WO2022088408A1 - Procédé et système de détection de fraude de transaction basés sur un réseau neuronal graphique - Google Patents

Procédé et système de détection de fraude de transaction basés sur un réseau neuronal graphique Download PDF

Info

Publication number
WO2022088408A1
WO2022088408A1 PCT/CN2020/135271 CN2020135271W WO2022088408A1 WO 2022088408 A1 WO2022088408 A1 WO 2022088408A1 CN 2020135271 W CN2020135271 W CN 2020135271W WO 2022088408 A1 WO2022088408 A1 WO 2022088408A1
Authority
WO
WIPO (PCT)
Prior art keywords
transaction
graph
behavior
data
neural network
Prior art date
Application number
PCT/CN2020/135271
Other languages
English (en)
Chinese (zh)
Inventor
王欢
李青山
司华友
Original Assignee
南京博雅区块链研究院有限公司
北京大学
博雅正链(北京)科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 南京博雅区块链研究院有限公司, 北京大学, 博雅正链(北京)科技有限公司 filed Critical 南京博雅区块链研究院有限公司
Publication of WO2022088408A1 publication Critical patent/WO2022088408A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G06F18/232—Non-hierarchical techniques
    • G06F18/2323—Non-hierarchical techniques based on graph theory, e.g. minimum spanning trees [MST] or graph cuts
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange

