Dynamic prototype learning framework for non-homophilous graphs
Methods and systems are presented for providing a framework for analyzing graphs that exhibit non-homophilous behavior. Under the framework, a structural analysis and a feature-based analysis will be performed on a sequence of graphs. When performing the feature-based analysis, various features are extracted from each node in the sequence of graphs, and clusters of nodes are identified from each graph based on the features. A set of evolving prototypes is generated to represent evolving characteristics of the clusters of nodes, and a set of persistent prototypes is generated to represent persistent characteristics of the clusters of nodes. Information derived from the structural analysis of the graphs, the set of evolving prototypes, and the set of persistent prototypes are embedded within the nodes of the graphs. The embedded information is then used to classify the nodes.
1 . A system, comprising:
a non-transitory memory; and
one or more hardware processors coupled with the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
receiving a sequence of graphs corresponding to a plurality of time periods, wherein each graph in the sequence of graphs represents transactions conducted in a corresponding time period of the plurality of time periods, wherein each graph in the sequence of graphs comprises nodes and edges, and wherein each edge that connects two nodes in a graph of the sequence of graphs represents a transaction conducted by two accounts represented by the two nodes during the corresponding time period;
determining, for the nodes, positions within a node feature space based on node features associated with corresponding accounts represented by the nodes, wherein the node features are determined independent from topological structures of the sequence of graphs;
clustering the nodes in each of the sequence of graphs into a plurality of clusters based on the positions of the nodes within the node feature space;
deriving, based on the plurality of clusters, one or more prototypes that represent patterns associated with the positions of the nodes within the node feature space;
modifying the sequence of graphs, wherein the modifying the sequence of graphs comprises embedding the one or more prototypes into the nodes of the sequence of graphs;
classifying the nodes using a machine learning model system and based on the modified sequence of graphs; and
modifying an access level associated with an account represented by one of the nodes from the sequence of graphs based on the classifying.
2 . The system of claim 1 , wherein the operations further comprise:
providing the sequence of graphs to a first model in the machine learning model system; and
obtaining a set of intermediate outputs from the first model, wherein the modifying the sequence of graphs further comprises embedding the set of intermediate outputs into the nodes of the sequence of graphs.
3 . The system of claim 1 , wherein the one or more prototypes comprise a first set of prototypes representing evolving patterns associated with the nodes across the plurality of time periods.
4 . The system of claim 3 , wherein the one or more prototypes further comprise a second set of prototypes representing persistent patterns associated with the nodes over the plurality of time periods.
5 . The system of claim 1 , wherein the operations further comprise:
sequentially analyzing clusters, from the plurality of clusters, corresponding to each graph in the sequence of graphs, wherein the one or more prototypes are derived based on the sequentially analyzing the clusters.
6 . The system of claim 1 , wherein the node feature space comprises a plurality of feature dimensions.
7 . The system of claim 1 , wherein the operations further comprise:
collectively analyzing the plurality of clusters corresponding to the sequence of graphs, wherein the one or more prototypes are derived based on the collectively analyzing the plurality of clusters.
8 . The system of claim 1 , wherein the machine learning model system is configured to classify the nodes based on the topological structures of the sequence of graphs and the one or more prototypes embedded within the nodes of the sequence of graphs.
9 . A method, comprising:
receiving one or more graphs representing transactions conducted in one or more time periods, wherein the one or more graphs comprise nodes and edges, and wherein each edge that connects two nodes in the one or more graphs represents a transaction conducted by two accounts represented by the two nodes during a corresponding time period;
determining, by a computer system and for the nodes, positions within a node feature space based on node features associated with corresponding accounts represented by the nodes, wherein the node features are determined independent from a topological structure of the one or more graphs;
clustering, by the computer system, the nodes in the one or more graphs into a plurality of clusters based on the positions of the nodes within the node feature space;
deriving, by the computer system and based on the plurality of clusters, a set of prototypes representing patterns associated with the nodes within the node feature space;
modifying, by the computer system, the one or more graphs, wherein the modifying the one or more graphs comprises embedding the set of prototypes into the nodes of the one or more graphs;
classifying, by the computer system, the nodes using a machine learning model system and based on the one or more modified graphs; and
causing, by the computer system, an access level associated with an account corresponding to one of the nodes to be modified based on the classifying.
10 . The method of claim 9 , wherein each node in the one or more graphs represents a cryptocurrency wallet, and wherein the transaction is a cryptocurrency transaction conducted between two cryptocurrency wallets represented by the two nodes.
11 . The method of claim 10 , wherein the classifying comprises determining that the one of the nodes represents a particular cryptocurrency wallet that has been used to conduct malicious activities.
12 . The method of claim 9 , wherein the node features comprise at least one of a number of outgoing transactions conducted through a cryptocurrency wallet represented by a node of the one or more graphs, a number of incoming transactions conducted through the cryptocurrency wallet represented by the node, an average amount associated with transactions conducted through the cryptocurrency wallet represented by the node, an average time between transactions conducted through the cryptocurrency wallet represented by the node, or statistical data associated with neighboring nodes of the node.
13 . The method of claim 9 , wherein the set of prototypes represents evolving characteristics of the plurality of clusters over the one or more time periods.
14 . The method of claim 9 , wherein the set of prototypes represents persistent characteristics of the plurality of clusters across the one or more time periods.
15 . The method of claim 9 , wherein each prototype in the set of prototypes represents attributes associated with a corresponding cluster from the plurality of clusters.
16 . A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
accessing a sequence of graphs representing transactions conducted in a plurality of corresponding time periods, wherein each graph in the sequence of graphs comprises nodes and edges, and wherein each edge that connects two nodes in a graph of the sequence of graphs represents a transaction conducted by two accounts represented by the two nodes during a corresponding time period from the plurality of corresponding time periods;
determining, for the nodes, positions within a node feature space based on node features associated with corresponding accounts represented by the nodes, wherein the node features are determined independent from topological structures of the sequence of graphs;
clustering the nodes of each graph in the sequence of graphs into a plurality of clusters based on the positions of the nodes within the node feature space;
deriving, based on the plurality of clusters, a first set of prototypes representing patterns associated with the nodes within the node feature space;
modifying the sequence of graphs, wherein the modifying the sequence of graphs comprises embedding the first set of prototypes into the nodes of the sequence of graphs; and
classifying the nodes using a machine learning model system and based on the modified sequence of graphs.
17 . The non-transitory machine-readable medium of claim 16 , wherein the operations further comprise:
sequentially analyzing clusters, from the plurality of clusters, corresponding to each graph in the sequence of graphs; and
deriving the first set of prototypes based on the sequentially analyzing the clusters.
18 . The non-transitory machine-readable medium of claim 16 , wherein the first set of prototypes represents evolving characteristics of the plurality of clusters over the plurality of corresponding time periods.
19 . The non-transitory machine-readable medium of claim 16 , wherein the operations further comprise:
collectively analyzing the plurality of clusters corresponding to the sequence of graphs; and
deriving a second set of prototypes based on the collectively analyzing the plurality of clusters, wherein the modifying the sequence of graphs further comprises embedding the second set of prototypes into the nodes.
20 . The non-transitory machine-readable medium of claim 19 , wherein the second set of prototypes represents persistent characteristics of the plurality of clusters across the plurality of corresponding time periods.