開源 | HMGNN：異構小圖神經網絡及其在拉新裂變風控場景的應用

{"type":"doc","content":[{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"愛奇藝風控團隊負責公司全業務風險防控，面向業務提供通用與定製相結合的一站式解決方案，爲業務賦能，加強業務核心競爭力。風控中臺提供涵蓋賬戶安全、會員安全、內容生態保護、拉新裂變反作弊、營銷活動、金融支付等各個互聯網風險場景的專屬解決方案，已接入30+業務線，300+業務風險點。本論文由愛奇藝與南京大學共同完成，是雙方產學研合作的一部分，旨在探索圖神經網絡在拉新裂變反作弊場景的應用。"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"背景"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在流量爲王的時代，拉新裂變是各大互聯網公司爭奪新用戶的重要手段。活動可觀的用戶獎勵（現金、會員卡等），也使其成爲黑灰產的重點攻擊目標之一。爲了保障活動效果及用戶質量，高準召的風控也顯得日益重要。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"黑灰產通常採用模擬器、多開分身、改機、設備農場、代理IP、接碼平臺、衆包平臺等工具批量僞造新用戶參與活動，將活動獎勵據爲己有。造成公司資金損失、業務關鍵指標下降、正常用戶體驗受損等多方面影響。針對此類攻擊，業界已有一些較爲成熟的防禦模型："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"頻繁集檢測（FP-Growth）：批量攻擊往往會在設備、網絡、時間、地點等維度或維度組合上出現大量聚集，此時頻繁集檢測是簡單有效的檢測與預警算法。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"聚類\/無監督：K-means、iForest等，一般提取行爲特徵後進行聚類或異常點檢測，以找到行爲相似異常聚集或異於正常行爲的用戶。具有較高的魯棒性，但是準確率不易掌控。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"有監督模型：LR、XGBoost等，提取手工特徵，根據已知正負樣本訓練模型。準確率一般較高，但是泛化能力很差。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"社區檢測：Louvain、Fraudar、高密子圖等，引入了關係信息，可提升對頻繁換物料的攻擊的識別能力，可以理解爲頻繁集檢測的升級版，同時可以用於標籤傳播，提升召回。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖神經網絡：GCN，GraphSage等，能夠使特徵信息在節點間傳播，併發揮出神經網絡對於特徵的抽象能力，同時也支持只有部分標籤進行半監督學習。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"本文基於拉新裂變場景中普遍存在的關聯數據（邀請關聯、設備關聯、網絡關聯等）以及業務場景特點，創新地提出了異構小圖神經網絡模型（HMGNN），進一步提升了對攻擊的識別能力。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"簡介"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"業務場景"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"用戶參加拉新活動，符合以下條件均可獲得積分、獎品或現金："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"老用戶邀請新用戶達到一定數量"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"用戶參加各種激勵活動（簽到、下載、答題等）"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"一些典型的攻擊方式包括："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"僞造新設備：活動需通過設備id來判斷新用戶，通過模擬器、多開分身、改機、設備農場等，都可以僞裝成新的設備，從而繞過一些簡單的設備判新規則。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"僞造新用戶：活動需要通過手機號來驗證新用戶，通過虛擬小號、海外黑卡、私域黑卡等物料，輔助貓池、接碼平臺等工具，攻擊者可以全自動化完成的手機號驗證。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"IP：IP是經典的黑產與風控攻防維度，通過代理IP、秒撥IP等，可以繞過一些簡單的IP策略。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"建模與挑戰"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}}]}