparatus embodiment, since it is substantially similar to the method embodiment, the description is relatively simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above-described system and system embodiments are only illustrative, wherein the units described as separate parts may or may not be physically separate, and the parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. One of ordinary skill in the art can understand and implement it without inventive effort.
Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in this disclosure may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
The computer storage media described above may take any combination of one or more computer-readable media, including, but not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
The above embodiments, objects, technical solutions and advantages of the present invention are further described in detail, it should be understood that the above embodiments are only for the purpose of describing the present invention, and are not intended to limit the scope of the present invention.
Claims (10)
1. A method of building a risk identification model, the method comprising:
the method comprises the steps that a heterogeneous network graph of N moments, which is constructed by using network behavior data of a user at the N moments, is obtained, the heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, the edges are determined according to behavior relations between the behavior bodies and the behavior objects, and N is a positive integer greater than 1; some nodes in the nodes are marked with labels for judging whether the preset type risks exist or not;
training by using the heterogeneous network diagram at the N moments to obtain the risk identification model, wherein the risk identification model comprises a diagram neural network, a pulse neural network, a splicing network and a mapping network; the graph neural network obtains first characterization vectors of each node at the N moments by using the heterogeneous network graphs at the N moments; the pulse neural network accumulates and updates the membrane voltage by using the first characterization vectors of the nodes at the N moments to obtain pulse sequences of the nodes at the N moments; the splicing network splices the pulse sequences of the node at the N moments respectively aiming at each node to obtain a second characterization vector of the node; the mapping network is used for determining a risk identification result of each node by using the second characterization vector of each node; the training targets include: minimizing a difference between a risk identification result of the risk identification model for the node and the label.
2. The method of claim 1, wherein the graph neural network employs graph sampling and aggregation GraphSAGE networks;
for each time t in the N times, the GraphSAGE network samples the neighbor nodes of the node v from the heterogeneous network graph at the time t and samples the neighbor nodes of the node v from the updating graph data at the time t-1 compared with the heterogeneous network graph at the time t aiming at each node v; and the GraphSAGE determines a first characterization vector of the node v at the time t by using the information of the node v and the sampled neighbor nodes thereof.
3. The method of claim 1, wherein the spiking neural network accumulates and updates the membrane voltage using the first characterization vector for each node at the N time instants, and wherein deriving the pulse sequence for each node at the N time instants comprises:
the pulse neural network utilizes a first characterization vector of a node v at the time t and the membrane voltage at the time t-1 to accumulate the membrane voltage, and leaks partial membrane voltage based on leakage parameters to obtain the membrane voltage at the time t;
if the membrane voltage at the time t reaches the voltage threshold value at the time t, generating a pulse and setting the membrane voltage as an initial value;
the information whether the node v generates pulses at N times constitutes a pulse train of the node v at N times.
4. The method of claim 3, wherein the voltage threshold at time t is derived from the voltage threshold at time t-1 and whether or not a pulse is generated at time t.
5. The method according to claim 3, wherein in the training process, each iteration updates model parameters of the risk identification model by using values of a loss function until a preset training end condition is met, wherein the model parameters comprise the leakage parameters.
6. The method according to any one of claims 1 to 5, wherein, when updating model parameters in the training process, gradient calculation is performed by replacing a step function adopted by the impulse neural network with an approximate step function, wherein the approximate step function comprises a Sigmoid function.
7. A method of risk identification, the method comprising:
the method comprises the steps that a heterogeneous network graph of N moments, which is constructed by using network behavior data of a user at the N moments, is obtained, the heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, the edges are determined according to behavior relations between the behavior bodies and the behavior objects, and N is a positive integer greater than 1;
inputting the information of the heterogeneous network graph and the target node at the N moments into a risk identification model to obtain a risk identification result of the target node by the risk identification model;
wherein the risk identification model is pre-established using the method of any one of claims 1 to 6.
8. An apparatus for establishing a risk identification model, the apparatus comprising:
the network behavior data acquisition unit is configured to acquire N moments of heterogeneous network graphs constructed by network behavior data of users at N moments, each heterogeneous network graph comprises nodes and edges, each node comprises a behavior body and a behavior object, each edge is determined according to a behavior relation between the behavior body and the behavior object, and N is a positive integer greater than 1; some nodes in the nodes are marked with labels for judging whether the preset type risks exist or not;
the model training unit is configured to train the risk recognition model by using the heterogeneous network diagram at the N moments, wherein the risk recognition model comprises a diagram neural network, a pulse neural network, a splicing network and a mapping network; the graph neural network obtains first characterization vectors of each node at the N moments by using the heterogeneous network graphs at the N moments; the pulse neural network accumulates and updates the membrane voltage by using the first characterization vectors of the nodes at the N moments to obtain pulse sequences of the nodes at the N moments; the splicing network splices the pulse sequences of the node at the N moments respectively aiming at each node to obtain a second characterization vector of the node; the mapping network is used for determining a risk identification result of each node by using the second characterization vector of each node; the training targets include: minimizing a difference between a risk identification result of the risk identification model for the node and the label.