Definitions

  • the invention relates to the field of financial technology, in particular to a transaction fraud detection method and system based on a graph neural network.
  • Transaction data refers to the directed transactions between many transaction accounts. Due to the existence of scams, malware, terrorist organizations, ransomware, Ponzi schemes, etc., some fraudulent transactions appear in the transaction network, and these data are time series data. Refers to the behavior sequence of transactions over a period of time, so we need to classify illegal transactions and legitimate transactions to detect transaction fraud.
  • a transaction fraud detection method and system based on a graph neural network.
  • the present invention proposes an embodiment of a transaction fraud detection method based on a graph neural network, comprising the following steps:
  • the transaction data preprocessing step is to obtain transaction data and preprocess the transaction data to obtain a panel-shaped transaction sample set
  • the step of extracting the historical features of the transaction behavior performing long-short-term memory network processing on the transaction sample set to obtain the historical features of the transaction behavior;
  • the step of extracting transaction behavior aggregation features is to perform graph convolution network processing on the transaction historical behavior features to obtain transaction behavior aggregation features;
  • the historical characteristics of the transaction behavior and the aggregated characteristics of the transaction behavior are processed by the full connection layer, and the fraud prediction of the transaction node is carried out through two classifications.
  • the preprocessing includes the following sub-steps:
  • the spectral clustering sample labeling step is to perform spectral clustering sample labeling processing on the transaction sample set to obtain a spectral clustering transaction sample set.
  • the spectral clustering sample labeling process includes the following sub-steps:
  • the feature matrix is clustered.
  • the graph convolutional network processing includes the following sub-steps:
  • the adjacency matrix is input into the graph convolutional network graph learning layers of layers 2 to 4 for feature propagation among neighbors, and nonlinear activation is performed on the outside after each layer.
  • a transaction fraud detection system based on a graph neural network proposed by the present invention, the transaction fraud detection system based on a graph neural network includes the following modules:
  • a transaction data preprocessing module which is used for acquiring transaction data and preprocessing the transaction data to obtain a panel-shaped transaction sample set
  • a transaction behavior historical feature extraction module which is used to perform long-short-term memory network processing on the transaction sample set to obtain transaction behavior historical features
  • the transaction behavior aggregation feature extraction module is configured to perform graph convolution network processing on the transaction historical behavior features to obtain transaction behavior aggregation features
  • a prediction module which is configured to perform full-connection layer processing on the historical characteristics of the transaction behavior and the aggregated characteristics of the transaction behavior, and perform fraud prediction of transaction nodes through binary classification.
  • the preprocessing includes the following sub-steps:
  • the graph neural network-based transaction fraud detection system further includes a spectral clustering sample labeling module, which is configured to perform spectral clustering sample labeling on the transaction sample set processing to obtain a spectral clustering transaction sample set.
  • the spectral clustering sample labeling process includes the following sub-steps:
  • the feature matrix is clustered.
  • the graph convolutional network processing includes the following sub-steps:
  • the adjacency matrix is input into the graph convolutional network graph learning layers of layers 2 to 4 for feature propagation among neighbors, and nonlinear activation is performed on the outside after each layer.
  • the above-mentioned transaction fraud detection method and system based on graph neural network overcomes the traditional transaction fraud detection method, which ignores the relationship between the data itself through the extraction of historical features of transaction behavior and the extraction of aggregated features of transaction behavior, and then through the full connection layer processing. And transaction behavior is the defect of time series data, which ensures the comprehensiveness of transaction fraud detection and improves the accuracy of transaction fraud detection.
  • Fig. 1 is the flow chart of the transaction fraud detection method based on graph neural network of the present invention
  • Fig. 2 is the flow chart of transaction data preprocessing steps in the transaction fraud detection method based on the graph neural network of the present invention
  • Fig. 3 time variation curve of local transaction node feature (transaction fee) after transaction data preprocessing in the transaction fraud detection method based on graph neural network of the present invention
  • Fig. 4 is the time change curve of the summary characteristic of the transaction node (the maximum value in the transaction fee of the local transaction node and its neighbor transaction node) after transaction data preprocessing in the transaction fraud detection method based on the graph neural network of the present invention
  • Figure 5 Illegal transaction diagram formed by transaction data marked as illegal transaction in Bitcoin transaction data
  • FIG. 7 is a comparison diagram of the effect of spectral clustering sample labeling and binary real distribution in the transaction fraud detection method based on graph neural network of the present invention.
  • Fig. 8 is a flow chart of parallelized construction of distance matrix in the method for detecting transaction fraud based on graph neural network of the present invention
  • FIG. 9 is a structural diagram of a transaction fraud detection system based on a graph neural network according to an embodiment of the present invention.
  • FIG. 10 is a data flow diagram of the transaction fraud detection system based on the graph neural network of the present invention.
  • the method and system for detecting transaction fraud based on a graph neural network of the present invention are described in detail by taking the digital currency transaction fraud detection of Bitcoin (BTC) as an example. It should be noted that the graph neural network-based transaction fraud detection method and system of the present invention can also be used in fraud detection of other transaction data, such as digital currency transaction data, traffic data, and stock data.
  • BTC digital currency transaction fraud detection
  • other transaction data such as digital currency transaction data, traffic data, and stock data.
  • the transaction fraud detection method based on the graph neural network proposed by the present invention includes the following steps:
  • a transaction data preprocessing step acquiring transaction data and preprocessing the transaction data to obtain a panel-shaped transaction sample set
  • S500 a prediction step, which performs full-connection layer processing on the historical characteristics of the transaction behavior and the aggregated characteristics of the transaction behavior, and conducts fraud prediction of transaction nodes through two classifications.
  • the above-mentioned transaction fraud detection method based on graph neural network overcomes the traditional transaction fraud detection method, which ignores the relationship between the data itself and the transaction through the extraction of historical features of transaction behavior and the extraction of aggregated features of transaction behavior, and then through the full connection layer processing. Behavior is a flaw in time-series data, ensuring comprehensive transaction fraud detection and improving transaction fraud detection accuracy.
  • the transaction data preprocessing step is mainly used to collect and preprocess the transaction data required for transaction fraud detection, so that the preprocessed transaction sample set is in the form of a panel and has a connection between transaction nodes and transaction nodes.
  • the samples constitute a dynamically changing transaction flow graph.
  • the transaction features at each time step are obtained through preprocessing, and the preprocessing includes the following sub-steps:
  • the Bitcoin real transaction data used is a transaction graph collected from the Bitcoin blockchain.
  • the data description of the transaction graph is as follows: a node in the graph represents a transaction, and an edge can be seen as the flow of Bitcoin between one transaction and another. It consists of 203769 nodes and 234355 edges. Among them, 2% of the nodes are marked as illegal nodes, 21% of the nodes are marked as legal transaction nodes, and the rest of the transactions are not marked.
  • each transaction node is associated with time information, where the time information refers to the estimated time when the Bitcoin network confirms the transaction.
  • the time interval of about 2 weeks is divided into 49 different time steps, about two years of Bitcoin transaction data.
  • the time interval between their mutual transactions on the blockchain is less than 3 hours, and the transaction nodes that exist in other time steps will not be connected. side, the time interval here can be modified to other reasonable values.
  • the local transaction node feature in step S110 represents transaction data of the local transaction node, such as time step, input transaction number (node in-degree), output transaction number (node out-degree), transaction fee, output amount, and derivative statistics.
  • the derived statistical features refer to some average features of neighboring nodes, such as the average BTC fee received by the number of input transactions, the average BTC fee received by the number of output transactions, the average BTC fee spent by the number of input transactions, and the average number of output transactions. BTC fees spent, average number of input/output transactions related to the number of input transactions (average number of input related transactions), average number of input/output transactions related to the number of output transactions (average number of output related transactions), etc.
