Feature extraction techniques

1 . A method, comprising:

generating, by a server system from a plurality of electronic transactions, a bi-partite transaction network graph that includes a plurality of nodes and edges, wherein the plurality of nodes correspond to both user accounts and electronic transactions, and wherein labels for one or more of the plurality of nodes specify that one or more user accounts and electronic transactions are anomalous;

capturing, by the server system, a plurality of snapshots of the network graph, wherein the plurality of snapshots include nodes and edges existing at a plurality of different time intervals;

generating, by the server system for nodes included in respective snapshots of the plurality of snapshots, a plurality of different types of features, wherein generating the plurality of different types of features includes generating a neighbor convolution feature for a given node in a given snapshot by:

compressing a plurality of node behavior features for one or more neighbor nodes of the given node, wherein the one or more neighbor nodes are one hop away from the given node within the given snapshot of the network graph; and

training, by the server system using the plurality of different types of features, a machine learning model, wherein the trained machine learning model is usable to predict whether one or more unlabeled nodes in the network graph are anomalous.

2 . The method of claim 1 , further comprising:

determining, by the server system using the trained machine learning model, labels for one or more unlabeled nodes in the network graph, wherein the determining includes inputting features for the one or more unlabeled nodes into the trained machine learning model; and

performing, by the server system based on the determined labels, one or more preventative actions for entities corresponding to one or more nodes based on the determined labels for the one or more unlabeled nodes indicating anomalous behavior for entities corresponding to the unlabeled one or more nodes.

3 . The method of claim 1 , wherein the compressing includes:

generating an adjacency matrix that indicates, for different pairs of a first set of nodes that are a single hop away from the given node, whether the different pairs of nodes of the first set of nodes are connected to one another in the network graph via one or more edges, wherein values stored in the adjacency matrix indicate weights of edges between respective pairs of nodes in the first set of nodes; and

generating an identity matrix that indicates whether nodes in the network graph include one or more loop edges connected to themselves.

4 . The method of claim 3 , further comprising:

performing, by the server system, the compressing for a second set of nodes that are at least two hops away from the given node of the network graph.

5 . The method of claim 3 , wherein the compressing further includes:

generating a feature matrix that includes node behavior features for nodes in the first set of nodes;

squaring the adjacency matrix;

adding a result of the squaring to the identity matrix;

multiplying a result of the adding with the feature matrix; and

performing independent component analysis on a result of the multiplying.

6 . The method of claim 1 , wherein generating the plurality of different types of features includes generating one or more community diffusion features by:

identifying, in a given snapshot of the network graph, whether nodes included in the given snapshot have anomalous labels;

determining, using one or more distance procedures, distances between unlabeled nodes of the given snapshot and the one or more nodes identified to have anomalous labels; and

determining a connectivity density for the unlabeled nodes, wherein determining the connectivity density for a given unlabeled node includes identifying a number of nodes connected to the given unlabeled node with anomalous labels.

7 . The method of claim 1 , wherein generating the plurality of different types of features includes generating a plurality of node behavior features, including determining one or more types of the following types of node behavior features: degree-related features, flow-related features, duration-related features, and interval-related features.

8 . The method of claim 7 , wherein the degree-related features, the flow-related features, the duration-related features, and the interval-related features include the following: in-degree, out-degree, total degree, inflow, outflow, change of balance, input electronic communication duration, output transaction duration, input transaction interval, output transaction interval, and total transaction interval.

9 . A non-transitory computer-readable medium having instructions stored thereon that are executable by a server system to perform operations comprising:

generating, from a plurality of electronic transactions, a bi-partite transaction network graph that includes a plurality of nodes and edges, wherein the plurality of nodes correspond to both user accounts and electronic transactions, and wherein labels for one or more of the plurality of nodes specify that one or more user accounts and electronic transactions are anomalous;

capturing a plurality of snapshots of the bi-partite transaction network graph, wherein the plurality of snapshots include nodes and edges existing at a plurality of different time intervals;

generating, for nodes included in respective snapshots of the plurality of snapshots, a plurality of different types of features, wherein generating the plurality of different types of features includes generating a neighbor convolution feature for a given node in a given snapshot by:

compressing a plurality of node behavior features for one or more neighbor nodes to the given node, wherein the one or more neighbor nodes are one hop away from the given node within the given snapshot of the bi-partite transaction network graph; and

training, using the plurality of different types of features, a machine learning model, wherein the trained machine learning model is usable to predict whether one or more unlabeled nodes in the bi-partite transaction network graph are anomalous.

10 . The non-transitory computer-readable medium of claim 9 , wherein the compressing includes:

generating an adjacency matrix that indicates, for different pairs of a first set of nodes that are a single hop away from a center node of the bi-partite transaction network graph, whether the different pairs of nodes of the first set of nodes are connected to one another in the bi-partite transaction network graph via one or more edges, wherein values stored in the adjacency matrix indicate weights of edges between respective pairs of nodes in the first set of nodes.

