当前位置:网站首页>Open source | hmgnn: heterogeneous small graph neural network and its application in laxin fission risk control scenario

Open source | hmgnn: heterogeneous small graph neural network and its application in laxin fission risk control scenario

2020-11-09 10:50:05 InfoQ

{"type":"doc","content":[{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Iqiyi risk control team is responsible for risk prevention and control of the whole business of the company , Business oriented to provide a combination of general and customized one-stop solution , Empowering business , Strengthen the core competitiveness of the business . Risk control center provides cover account security 、 Member safety 、 Content ecological protection 、 New fission anti cheating 、 Marketing activities 、 Exclusive solutions for various Internet risk scenarios such as financial payment , Connected to 30+ Line of business ,300+ Business risk points . This paper is written by iqiyi and Nanjing University , It is part of the cooperation between the two sides , The purpose of this paper is to explore the application of graph neural network in anti cheating scenario of pulling new fission ."}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":" background "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" In the age of flow as king , Pulling new fission is an important means for major Internet companies to compete for new users . Significant user rewards ( cash 、 Membership cards, etc ), It also makes it one of the key targets of black ash production . In order to ensure the activity effect and user quality , The risk control of gaozhungzhao is becoming more and more important ."}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Black ash production usually uses simulators 、 Split up 、 Change the engine 、 Equipment farm 、 agent IP、 Docking station 、 Tools such as crowdsourcing platform forge new users to participate in activities in batch , Take the award as your own . Cause loss of company funds 、 Business key indicators are down 、 The normal user experience is damaged and so on . Against such attacks , There are some mature defense models in the industry :"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Frequent set detection (FP-Growth): Batch attacks tend to occur on devices 、 The Internet 、 Time 、 A large number of clusters appear on the dimensions of location or combination of dimensions , At this time, frequent set detection is a simple and effective detection and early warning algorithm ."}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" clustering \/ Unsupervised :K-means、iForest etc. , Generally, after extracting behavior features, clustering or outlier detection is carried out , To find users with similar abnormal aggregation behavior or different from normal behavior . It has high robustness , But accuracy is not easy to control ."}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" There's a surveillance model :LR、XGBoost etc. , Extracting manual features , According to the known positive and negative samples, the model is trained . The accuracy is generally high , But the generalization ability is very poor ."}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Community testing :Louvain、Fraudar、 High density subgraphs, etc , The introduction of relational information , It can improve the ability to identify frequent material change attacks , It can be understood as an upgraded version of frequent set detection , It can also be used for tag propagation , Promote recall ."}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Figure neural network :GCN,GraphSage etc. , It can make feature information spread among nodes , And give play to the neural network for the abstract ability of features , It also supports semi supervised learning with only partial tags ."}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" This paper is based on the correlation data which is common in the fission scenario ( Invite to associate 、 Device Association 、 Network connection, etc ) And the characteristics of business scenarios , A novel heterogeneous small graph neural network model is proposed (HMGNN), Further improve the ability to identify attacks ."}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":" brief introduction "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":" Business scenario "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Users participate in pull out activities , Integral can be obtained if the following conditions are met 、 Prizes or cash :"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Old users invite new users to a certain number "}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Users participate in various incentive activities ( Sign in 、 download 、 Answer questions, etc )"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Some typical attacks include :"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Fake new equipment : Activities need to be carried out through equipment id To judge new users , Through the simulator 、 Split up 、 Change the engine 、 Equipment farm, etc , Can be disguised as a new device , So as to bypass some simple equipment judgment rules ."}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" Fake new users : The activity needs to verify new users by mobile phone number , Through the virtual trumpet 、 Overseas black card 、 Private domain black card and other materials , Auxiliary cat pool 、 Code platform and other tools , The attacker can complete the verification of mobile phone number automatically ."}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"IP:IP It's a classic dimension of underworld production and risk control , Through agency IP、 Second dial IP etc. , You can bypass some simple IP Strategy ."}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":" Modeling and challenges "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}}]}

版权声明
本文为[InfoQ]所创,转载请带上原文链接,感谢