  • the summary features of the transaction nodes in step S120 are obtained through the local transaction node features of the neighbor transaction nodes of the local transaction node forward and/or backward one-hop (one-hop), that is, all neighbor transaction nodes of the local transaction node are obtained.
  • the characteristic data of the same local trading node obtained by step S100 are processed, and the descriptive statistical characteristics such as the maximum value, minimum value, median, mode, standard deviation, full distance and correlation coefficient among them are obtained as the transaction node. Summarize features.
  • Step S130 is to obtain the local topology information of a transaction node, which is obtained by calculating the spectral information of the graph of all transaction nodes radiating an appropriate number of layers with the local transaction node as the center.
  • the node characteristics of the transaction graph are described as follows: the time step is 2 weeks, with a total of 49 steps.
  • the first 93 node characteristics are the characteristics of local transaction nodes, which are the characteristics and transaction data of local transaction nodes, including time step, number of input transactions (node in-degree), number of output transactions (node out-degree), transaction fee, output amount and Derived statistical features.
  • the last 72 node features are the aggregated features of the transaction nodes, using the maximum value of the same feature parameters (a local transaction node feature) obtained from the local (central) transaction node’s backward and/or backward neighbor transaction nodes , minimum, median, mode, standard deviation, range, and correlation coefficient.
  • Figure 3 and Figure 4 are drawn to observe the change curve of transaction characteristics over time after the transaction data preprocessing.
  • Figure 3 is the time change curve of a certain local transaction node characteristics (such as transaction fees)
  • Figure 4 is the summary characteristics of transaction nodes (such as the maximum value of the transaction fees of the local transaction node and its neighbor transaction nodes) time curve.
  • the figure shows the change of three types of nodes over time on two different attributes (local transaction node characteristics and transaction node summary characteristics). It can be seen that these two attributes can better distinguish legal transaction nodes (Fig.
  • the relatively stable curve in the middle and lower part) and the illegal transaction node (the curve in the upper part of the figure is more tortuous), in which the attribute curve of the legal transaction node is relatively stable over time at the bottom of the image, while the illegal transaction node is at the top of the image.
  • the curve is steeper.
  • step S100 after the transaction data preprocessing step of step S100 is completed, when the number of known classified transaction samples is sufficient, the historical feature extraction of transaction behavior in step S300 can be directly performed.
  • the number of transaction samples known to be classified is small and it is impossible to accurately detect transaction fraud, it is necessary to further perform spectral clustering sample labeling, and label unlabeled transaction nodes to avoid the situation of too small samples.
  • a spectral clustering sample labeling step performing spectral clustering sample labeling processing on the transaction sample set to obtain a spectral clustering transaction sample set.
  • the transaction sample set it consists of 203,769 nodes and 234,355 edges. Among them, 2% of the transaction nodes are marked as illegal transaction nodes, 21% of the transaction nodes are marked as legal transaction nodes, and the rest of the transaction nodes are not marked, that is, 77% of the transaction nodes are not marked. Since the classification of some samples of transaction data - transaction nodes is unknown, the present invention adopts the spectral clustering unsupervised method to classify these transaction nodes, and learns the labels of the unknown transaction nodes to increase the sample size and use them as available data for subsequent training. Optionally, due to the large number of samples to be learned, parallelized spectral clustering should be used.
  • spectral clustering is used to label unlabeled nodes for samples.
  • Spectral clustering can overcome the defect that K-means clustering is affected by data shape, and is a globally optimal clustering method.
  • the main idea of spectral clustering is to regard the data as points in the n-dimensional space, as shown in Figure 5 and Figure 6, which are the illegal transaction graph formed by the transaction data marked as illegal transaction in the bitcoin transaction data and the A graph of legitimate transactions formed by transaction data marked as legitimate transactions. If there is a certain similarity between points, they are connected by edges, and the purpose of clustering is achieved by cutting the graph composed of the above points and dividing them into multiple subgraphs, that is, the sum of the weight values in the subgraphs is as high as possible.
  • the implementation method is to connect the eigenvalue decomposition of the graph cut and the eigenvalue decomposition of the Laplacian matrix together through the Rayleigh entropy, so as to solve the NP-hard problem. Convert to continuous eigenvalues to solve the problem.
  • the spectral clustering sample labeling process includes the following sub-steps:
  • K-Means clustering method can be selected.
  • the left side of the figure is the real distribution of the two classifications of the original data
  • the right side is the spectral clustering sample labeling result processed by the spectral clustering algorithm of the present invention.
  • the classification result of the present invention after the spectral clustering sample labeling after spectral clustering is very similar to the true distribution of the binary classification, indicating that the spectral clustering sample labeling accuracy of the present invention is very high, which can greatly improve the detection accuracy of results.
  • the sample set data (x 1 , x 2 , .
  • the distance here can be measured using Euclidean distance, shortest path or Game distance, preferably shortest path or Game distance.
  • the Game distance means that there is only one shortest path from point A to point B (not allowed to leave the surface) on the surface (three-dimensional space), and the distance of this shortest path is the geodesic distance.
  • the process of parallelizing the construction of the distance matrix is shown in the figure.
  • reduce() reduces the results of all partitions, that is, traverses and merges values from the same new key written by map(), and combines The values in each row are filled column by column, resulting in a complete distance matrix.
  • the Gaussian similarity is calculated to obtain the similarity matrix W.
  • the final sparse real symmetric matrix L' is obtained.
  • the Lanczos method is suitable for iterative approximation to solve the eigenvalues and eigenvectors of such large sparse matrices.
  • the idea is to convert the Laplace matrix into a real symmetric tridiagonal matrix by means of orthogonal similarity transformation.
  • the eigenvalues and eigenvectors obtained by decomposing Tkk are the eigenvalues and eigenvectors of L'. If only the first k eigenvalues are calculated, the calculation can be completed with only k iterations, so it is more efficient.
  • the number of clusters k is set to 2 (legal transactions and illegal transactions), and the matrix composed of feature vectors h 1 , h 2 , .
  • the step of extracting the historical features of the transaction behavior is to perform long-short-term memory network processing on the transaction sample set to obtain the historical features of the transaction behavior. That is, by learning the historical characteristics of the transaction behavior, the historical characteristics of the transaction behavior can be obtained.
  • LSTM is committed to solving the long-term dependency problem. It adds three gates on the basis of RNN, namely input gate, forget gate and output gate, to effectively filter historical information, and the final output h t is composed of output gates o t and C t Long-term cellular state storage body determination.
  • the transaction node time series data in the transaction sample set obtained in the transaction data preprocessing step or the transaction node time series data in the spectral cluster transaction sample set obtained in the spectral clustering sample labeling step are input into the LSTM neural network
  • the graph convolutional network processing includes the following sub-steps:
  • the adjacency matrix is input into the graph convolutional network graph learning layer of layers 2 to 4 for feature propagation among neighbors, and nonlinear activation is performed on the outside after each layer.
  • the number of layers is set to 2-4 layers, so as to avoid too many layers affecting the learning of local features of nodes, and what is learned is global features.
  • the adjacency matrix is input into the 2-layer graph convolutional network graph learning layer for feature propagation among neighbors, and nonlinear activation is performed on the outside after each layer.
  • the calculation of the adjacency matrix of the historical feature of the transaction behavior can include two parts, the first part is whether there is an edge connection, and if so, it is set to 1; because it is a time series, the second part can be the similarity of each feature sequence. Finally, the weighted sum of the above two parts according to the weight is the similarity between a node and its neighbor nodes.
  • the present invention mainly uses graph-based methods for fraud detection.
  • ⁇ is the loss for a specific prediction task, which measures the error between the true value and the predicted value
  • ⁇ is the regularization term of the graph, which makes the prediction smooth on the graph
  • ⁇ is a hyperparameter to balance the above ratio of the two.
  • the regularization term usually implements the smoothness assumption of the graph signal, that is, similar vertices tend to have similar predictions, preserving the topological relationship of the graph.
  • a widely used regularization term ⁇ is defined as follows, which is a measure weighting based on Euclidean distance, which belongs to the variation measure in the graph signal, and describes the overall smoothness. When g(x i , x j ) is 1 is the Euclidean distance:
  • g(x i , x j ) is the similarity measure between feature vectors of entity pairs, is the degree of vertex i.
  • the regularizer smoothes each pair of entities so that their predictions (after normalization by degrees) are close to each other.
  • the strength of the smoothing is determined by the similarity g(x i , x j ) of the feature vectors. This can be equivalently written in a more compact matrix form:
  • L is the Laplacian matrix of the graph i.e.
  • A is the similarity matrix
  • each element is g(x i , x j ).
  • Graph Convolutional Network is a special graph-based learning method that has developed rapidly in recent years. It incorporates the core idea of graph-based learning, namely advanced convolutional neural networks (CNNs).
  • CNNs advanced convolutional neural networks
  • the core idea of standard CNNs is to use convolutions (such as 3 ⁇ 3 filter matrices) to capture local patterns in the input data (such as oblique lines in images).
  • CNNs the goal of GCN is to capture the local connection patterns on the graph through convolution.
  • KNN K-Nearest Neighbor
  • Sort Sort to get the normalized output of the vertices
  • graph convolution network methods such as LGCL (Learn Graph Convolution Layer): the learnable graph convolution layer automatically selects a fixed number of neighbor nodes for each feature value-based sorting, so as to Transform the graph-structured data into regular one-dimensional mesh data, and then apply standard CNN operations on the one-dimensional mesh data;
  • f represents the filtering operation T of parameterized convolution
  • U is the matrix of characteristic column vectors of L.
  • U T X represents the positive transformation of GFT, and X is projected onto each eigenvector to obtain the Fourier coefficient ⁇ (in the spectral domain); the next step is F ⁇ , this step is scaling eigenvalue scaling, right
  • the elements of the angle matrix F are the eigenvalues of L, and the higher the frequency, the larger the scaling coefficient ⁇ , that is to say, L is a high-pass filter.
  • the above vector obtained by scaling Multiplying a U matrix to the left is an inverse transformation of GFT, which is equivalent to transforming the frequency domain information back to the time domain.
  • F is regarded as the equation of ⁇ , so that the k-order approximation of the Chebyshev polynomial T k (x) can be used to represent F:
  • X is the original vertex feature
  • the dimension is N*C
  • W is the parameter to be learned
  • the dimension is C*F
  • F is the output feature dimension. Then the dimension of the output after a first-order graph convolution is N*F.
  • the prediction step is to perform full-connection layer processing on the historical characteristics of the transaction behavior and the aggregated characteristics of the transaction behavior, and perform fraud prediction of transaction nodes through two classifications.
  • the historical characteristics of transaction behavior, aggregation characteristics of transaction behavior, and the output results of traditional machine learning models are processed through the full connection layer and then classified into two categories to obtain the prediction of whether the final transaction node is an illegal transaction (that is, predicting that the label of the transaction node to be tested is a legal transaction). or illegal transactions).
  • the present invention also proposes a transaction fraud detection system based on a graph neural network.
  • the transaction fraud detection system based on the graph neural network includes the following modules:
  • the transaction data preprocessing module is used to obtain transaction data and preprocess the transaction data to obtain a panel-shaped transaction sample set
  • the transaction behavior historical feature extraction module is used to perform long-short-term memory network processing on the transaction sample set to obtain the transaction behavior historical features
  • the transaction behavior aggregation feature extraction module is used to perform graph convolution network processing on transaction historical behavior features to obtain transaction behavior aggregation features;
  • the prediction module is used to perform full connection processing on the historical characteristics of the transaction behavior and the aggregated characteristics of the transaction behavior, and conduct fraud prediction of transaction nodes through two classifications.
  • the above-mentioned transaction fraud detection system based on graph neural network overcomes the traditional transaction fraud detection method that ignores the relationship between data itself and transactions through the extraction of historical features of transaction behavior and aggregation of transaction behavior, and then through the full connection layer processing. Behavior is a flaw in time-series data, ensuring comprehensive transaction fraud detection and improving transaction fraud detection accuracy.
  • the transaction data preprocessing module is mainly used to collect and preprocess the transaction data required for transaction fraud detection, so that the preprocessed transaction sample set is in the form of a panel and has a relationship between transaction nodes and transaction nodes.
  • the samples constitute a dynamically changing transaction flow graph.
  • the transaction features at each time step are obtained through preprocessing, and the preprocessing includes the following sub-steps:
  • the Bitcoin real transaction data used is a transaction graph collected from the Bitcoin blockchain.
  • the data description of the transaction graph is as follows: a node in the graph represents a transaction, and an edge can be seen as the flow of Bitcoin between one transaction and another. It consists of 203769 nodes and 234355 edges. Among them, 2% of the nodes are marked as illegal nodes, 21% of the nodes are marked as legitimate transaction nodes, and the rest of the transactions are not marked.
  • each transaction node is associated with time information, where time information refers to the estimated time when the Bitcoin network confirms the transaction.
  • time information refers to the estimated time when the Bitcoin network confirms the transaction.
  • the time interval of about 2 weeks is divided into 49 different time steps, about two years of Bitcoin transaction data.
  • the time interval between the mutual transactions between them appears on the blockchain is less than 3 hours, and the transaction nodes that exist in other time steps will not be connected. side, the time interval here can be modified to other reasonable values.
  • the various trading characteristics of each time step are explained in detail below.
  • the above-mentioned local transaction node characteristics represent transaction data of the local transaction node, such as time step, the number of input transactions (node in-degree), the number of output transactions (node out-degree), transaction fees, output volume, and derivative statistics.
  • the derived statistical features refer to some average features of neighboring nodes, such as the average BTC fee received by the number of input transactions, the average BTC fee received by the number of output transactions, the average BTC fee spent by the number of input transactions, and the average number of output transactions. BTC fees spent, average number of input/output transactions related to the number of input transactions (average number of input related transactions), average number of input/output transactions related to the number of output transactions (average number of output related transactions), etc.
  • the summary features of the above-mentioned transaction nodes are obtained through the local transaction node features of the neighbor transaction nodes of the local transaction node forward and/or one-hop backward (one-hop), that is, the passing steps of all neighbor transaction nodes of the local transaction node.
  • the characteristic data of the same local trading node obtained by S100 is processed, and the descriptive statistical characteristics such as the maximum value, minimum value, median, mode, standard deviation, range and correlation coefficient among them are obtained as the summary characteristics of the trading node.
  • the transaction node sub-graph information of the above transaction data is to obtain the local topology information of a transaction node.
  • the sub-graph information of the transaction node which reflects the topology information of the graph in the frequency domain. If the eigenvalues are similar, it means that the sub-graph topological structure where the transaction node is located is more similar.
  • the node characteristics of the transaction graph are described as follows: the time step is 2 weeks, with a total of 49 steps.
  • the first 93 node characteristics are the characteristics of local transaction nodes, which are the characteristics and transaction data of local transaction nodes, including time step, number of input transactions (node in-degree), number of output transactions (node out-degree), transaction fee, output amount and Derived statistical features.
  • the last 72 node features are the aggregated features of the transaction nodes, using the maximum value of the same feature parameters (a local transaction node feature) obtained from the local (central) transaction node’s backward and/or backward neighbor transaction nodes , minimum, median, mode, standard deviation, range, and correlation coefficient.
  • Figure 3 and Figure 4 are drawn to observe the change curve of transaction characteristics over time after the transaction data preprocessing.
  • Figure 3 is the time change curve of a certain local transaction node characteristics (such as transaction fees)
  • Figure 4 is the summary characteristics of transaction nodes (such as the maximum value of the transaction fees of the local transaction node and its neighbor transaction nodes) time curve.
  • the figure below shows the changes of three types of nodes over time on two different attributes (local transaction node characteristics and transaction node summary characteristics). It can be seen that these two attributes can better distinguish legal transaction nodes ( The lower part of the figure is a relatively stable curve) and the illegal transaction node (the upper part of the figure is more tortuous curve), in which the attribute curve of the legal transaction node is relatively stable over time at the bottom of the image, while the illegal transaction node at the top of the image changes with time.
  • the change curve is steeper.
  • the module for extracting historical features of transaction behavior can be directly executed.
  • the number of transaction samples known to be classified is small and it is impossible to accurately detect transaction fraud, it is necessary to further execute the spectral clustering sample labeling module to label unlabeled transaction nodes to avoid excessive sample size. Condition.
  • the graph neural network-based transaction fraud detection system further includes a spectral clustering sample labeling module, which is configured to perform spectral clustering sample labeling processing on the transaction sample set to obtain a spectral clustering transaction sample set.
  • a spectral clustering sample labeling module which is configured to perform spectral clustering sample labeling processing on the transaction sample set to obtain a spectral clustering transaction sample set.
  • the transaction sample set it consists of 203,769 nodes and 234,355 edges. Among them, 2% of the transaction nodes are marked as illegal transaction nodes, 21% of the transaction nodes are marked as legal transaction nodes, and the rest of the transaction nodes are not marked, that is, 77% of the transaction nodes are not marked. Since the classification of some samples of transaction data - transaction nodes is unknown, the present invention adopts the spectral clustering unsupervised method to classify these transaction nodes, and learns the labels of the unknown transaction nodes to increase the sample size and use them as available data for subsequent training. Optionally, due to the large number of samples to be learned, parallelized spectral clustering should be used.
  • spectral clustering is used to label unlabeled nodes for samples.
  • Spectral clustering can overcome the defect that K-means clustering is affected by data shape, and is a globally optimal clustering method.
  • the main idea of spectral clustering is to regard the data as points in the n-dimensional space, as shown in Figure 5 and Figure 6, which are the illegal transaction graph formed by the transaction data marked as illegal transaction in the bitcoin transaction data and the A graph of legitimate transactions formed by transaction data marked as legitimate transactions. If there is a certain similarity between points, they are connected by edges, and the purpose of clustering is achieved by cutting the graph composed of the above points and dividing them into multiple subgraphs, that is, the sum of the weight values in the subgraphs is as high as possible.
  • the implementation method is to connect the eigenvalue decomposition of the graph cut and the eigenvalue decomposition of the Laplacian matrix together through the Rayleigh entropy, so as to solve the NP-hard problem. Convert to continuous eigenvalues to solve the problem.
  • the spectral clustering sample labeling process includes the following sub-steps:
  • K-Means clustering method can be selected.
  • the left side of the figure is the real distribution of the two classifications of the original data
  • the right side is the spectral clustering sample labeling result processed by the spectral clustering algorithm of the present invention.
  • the classification result of the present invention after the spectral clustering sample labeling after spectral clustering is very similar to the true distribution of the binary classification, indicating that the spectral clustering sample labeling accuracy of the present invention is very high, which can greatly improve the detection accuracy of results.
  • the sample set data (x 1 , x 2 , .
  • the distance here can be measured using Euclidean distance, shortest path or Game distance, preferably shortest path or Game distance.
  • the Game distance means that there is only one shortest path from point A to point B (not allowed to leave the surface) on the surface (three-dimensional space), and the distance of this shortest path is the geodesic distance.
  • the process of parallelizing the construction of the distance matrix is shown in the figure.
  • reduce() reduces the results of all partitions, that is, traverses and merges values from the same new key written by map(), and combines The values in each row are filled column by column, resulting in a complete distance matrix.
  • the Gaussian similarity is calculated to obtain the similarity matrix W.
  • the final sparse real symmetric matrix L' is obtained.
  • the Lanczos method is suitable for iterative approximation to solve the eigenvalues and eigenvectors of such large sparse matrices.
  • the idea is to convert the Laplace matrix into a real symmetric tridiagonal matrix by means of orthogonal similarity transformation.
  • the eigenvalues and eigenvectors obtained by decomposing Tkk are the eigenvalues and eigenvectors of L'. If only the first k eigenvalues are calculated, the calculation can be completed with only k iterations, so it is more efficient.
  • the number of clusters k is set to 2 (legal transactions and illegal transactions), and the matrix composed of the eigenvectors h 1 , h 2 , .
  • the transaction behavior history feature extraction module is used to perform long short-term memory network processing on the transaction sample set to obtain transaction behavior history features. That is, by learning the historical characteristics of the transaction behavior, the historical characteristics of the transaction behavior can be obtained.
  • LSTM is committed to solving the long-term dependency problem. It adds three gates on the basis of RNN, namely input gate, forget gate and output gate, to effectively filter historical information, and the final output h t is composed of output gates o t and C t Long-term cellular state storage body determination.
  • the transaction node time series data in the transaction sample set obtained in the transaction data preprocessing step or the transaction node time series data in the spectral cluster transaction sample set obtained in the spectral clustering sample labeling step are input into the LSTM neural network
  • the graph convolutional network processing includes the following substeps:
  • the adjacency matrix is input into the graph convolutional network graph learning layer of layers 2 to 4 for feature propagation among neighbors, and nonlinear activation is performed on the outside after each layer.
  • the number of layers is set to 2-4 layers, so as to avoid too many layers affecting the learning of local features of nodes, and what is learned is global features.
  • the adjacency matrix is input into the 2-layer graph convolutional network graph learning layer for feature propagation among neighbors, and nonlinear activation is performed on the outside after each layer.
  • the calculation of the adjacency matrix of the historical feature of the transaction behavior can include two parts, the first part is whether there is an edge connection, and if so, it is set to 1; because it is a time series, the second part can be the similarity of each feature sequence. Finally, the weighted sum of the above two parts according to the weight is the similarity between a node and its neighbor nodes.
  • the present invention mainly uses graph-based methods for fraud detection.
  • ⁇ is the loss for a specific prediction task, which measures the error between the true value and the predicted value
  • ⁇ is the regularization term of the graph, which makes the prediction smooth on the graph
  • ⁇ is a hyperparameter to balance the above ratio of the two.
  • the regularization term usually implements the smoothness assumption of the graph signal, that is, similar vertices tend to have similar predictions, preserving the topological relationship of the graph.
  • a widely used regularization term ⁇ is defined as follows, which is a measure weighting based on Euclidean distance, which belongs to the variation measure in the graph signal, and describes the overall smoothness. When g(x i , x j ) is 1 is the Euclidean distance:
  • g(x i , x j ) is the similarity measure between feature vectors of entity pairs, is the degree of vertex i.
  • the regularizer smoothes each pair of entities so that their predictions (after normalization by degrees) are close to each other.
  • the strength of the smoothing is determined by the similarity g(x i , x j ) of the feature vectors. This can be equivalently written in a more compact matrix form:
  • L is the Laplacian matrix of the graph i.e.
  • A is the similarity matrix
  • each element is g(x i , x j ).
  • Graph Convolutional Network is a special graph-based learning method that has developed rapidly in recent years. It incorporates the core idea of graph-based learning, namely advanced convolutional neural networks (CNNs).
  • CNNs advanced convolutional neural networks
  • the core idea of standard CNNs is to use convolutions (such as 3 ⁇ 3 filter matrices) to capture local patterns in the input data (such as oblique lines in images).
  • CNNs the goal of GCN is to capture the local connection patterns on the graph through convolution.
  • KNN K-Nearest Neighbor
  • Sort Sort to get the normalized output of the vertices
  • graph convolution network methods such as LGCL (Learn Graph Convolution Layer): the learnable graph convolution layer automatically selects a fixed number of neighbor nodes for each feature value-based sorting, so as to Transform the graph-structured data into regular one-dimensional mesh data, and then apply standard CNN operations on the one-dimensional mesh data;
  • f represents the filtering operation T of parameterized convolution
  • U is the matrix of characteristic column vectors of L.
  • U T X represents the positive transformation of GFT, and X is projected onto each eigenvector to obtain the Fourier coefficient ⁇ (in the spectral domain); the next step is F ⁇ , this step is scaling eigenvalue scaling, right
  • the elements of the angle matrix F are the eigenvalues of L, and the higher the frequency, the larger the scaling coefficient ⁇ , that is to say, L is a high-pass filter.
  • the above vector obtained by scaling Multiplying a U matrix to the left is an inverse transformation of GFT, which is equivalent to transforming the frequency domain information back to the time domain.
  • F is regarded as the equation of ⁇ , so that the k-order approximation of the Chebyshev polynomial T k (x) can be used to represent F:
  • X is the original vertex feature
  • the dimension is N*C
  • W is the parameter to be learned
  • the dimension is C*F
  • F is the output feature dimension. Then the dimension of the output after a first-order graph convolution is N*F.
  • the prediction module is used to perform full-connection layer processing on historical features of transaction behavior and aggregated features of transaction behaviors, and perform fraud prediction of transaction nodes through binary classification.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Data Mining & Analysis (AREA)
  • Accounting & Taxation (AREA)
  • General Engineering & Computer Science (AREA)
  • Finance (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Computation (AREA)
  • Biophysics (AREA)
  • General Business, Economics & Management (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Strategic Management (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Discrete Mathematics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Technology Law (AREA)
  • Image Analysis (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

Procédé et système de détection de fraude de transaction basés sur un réseau neuronal graphique. Le procédé comprend les étapes suivantes : une étape de prétraitement de données de transaction (S100) consistant : à obtenir des données de transaction, à prétraiter les données de transaction, et à obtenir un ensemble d'échantillons de transaction sous une forme de panneau ; une étape d'extraction de caractéristiques historiques de comportement de transaction (S300) consistant : à réaliser un long traitement de réseau de mémoire à court terme sur l'ensemble d'échantillons de transaction pour obtenir une caractéristique historique de comportement de transaction ; une étape d'extraction de caractéristique d'agrégation de comportement de transaction (S400) consistant : à effectuer un traitement de réseau convolutif graphique sur la caractéristique historique de comportement de transaction pour obtenir une caractéristique d'agrégation de comportement de transaction ; et une étape de prédiction (S500) consistant : à réaliser un traitement de couche entièrement connecté sur la caractéristique historique de comportement de transaction et la caractéristique d'agrégation de comportement de transaction, et à réaliser une prédiction de fraude d'un nœud de transaction au moyen d'une classification binaire. Le procédé surmonte les défauts selon lesquels un procédé de détection de fraude de transaction classique ignore une relation entre des données et un comportement de transaction représente des données de série chronologique, assure l'exhaustivité de la détection de fraude de transaction, et améliore la précision de détection de fraude de transaction.
PCT/CN2020/135271 2020-11-02 2020-12-10 Procédé et système de détection de fraude de transaction basés sur un réseau neuronal graphique WO2022088408A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011203297.3A CN112396160A (zh) 2020-11-02 2020-11-02 基于图神经网络的交易欺诈检测方法及系统
CN202011203297.3 2020-11-02

Publications (1)

Publication Number Publication Date
WO2022088408A1 true WO2022088408A1 (fr) 2022-05-05

Family

ID=74599110

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/135271 WO2022088408A1 (fr) 2020-11-02 2020-12-10 Procédé et système de détection de fraude de transaction basés sur un réseau neuronal graphique

Country Status (2)

Country Link
CN (1) CN112396160A (fr)
WO (1) WO2022088408A1 (fr)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115423542A (zh) * 2022-11-07 2022-12-02 中邮消费金融有限公司 一种老带新活动反欺诈识别方法及系统
CN116032670A (zh) * 2023-03-30 2023-04-28 南京大学 基于自监督深度图学习的以太坊钓鱼欺诈行为检测方法
CN116128130A (zh) * 2023-01-31 2023-05-16 广东电网有限责任公司 一种基于图神经网络的短期风能数据预测方法及装置
CN116629080A (zh) * 2023-07-24 2023-08-22 福建农林大学 钢管混凝土叠合构件撞击位移时程图卷积预测方法
CN117057929A (zh) * 2023-10-11 2023-11-14 中邮消费金融有限公司 异常用户行为检测方法、装置、设备及存储介质
CN117455518A (zh) * 2023-12-25 2024-01-26 连连银通电子支付有限公司 一种欺诈交易检测方法和装置
CN118427757A (zh) * 2024-06-27 2024-08-02 深圳市拜特科技股份有限公司 企业账户的全生命周期监控方法、装置、设备及存储介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11575695B2 (en) * 2021-04-02 2023-02-07 Sift Sciences, Inc. Systems and methods for intelligently constructing a backbone network graph and identifying and mitigating digital threats based thereon in a machine learning task-oriented digital threat mitigation platform
CN113362071A (zh) * 2021-06-21 2021-09-07 浙江工业大学 一种针对以太坊平台的庞氏骗局识别方法及系统
CN113627947A (zh) * 2021-08-10 2021-11-09 同盾科技有限公司 交易行为检测方法、装置、电子设备及存储介质
CN114372803A (zh) * 2021-12-14 2022-04-19 同济大学 一种基于交易图谱的快速反洗钱检测方法
CN114418767A (zh) * 2022-01-25 2022-04-29 支付宝(杭州)信息技术有限公司 一种交易意图识别方法及装置
CN117408806A (zh) * 2022-07-07 2024-01-16 汇丰软件开发(广东)有限公司 一种识别加密货币市场中操纵价格行为的方法
CN115345736B (zh) * 2022-07-14 2023-12-29 上海即科智能技术集团有限公司 一种金融交易异常行为检测方法
CN114972366B (zh) * 2022-07-27 2022-11-18 山东大学 基于图网络的大脑皮层表面全自动分割方法及系统
CN118446122B (zh) * 2024-07-08 2024-09-27 河海大学 一种基于人工神经网络的动区-不动区传输模型参数智能拟合方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160364794A1 (en) * 2015-06-09 2016-12-15 International Business Machines Corporation Scoring transactional fraud using features of transaction payment relationship graphs
CN108960304A (zh) * 2018-06-20 2018-12-07 东华大学 一种网络交易欺诈行为的深度学习检测方法
CN110084603A (zh) * 2018-01-26 2019-08-02 阿里巴巴集团控股有限公司 训练欺诈交易检测模型的方法、检测方法以及对应装置
CN111311416A (zh) * 2020-02-28 2020-06-19 杭州云象网络技术有限公司 一种基于多通道图和图神经网络的区块链洗钱节点检测方法
CN111462088A (zh) * 2020-04-01 2020-07-28 深圳前海微众银行股份有限公司 基于图卷积神经网络的数据处理方法、装置、设备及介质

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109816535A (zh) * 2018-12-13 2019-05-28 中国平安财产保险股份有限公司 欺诈识别方法、装置、计算机设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160364794A1 (en) * 2015-06-09 2016-12-15 International Business Machines Corporation Scoring transactional fraud using features of transaction payment relationship graphs
CN110084603A (zh) * 2018-01-26 2019-08-02 阿里巴巴集团控股有限公司 训练欺诈交易检测模型的方法、检测方法以及对应装置
CN108960304A (zh) * 2018-06-20 2018-12-07 东华大学 一种网络交易欺诈行为的深度学习检测方法
CN111311416A (zh) * 2020-02-28 2020-06-19 杭州云象网络技术有限公司 一种基于多通道图和图神经网络的区块链洗钱节点检测方法
CN111462088A (zh) * 2020-04-01 2020-07-28 深圳前海微众银行股份有限公司 基于图卷积神经网络的数据处理方法、装置、设备及介质

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115423542A (zh) * 2022-11-07 2022-12-02 中邮消费金融有限公司 一种老带新活动反欺诈识别方法及系统
CN116128130A (zh) * 2023-01-31 2023-05-16 广东电网有限责任公司 一种基于图神经网络的短期风能数据预测方法及装置
CN116128130B (zh) * 2023-01-31 2023-10-24 广东电网有限责任公司 一种基于图神经网络的短期风能数据预测方法及装置
CN116032670A (zh) * 2023-03-30 2023-04-28 南京大学 基于自监督深度图学习的以太坊钓鱼欺诈行为检测方法
CN116629080A (zh) * 2023-07-24 2023-08-22 福建农林大学 钢管混凝土叠合构件撞击位移时程图卷积预测方法
CN116629080B (zh) * 2023-07-24 2023-09-26 福建农林大学 钢管混凝土叠合构件撞击位移时程图卷积预测方法
CN117057929A (zh) * 2023-10-11 2023-11-14 中邮消费金融有限公司 异常用户行为检测方法、装置、设备及存储介质
CN117057929B (zh) * 2023-10-11 2024-01-26 中邮消费金融有限公司 异常用户行为检测方法、装置、设备及存储介质
CN117455518A (zh) * 2023-12-25 2024-01-26 连连银通电子支付有限公司 一种欺诈交易检测方法和装置
CN117455518B (zh) * 2023-12-25 2024-04-19 连连银通电子支付有限公司 一种欺诈交易检测方法和装置
CN118427757A (zh) * 2024-06-27 2024-08-02 深圳市拜特科技股份有限公司 企业账户的全生命周期监控方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN112396160A (zh) 2021-02-23

Similar Documents

Publication Publication Date Title
WO2022088408A1 (fr) Procédé et système de détection de fraude de transaction basés sur un réseau neuronal graphique
Zhang et al. A graph-cnn for 3d point cloud classification
CN112633426B (zh) 处理数据类别不均衡的方法、装置、电子设备及存储介质
Jiang et al. Convolution neural network model with improved pooling strategy and feature selection for weld defect recognition
CN111047078B (zh) 交通特征预测方法、系统及存储介质
Yang et al. Multi-scale bidirectional fcn for object skeleton extraction
US20230134508A1 (en) Electronic device and method with machine learning training
CN116681497A (zh) 基于图神经网络的资金风险识别方法、计算机装置及计算机可读存储介质
WO2023217127A1 (fr) Procédé de détermination de causalité et dispositif associé
Anirudh et al. Influential sample selection: A graph signal processing approach
CN116662817A (zh) 物联网设备的资产识别方法及系统
CN114154557A (zh) 癌症组织分类方法、装置、电子设备及存储介质
CN110096979A (zh) 模型的构建方法、人群密度估计方法、装置、设备和介质
CN117971354B (zh) 基于端到端学习的异构加速方法、装置、设备及存储介质
Chen et al. Efficient kernel fuzzy clustering via random Fourier superpixel and graph prior for color image segmentation
ElShawi et al. csmartml: A meta learning-based framework for automated selection and hyperparameter tuning for clustering
CN116452333A (zh) 异常交易检测模型的构建方法、异常交易检测方法及装置
Lu et al. Feature pyramid-based graph convolutional neural network for graph classification
CN114648560A (zh) 分布式图像配准方法、系统、介质、计算机设备及终端
Wan et al. Modeling noisy annotations for point-wise supervision
CN114254738A (zh) 双层演化的动态图卷积神经网络模型构建方法及应用
Saranya et al. FBCNN-TSA: An optimal deep learning model for banana ripening stages classification
Bode et al. Bounded: Neural boundary and edge detection in 3d point clouds via local neighborhood statistics
CN117056970A (zh) 基于图神经网络的隐私特征保护方法和系统
CN116432053A (zh) 基于模态交互深层超图神经网络的多模态数据表示方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20959567

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 111023)

122 Ep: pct application non-entry in european phase

Ref document number: 20959567

Country of ref document: EP

Kind code of ref document: A1