11 . The non-transitory computer-readable medium of claim 9 , wherein generating the plurality of different types of features includes generating one or more community diffusion features by:

identifying, in a given snapshot of the bi-partite transaction network graph, whether nodes included in the given snapshot have anomalous labels;

determining, using one or more distance procedures, distances between unlabeled nodes of the given snapshot and the one or more nodes identified to have anomalous labels; and

determining a connectivity density for the unlabeled nodes, wherein determining the connectivity density for a given unlabeled node includes identifying a number of nodes connected to the given unlabeled node with anomalous labels.

12 . The non-transitory computer-readable medium of claim 10 , wherein the compressing further includes:

generating an identity matrix that indicates whether nodes in the bi-partite transaction network graph include one or more loop edges connected to themselves;

generating a feature matrix that includes node behavior features for nodes in the first set of nodes;

combining the adjacency matrix, the identity matrix, and the feature matrix; and

performing independent component analysis on the combination.

13 . The non-transitory computer-readable medium of claim 9 , wherein generating the plurality of different types of features includes generating one or more node behavior features, including one or more types of the following types of node behavior features: in-degree, out-degree, inflow, outflow, change of balance, input electronic communication duration, output electronic communication duration, input electronic communication interval, and output electronic communication interval.

14 . The non-transitory computer-readable medium of claim 9 , wherein the plurality of snapshots are generated for the bi-partite transaction network graph at different twenty-four-hour time intervals.

15 . The non-transitory computer-readable medium of claim 14 , wherein a given node is included in two or more of the plurality of snapshots of the bi-partite transaction network graph.

16 . A system, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that are executable by the processor to cause the system to perform operations comprising:

generating, from a plurality of electronic transactions, a bi-partite transaction network graph that includes a plurality of nodes and edges, wherein the plurality of nodes correspond to both user accounts and electronic transactions, and wherein labels for one or more of the plurality of nodes specify that one or more user accounts and electronic transactions are anomalous;

capturing, a plurality of snapshots of the network graph, wherein the plurality of snapshots include nodes and edges existing at a plurality of different time intervals;

generating, for nodes included in respective snapshots of the plurality of snapshots, a plurality of different types of features, wherein generating the plurality of different types of features includes generating community diffusion features for a plurality of nodes in a given snapshot by:

determining, using one or more distance procedures, a distance between unlabeled nodes included in a given snapshot and one or more labeled nodes located near the center of the given snapshot; and

determining a connectivity density for the unlabeled nodes, including determining a number of nodes that the unlabeled nodes are connected to that are known to be anomalous; and

training, using the plurality of different types of features, a machine learning model, wherein the trained machine learning model is usable to predict whether one or more unlabeled nodes in the network graph are anomalous.

17 . The system of claim 16 , wherein the instructions are further executable by the processor to cause the system to:

determine, using the trained machine learning model, labels for one or more unlabeled nodes in the network graph, wherein the determining includes inputting features for the one or more unlabeled nodes into the trained machine learning model; and

perform, based on the determined labels, one or more preventative actions for entities corresponding to one or more nodes based on the determined labels for the one or more unlabeled nodes indicating anomalous behavior for entities corresponding to the unlabeled one or more nodes.

18 . The system of claim 16 , wherein generating the plurality of different types of features includes generating a neighbor convolution feature for a given node in a given snapshot by:

compressing a plurality of node behavior features for one or more neighbor nodes to the given node, wherein the one or more neighbor nodes are one hop away from the given node within the given snapshot of the network graph.

19 . The system of claim 16 , wherein generating the plurality of different types of features includes generating one or more community diffusion features by:

identifying, in a given snapshot of the network graph, whether nodes included in the given snapshot have anomalous labels;

determining, using one or more distance procedures, distances between unlabeled nodes of the given snapshot and the one or more nodes identified to have anomalous labels; and

determining a connectivity density for the unlabeled nodes, wherein determining the connectivity density for a given unlabeled node includes identifying a number of nodes connected to the given unlabeled node with anomalous labels.

20 . The system of claim 18 , wherein the compressing includes:

generating an adjacency matrix that indicates, for different pairs of a first set of nodes that are a single hop away from a center node of the bi-partite transaction network graph, whether the different pairs of nodes of the first set of nodes are connected to one another in the bi-partite transaction network graph via one or more edges, wherein values stored in the adjacency matrix indicate weights of edges between respective pairs of nodes in the first set of nodes;

generating an identity matrix that indicates whether nodes in the bi-partite transaction network graph include one or more loop edges connected to themselves;

generating a feature matrix that includes node behavior features for nodes in the first set of nodes;

combining the adjacency matrix, the identity matrix, and the feature matrix; and

performing independent component analysis on the combination.