刘枭 王晓国

摘 要：目前银行对电信诈骗的标记数据积累少，人工标记数据的代价大，导致电信诈骗检测的有监督学习方法可使用的标记数据不足。针对这个问题，提出一种基于密集子图的无监督学习方法用于电信诈骗的检测。首先，通过在账户资源（IP地址和MAC地址统称为资源）网络搜索可疑度较高的子图来识别欺诈账户;然后，设计了一种符合电信诈骗特性的子图可疑度量;最后，提出一种磁盘驻留、线性内存消耗且有理论保障的可疑子图搜索算法。在两组模拟数据集上，所提方法的F1-score分别达到0.921和0.861，高于CrossSpot、fBox和EvilCohort算法，与M-Zoom算法的0.899和0.898相近，但是所提方法的平均运行时间和内存消耗峰值均小于M-Zoom算法;在真实数据集上，所提方法的F1-score达到0.550，高于fBox和EvilCohort算法，与M-Zoom算法的0.529相近。实验结果表明，所提方法能较好地应用于现阶段的银行反电信诈骗业务，且非常适合于实际应用中的大规模数据集。

关键词： 电信诈骗;无监督学习;欺诈检测;密集子图;贪心算法

中图分类号：TP391.4

文献标志码：A

文章编号：1001-9081（2019）04-1214-06

Abstract： Lack of labeled data accumulated for telecommunication fraud in the bank and high cost of manually labeling cause the insufficiency of labeled data that can be used in supervised learning methods for telecommunication fraud detection. To solve this problem， an unsupervised learning method based on dense subgraph was proposed to detect telecommunication fraud. Firstly， subgraphs with high anomaly degree in the network of accounts and resources （IP addresses and MAC addresses） were searched to identify fraud accounts. Then， a subgraph anomaly degree metric satisfying the features of telecommunication fraud was designed. Finally， a suspicious subgraph searching algorithm with resident disk， efficient memory and theory guarantee was proposed. On two synthetic datasets， the F1-scores of the proposed method are 0.921 and 0.861， which are higher than those of CrossSpot， fBox and EvilCohort algorithms while very close to those of M-Zoom algorithm （0.899 and 0.898）， but the average running time and memory consumption peak of the proposed method are less than those of M-Zoom algorithm. On real-world dataset， F1-score of the proposed method is 0.550， which is higher than that of fBox and EvilCohort while very close to that of M-Zoom algorithm （0.529）. Theoretical analysis and simulation results show that the proposed method can be applied to telecommunication fraud detection in the bank effectively， and is suitable for big datasets in practice.

Key words： telecommunication fraud; unsupervised learning; fraud detection; dense subgraph; greedy algorithm

0 引言

隨着互联网技术的发展， 人们越来越多地使用电子银行进行资金操作，据《2016中国电子银行调查报告》显示，全国个人网银用户和个人手机银行用户比例分别达到46%和42%。 据《腾讯2017年第三季度反电信网络诈骗大数据报告》，显示网络诈骗、电话欺诈和短信诈骗合计造成资金损失44.1亿，并且已经形成了完整的黑色产业链。本文根据合作银行的需求，对电信诈骗的检测方法展开研究。……