9. An apparatus for risk identification, the apparatus comprising:
the graph acquiring unit is configured to acquire an N-moment heterogeneous network graph constructed by using network behavior data of a user at N moments, wherein the heterogeneous network graph comprises nodes and edges, the nodes comprise behavior bodies and behavior objects, the edges are determined according to behavior relations between the behavior bodies and the behavior objects, and N is a positive integer greater than 1;
the risk identification unit is configured to input the information of the heterogeneous network graph and the target node at the N moments into a risk identification model and obtain a risk identification result of the target node by the risk identification model;
wherein the risk identification model is pre-established using the apparatus of claim 8.
10. A computer-readable storage medium, on which a computer program is stored which, when executed in a computer, causes the computer to carry out the method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210859441.1A CN115293247A (en) | 2022-07-21 | 2022-07-21 | Method for establishing risk identification model, risk identification method and corresponding device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210859441.1A CN115293247A (en) | 2022-07-21 | 2022-07-21 | Method for establishing risk identification model, risk identification method and corresponding device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115293247A true CN115293247A (en) | 2022-11-04 |
Family
ID=83823362
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210859441.1A Pending CN115293247A (en) | 2022-07-21 | 2022-07-21 | Method for establishing risk identification model, risk identification method and corresponding device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115293247A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116561688A (en) * | 2023-05-09 | 2023-08-08 | 浙江大学 | Emerging technology identification method based on dynamic graph anomaly detection |
| CN116992157A (en) * | 2023-09-26 | 2023-11-03 | 江南大学 | Advertisement recommendation method based on biological neural network |
| CN117113148A (en) * | 2023-08-30 | 2023-11-24 | 上海智租物联科技有限公司 | Risk identification method, device and storage medium based on time sequence diagram neural network |
| CN117113148B (en) * | 2023-08-30 | 2024-05-17 | 上海智租物联科技有限公司 | Risk identification method, device and storage medium based on time sequence diagram neural network |
-
2022
- 2022-07-21 CN CN202210859441.1A patent/CN115293247A/en active Pending
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116561688A (en) * | 2023-05-09 | 2023-08-08 | 浙江大学 | Emerging technology identification method based on dynamic graph anomaly detection |
| CN116561688B (en) * | 2023-05-09 | 2024-03-22 | 浙江大学 | Emerging technology identification method based on dynamic graph anomaly detection |
| CN117113148A (en) * | 2023-08-30 | 2023-11-24 | 上海智租物联科技有限公司 | Risk identification method, device and storage medium based on time sequence diagram neural network |
| CN117113148B (en) * | 2023-08-30 | 2024-05-17 | 上海智租物联科技有限公司 | Risk identification method, device and storage medium based on time sequence diagram neural network |
| CN116992157A (en) * | 2023-09-26 | 2023-11-03 | 江南大学 | Advertisement recommendation method based on biological neural network |
| CN116992157B (en) * | 2023-09-26 | 2023-12-22 | 江南大学 | Advertisement recommendation method based on biological neural network |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109345260B (en) | Method for detecting abnormal operation behavior | |
| CN115293247A (en) | Method for establishing risk identification model, risk identification method and corresponding device | |
| Reddy et al. | Few-shot scene adaptive crowd counting using meta-learning | |
| CN109902546A (en) | Face identification method, device and computer-readable medium | |
| KR20170044102A (en) | Knowledge-graph biased classification for data | |
| CN112700252B (en) | Information security detection method and device, electronic equipment and storage medium | |
| CN111126674A (en) | Propagation prediction method and system based on depth model | |
| CN111178319A (en) | Video behavior identification method based on compression reward and punishment mechanism | |
| CN110084609B (en) | Transaction fraud behavior deep detection method based on characterization learning | |
| CN110853074A (en) | Video target detection network system for enhancing target by utilizing optical flow | |
| US20220237917A1 (en) | Video comparison method and apparatus, computer device, and storage medium | |
| CN113221104A (en) | User abnormal behavior detection method and user behavior reconstruction model training method | |
| CN112329895A (en) | Method and device for identifying user with suspicion of electricity stealing | |
| CN113935475A (en) | Simulation and training method of pulse neural network with pulse time offset | |
| CN111539916A (en) | Image significance detection method and system for resisting robustness | |
| CN114241587B (en) | Evaluation method and device for human face living body detection confrontation robustness | |
| CN110351303B (en) | DDoS feature extraction method and device | |
| CN114998659A (en) | Image data classification method for training impulse neural network model on line along with time | |
| Ma et al. | Robust face alignment by dual-attentional spatial-aware capsule networks | |
| CN111833115B (en) | Operation identification method and device, storage medium and server | |
| CN116612500B (en) | Pedestrian re-recognition model training method and device | |
| Schuman et al. | Variable structure dynamic artificial neural networks | |
| CN108717522A (en) | A kind of human body target tracking method based on deep learning and correlation filtering | |
| CN115293872A (en) | Method for establishing risk identification model and corresponding device | |
| CN115170136A (en) | Method and device for updating trusted model |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |