Method, device and electronic device for identifying risks

Abstract

The present disclosure provides a method, device and electronic device for identifying risks, which are applied to artificial intelligence or financial fields, etc. The method includes: obtaining at least one resource transfer data, the at least one resource transfer data is data between a determined risk medium and an associated medium for the risk medium; constructing a knowledge graph, the risk medium and the associated medium are nodes of the knowledge graph, and the resource transfer data are edges of the knowledge graph; obtaining resource transfer features based on the knowledge graph, the resource transfer features include resource transfer associated data for the risk medium and / or for the associated medium; clustering the resource transfer features to obtain a first risk class, the first proportion of the risk medium in the first risk class in the media included in the first risk class is greater than the second proportion of the risk medium in the second risk class in the media included in the second risk class; and obtaining suspicious risk media from the media other than the risk medium in the first risk class.

Description

Technical Field

[0001] The present disclosure relates to the fields of artificial intelligence and financial technology, and more specifically, to a method, device and electronic device for identifying risks. Background Art

[0002] Telecom network fraud is becoming increasingly serious, with fraud showing an industrialized, professional, and cross-platform trend. Machine learning and knowledge graphs have been used to discover certain potential risk relationships and make relevant warnings.

[0003] In the process of implementing the concept of the present disclosure, the applicant found that there are at least the following problems in the related technology. The information in the knowledge graph is often redundant, and a large number of customers unrelated to fraud will be mined, resulting in low accuracy. In addition, there is less data on fraudster labels, and it is difficult to improve the accuracy of machine learning output results through a large amount of training data. Summary of the invention

[0004] In view of this, the present disclosure provides a method, apparatus, and electronic device for identifying risks that reduce the difficulty of continuously maintaining assets of a business architecture.

[0005] One aspect of the present disclosure provides a method for identifying risks performed by a server, including: obtaining at least one resource transfer data, the at least one resource transfer data being data between a determined risk medium and an associated medium for the risk medium; constructing a knowledge graph, with the risk medium and the associated medium as nodes of the knowledge graph, and the resource transfer data as edges of the knowledge graph; obtaining resource transfer features based on the knowledge graph, the resource transfer features including resource transfer associated data for the risk medium and / or for the associated medium; clustering the resource transfer features to obtain a first risk class, a first proportion of the risk medium in the first risk class among the media included in the first risk class being greater than a second proportion of the risk medium in the second risk class among the media included in the second risk class; and obtaining suspicious risk media from the media other than the risk media in the first risk class.

[0006] According to an embodiment of the present disclosure, obtaining resource transfer characteristics based on a knowledge graph includes: obtaining first resource transfer data for a risk medium and second resource transfer data for a directly associated medium of the risk medium from the knowledge graph; and obtaining resource transfer characteristics based on the first resource transfer data and the second resource transfer data.

[0007] According to an embodiment of the present disclosure, the account number of the risky medium and the account number of the medium directly associated with the risky medium are allocated by the server.

[0008] According to an embodiment of the present disclosure, obtaining suspicious risk media from media other than risk media in the first risk class includes: obtaining suspicious risk media from associated media of the risk media in the first risk class based on a preset rule.

[0009] According to an embodiment of the present disclosure, obtaining suspicious risk media from associated media of risk media in the first risk class based on preset rules includes: obtaining suspicious risk media from indirectly associated media of risk media in the first risk class based on preset rules.

[0010] According to an embodiment of the present disclosure, the preset rules include at least one of the following: if the risk medium and the indirectly associated medium have resource transfer-out data for the same directly associated medium of the risk medium within a preset time interval, the indirectly associated medium is regarded as a suspicious risk medium; if the same directly associated medium of the risk medium has resource transfer-in data for the risk medium and the indirectly associated medium within a preset time interval, the indirectly associated medium is regarded as a suspicious risk medium.

[0011] According to an embodiment of the present disclosure, clustering resource transfer features includes: normalizing the resource transfer features to obtain a resource transfer feature vector; and clustering the resource transfer feature vector to obtain at least two risk classes.

[0012] According to an embodiment of the present disclosure, the resource transfer feature includes an amount feature; normalizing the resource transfer feature to obtain a resource transfer feature vector includes: smoothing the resource transfer feature through a logarithmic function to obtain a resource transfer smooth feature; and normalizing the resource transfer smooth feature to map the resource transfer smooth feature to a specified space.

[0013] According to an embodiment of the present disclosure, the above method further includes: storing the suspicious risk medium; and / or sending the suspicious risk medium to the client.

[0014] One aspect of the present disclosure provides a device for identifying risks, including: a resource transfer data acquisition module, a knowledge graph construction module, a resource transfer feature acquisition module, a feature clustering module, and a suspicious risk medium acquisition module. Among them, the resource transfer data acquisition module is used to acquire at least one resource transfer data, and the resource transfer data is data between the determined risk medium and the associated medium; the knowledge graph construction module is used to construct a knowledge graph, with the risk medium and the associated medium as nodes of the knowledge graph, and the resource transfer data as edges of the knowledge graph; the resource transfer feature acquisition module is used to acquire resource transfer features based on the knowledge graph, and the resource transfer features include resource transfer associated data for the risk medium and / or for the associated medium; the feature clustering module is used to cluster the resource transfer features to obtain a first risk class, and the first proportion of the risk medium in the first risk class in the media included in the first risk class is greater than the second proportion of the risk medium in the second risk class in the media included in the second risk class; and the suspicious risk medium acquisition module is used to acquire suspicious risk media from the media other than the risk media in the first risk class.

[0015] Another aspect of the present disclosure provides an electronic device, including one or more processors and a storage device, wherein the storage device is used to store executable instructions, and when the executable instructions are executed by the processor, the above method is implemented.

[0016] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0017] Another aspect of the present disclosure provides a computer program, which includes computer executable instructions, and the instructions are used to implement the above method when executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1 Schematically illustrates an exemplary system architecture to which the method, apparatus, and electronic device for identifying risks according to an embodiment of the present disclosure can be applied;

[0020] Figure 2 A flowchart schematically shows a method for identifying risks according to an embodiment of the present disclosure;

[0021] Figure 3 A schematic diagram of a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 4 A flowchart of obtaining resource transfer features based on a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 5 A schematic diagram of a medium according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 6 A schematic diagram schematically shows a personal risk transfer relationship map provided according to an embodiment of the present disclosure;

[0025] Figure 7 A schematic diagram schematically shows a preset rule according to an embodiment of the present disclosure;

[0026] Figure 8 A block diagram schematically shows a device for identifying risks according to an embodiment of the present disclosure;

[0027] Fig. 9 A schematic diagram schematically illustrates a logic diagram of identifying risks according to an embodiment of the present disclosure; and

[0028] Fig.10 A block diagram of an electronic device according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0029] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0030] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0031] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0032] When using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more features.

[0033] In recent years, the situation of telecommunications and Internet fraud has become increasingly severe, and fraud has shown a trend of industrialization, specialization, and cross-platform. Fraudsters often use social engineering methods such as deception and threats to control account holders and induce them to make payments or transfers. Telecommunications and Internet fraud has seriously undermined the country's good financial and social order, endangered the healthy development of economic construction, and affected users' sense of security and happiness.

[0034] To prevent financial crimes such as telecommunications network fraud, traditional methods are usually manual screening or the use of expert rules and other methods with good explanatory power. New artificial intelligence technologies such as machine learning and knowledge graphs are also gradually being applied to the field of financial risk control. Knowledge graphs have been used to discover certain relationships with potential risks and make relevant warnings. The current method is to directly give knowledge graph rules to screen possible fraudsters. Although this solution can mine a large number of suspicious fraudsters, the information associated with the graph is often complicated, and a large number of customers unrelated to fraud will be mined, resulting in a low accuracy rate. Traditional machine learning technology is also difficult to improve accuracy because there is less label data for fraudsters.

[0035] The embodiments of the present disclosure provide a method, device and electronic device for identifying risks. The method for identifying risks includes a resource transfer feature acquisition process and a suspicious medium acquisition process. In the resource transfer feature acquisition process, first, at least one resource transfer data is acquired, and the at least one resource transfer data is data between a determined risk medium and an associated medium for the risk medium. Then, a knowledge graph is constructed, and the risk medium and the associated medium are used as nodes of the knowledge graph, and the resource transfer data are used as edges of the knowledge graph. Then, based on the knowledge graph, resource transfer features are acquired, and the resource transfer features include resource transfer associated data for the risk medium and / or for the associated medium. After completing the resource transfer feature acquisition process, the suspicious medium acquisition process is entered, and the resource transfer features are clustered to obtain a first risk class, and the first proportion of the risk medium in the first risk class in the media included in the first risk class is greater than the second proportion of the risk medium in the second risk class in the media included in the second risk class. Then, suspicious risk media are acquired from the media other than the risk media in the first risk class.

[0036] The risk identification method, device and electronic device provided by the embodiments of the present disclosure are risk identification methods based on the combination of knowledge graph and machine learning. The knowledge graph is constructed based on resource transfer data to extract the associated transaction features related to fraudulent cards, and the fraudulent card list is output using K-means clustering and rule screening, which can improve the accuracy of fraudulent card identification compared with existing methods, thereby combating telecommunications fraud crimes and reducing losses for customers and banks.

[0037] The risk identification method, device, and electronic device provided in the embodiments of the present disclosure can be used in the field of artificial intelligence in related aspects of risk identification, and can also be used in various fields other than the field of artificial intelligence, such as the financial field. The application field of the risk identification method, device, and electronic device provided in the embodiments of the present disclosure is not limited.

[0038] Figure 1 The exemplary system architecture of the method, apparatus and electronic device for identifying risks according to the embodiments of the present disclosure is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0039] like Figure 1As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and servers 105, 106, 107. The network 104 may include multiple gateways, routers, hubs, network cables, etc., which are used to provide a medium for communication links between the terminal devices 101, 102, 103 and the servers 105, 106, 107. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0040] Users can use terminal devices 101, 102, 103 to interact with other terminal devices and servers 105, 106, 107 through network 104 to receive or send information, such as receiving risk identification requests, displaying knowledge graphs, displaying suspicious risks, etc. Terminal devices 101, 102, 103 can be installed with various communication client applications, such as operation and maintenance applications, asset management applications, software development applications, banking applications, government applications, monitoring applications, web browser applications, search applications, office applications, instant messaging tools, email clients, social platform software and other applications (only as examples). For example, a user can use terminal device 101 to view suspicious accounts. For example, a user can use terminal device 102 to maintain a knowledge graph. For example, a user can use terminal 103 to optimize algorithms, etc.

[0041] The terminal devices 101 , 102 , 103 include but are not limited to smart phones, virtual reality devices, augmented reality devices, tablet computers, laptop computers, desktop computers, etc.

[0042] Servers 105, 106, and 107 can receive requests and process them, and can be storage servers, background management servers, server clusters, etc. For example, server 105 can store knowledge graphs, server 106 can obtain resource transfer data, and server 107 can be a server for identifying risks. The background management server can analyze and process the received risk identification requests, etc., and feed back the processing results (such as the requested risk deadline, etc.) to the terminal device.

[0043] It should be noted that the risk identification method provided in the embodiment of the present disclosure can generally be performed by the server 105, 106, 107. Accordingly, the risk identification device provided in the embodiment of the present disclosure can generally be set in the server 105, 106, 107. The risk identification method provided in the embodiment of the present disclosure can also be performed by a server or server cluster that is different from the server 105, 106, 107 and can communicate with the terminal device 101, 102, 103 and / or the server 105, 106, 107.

[0044] It should be understood that the number of terminal devices, networks and servers is only illustrative. Depending on the implementation requirements, there can be any number of terminal devices, networks and servers.

[0045] Figure 2 The flowchart of the method for identifying risks according to the embodiment of the present disclosure is schematically shown. The method for identifying risks is executed by the server.

[0046] like Figure 2 As shown, the method for identifying risks may include operations S210 to S250.

[0047] In operation S210, at least one resource transfer data is acquired, where the at least one resource transfer data is data between a determined risk medium and an associated medium of the risk medium.

[0048] In this embodiment, the resource transfer data includes but is not limited to at least one of the following: transaction data, payment data, loan data and other operational data for resources. For example, a resource is transferred from account 1 to account 2, etc. Among them, the resource can be a virtual resource such as electronic currency, or a physical currency, etc. In addition, it can also be a valuable bill, a tradable object, etc. For example, the resource transfer data includes but is not limited to: a fraudulent card in a confirmed fraudulent transaction or a fraudulent transaction complained by a customer, as a fraudulent card list and the corresponding customer's personal transfer transaction data, etc.

[0049] The medium can be a physical medium, such as a bank card, passbook, etc. The medium can be a virtual medium, such as an account, account number, mobile phone number, ID number, user ID, etc. The medium can represent the identity of a user.

[0050] In order to facilitate understanding of the embodiments of the present disclosure, the following is an exemplary description using a bank card as an example, and the bank card has a corresponding bank account at the issuing bank. The risk medium may be a bank card with a fraudulent transaction risk, and the transaction funds involved in the bank account of the bank card with a fraudulent transaction risk include funds obtained by illegal means such as fraud.

[0051] In operation S220, a knowledge graph is constructed, with risk media and associated media as nodes of the knowledge graph, and resource transfer data as edges of the knowledge graph.

[0052] Among them, knowledge graph is a technical method that uses graph models to describe knowledge and model the relationship between all things in the world. It consists of nodes and edges: nodes can be entities or abstract concepts; edges are attributes of entities, usually represented by "relationships".

[0053] In this embodiment, bank cards can be used as nodes, and transaction relationships between bank cards can be used as edges of the knowledge graph. For example, if bank card 1 transfers money to bank card 2, it can be represented as node 1 representing bank card 1 pointing to node 2 representing bank card 2.

[0054] Figure 3 A schematic diagram of a knowledge graph according to an embodiment of the present disclosure is schematically shown.

[0055] like Figure 3 As shown, a part of the knowledge graph shows 5 media. Among them, there is an association relationship between medium 1 and medium 3. There is an association relationship between medium 3 and medium 2 and medium 4 respectively. There is also an association relationship between medium 4 and medium 5. The association relationship can be directional. Taking the transfer relationship as an example, if the account of medium 1 transfers money to the account of medium 3, the line segment representing the transfer relationship can point from the node of medium 1 to the node of medium 3.

[0056] In operation S230, resource transfer features are acquired based on the knowledge graph, where the resource transfer features include resource transfer association data for risk media and / or for associated media.

[0057] In this embodiment, taking the resource transfer transaction as an example, the transaction characteristics include but are not limited to at least one of the following: the number of outgoing transactions, the number of outgoing cards, the number of incoming transactions, the number of incoming cards, the number of transactions transferred to fraudulent cards, the number of transfers to fraudulent cards, the amount transferred to fraudulent cards, the number of transactions transferred in from fraudulent cards, the number of fraudulent cards transferred in from fraudulent cards, and the amount transferred in from fraudulent cards.

[0058] The transaction characteristics may be obtained by statistics based on historical transaction data, such as the number of transactions transferred to fraudulent cards, which may be the number of transactions for bank cards that have been determined to have fraudulent transactions.

[0059] In operation S240, the resource transfer characteristics are clustered to obtain a first risk class, wherein a first proportion of risk media in the first risk class among media included in the first risk class is greater than a second proportion of risk media in the second risk class among media included in the second risk class.

[0060] In this embodiment, resource transfer features are clustered by clustering to obtain multiple classes. Since the similarity between object features with the same properties is greater than the similarity between object features with different properties, object features with the same properties can be clustered into the same class as much as possible by clustering. Among them, clustering can be performed by unsupervised clustering or supervised clustering. For example, K-Means clustering method can be used for clustering.

[0061] The K-Means clustering method is used as an example.

[0062] First, select k initialized samples as initial cluster centers a=a1, a2, ..., ak, where k is a positive integer greater than 1.

[0063] Then, repeat the following two steps until a certain termination condition (number of iterations, minimum error change, etc.) is reached:

[0064] Operation 1: For each sample xi in the data set, calculate its distance to the k cluster centers and divide it into the class corresponding to the cluster center with the smallest distance. i is a positive integer greater than or equal to 1.

[0065] Operation 2: For each category ci, recalculate its cluster center (i.e. the centroid of all samples belonging to that class).

[0066] It should be noted that since K-Means clustering requires the number of cluster centers K to be specified in advance, the number of cluster categories K can be set according to the amount of resource transfer data and experience. For example, the value of K includes but is not limited to: 2, 3, 4, 8, 10, 20, 30, 50 or more.

[0067] In operation S250, suspicious risk media are obtained from media other than risk media in the first risk class.

[0068] By clustering, the probability of high-risk media existing in at least one class is made higher than that in other classes, so that it is easy to obtain high-risk media from the at least one class.

[0069] In the risk identification solution based on the combination of knowledge graph and machine learning in the disclosed embodiment, the machine learning method is to predict the future through historical data and experience, but traditional features are difficult to reflect the association relationship. The association features provided by the knowledge graph can enrich the data features and thus improve the accuracy of the machine learning model. By combining the knowledge graph with machine learning to optimize the existing method, the purpose of accurately obtaining the risk medium is achieved.

[0070] In some embodiments, after obtaining suspicious risk media, the risk media can be stored for matching processing, such as sending them in batches to auditors for review. After obtaining suspicious risk media, the risk media can also be output, such as sending them to a client so that the user can view the risk media on the client.

[0071] In some embodiments, obtaining resource transfer features based on the knowledge graph may include operations S401 to S402.

[0072] In operation S401, first resource transfer data for a risk medium and second resource transfer data for a directly associated medium of the risk medium are obtained from a knowledge graph.

[0073] In this embodiment, in order to obtain multi-dimensional resource transfer characteristics, feature extraction can be performed for risk media and directly associated media of risk media respectively. For example, the number of times the risk media receives resources, the number of times the risk media outputs resources, the amount of resources received each time, the amount of resources output each time, the total amount of resources received, and the total amount of resources output; the number of times the directly associated medium receives resources, the number of times the directly associated medium outputs resources, the amount of resources received each time, the amount of resources output each time, the total amount of resources received, and the total amount of resources output, etc.

[0074] In operation S402, a resource transfer feature is acquired based on the first resource transfer data and the second resource transfer data.

[0075] Since there is a large difference between the number of times and the amount of resources, such as the number of times can be single digits, tens digits or hundreds digits, but the amount of resources can be thousands digits, tens of thousands digits, millions digits, etc., the first resource transfer data and the second resource transfer data can be processed to obtain smoother features to avoid large numbers from drowning small numbers.

[0076] In some embodiments, the account number of the risky medium and the account number of the directly associated medium for the risky medium are allocated by the server, for example, bank cards issued by the same bank institution have corresponding accounts in the same bank institution.

[0077] In some embodiments, the media selected to participate in clustering are fraudulent bank cards with complete transaction information and bank cards with complete transaction information among the first-order transaction cards. For example, bank cards issued by the same bank can be selected to facilitate obtaining complete transaction data.

[0078] For example, a bank institution may choose bank cards issued by the bank institution itself, because the transaction data of non-bank cards is incomplete. If these cards are introduced into the model, it will be unfair to these cards and cause inaccurate results.

[0079] Figure 5 A medium schematic diagram according to an embodiment of the present disclosure is schematically shown.

[0080] like Figure 5 As shown, card 1, card 3 and card 4 are issued by institution 1, and card 2 and card 5 are issued by institution 2. If card 1 is a confirmed risk medium, only card 1, card 3 and card 4 can be clustered. Actively deleting card 2 and card 5 helps to increase the accuracy of the clustering results.

[0081] In some embodiments, obtaining suspicious risk media from media other than risk media in the first risk class may include the following operation: obtaining suspicious risk media from media associated with risk media in the first risk class based on a preset rule.

[0082] The probability of there being a risk medium in the medium that has associated transactions with the risk medium is high, so the associated medium that has associated transactions with the risk medium can be found from the cluster, and then the suspicious risk medium can be screened out, which effectively narrows the screening scope and improves the processing efficiency. Among them, the associated transaction can be a direct associated transaction or an indirect associated transaction.

[0083] In some embodiments, obtaining suspicious risk media from associated media of risk media in the first risk category based on preset rules includes: obtaining suspicious risk media from indirectly associated media of risk media in the first risk category based on preset rules. This further narrows the screening scope and improves processing efficiency.

[0084] Figure 6 A schematic diagram of a personal risk transfer relationship map provided according to an embodiment of the present disclosure is schematically shown.

[0085] like Figure 6 As shown in FIG. 1 , the card directly associated with the confirmed fraudulent card can be called a first-degree transaction card. Among the cards directly associated with the first-degree transaction card, the cards other than the fraudulent card can be called second-degree transaction cards. By analogy, there can also be third-degree transaction cards, fourth-degree transaction cards, etc.

[0086] There are too many cards with two or more transactions. Introducing a large number of cards will introduce many transactions that are not related to fraud. Therefore, fraud cards and one-time transaction cards are analyzed. The proportion of fraud cards in each class after K-means clustering is calculated. If the proportion of fraud cards in a class is very high, then the possibility that the remaining cards in the group are involved in fraud is also very high. In some embodiments, when clustering, only fraud cards, one-time transaction cards, and two-time transaction cards are clustered. On the basis of improving the accuracy of risk prediction, the prediction efficiency can also be effectively improved.

[0087] In some embodiments, the preset rules include at least one of the following.

[0088] For example, if the risk medium and the indirectly associated medium have resource transfer data for the same directly associated medium of the risk medium within a preset time interval, the indirectly associated medium is regarded as a suspicious risk medium. The preset time interval may be determined based on expert experience, etc. For example, the preset time interval includes but is not limited to: 1 minute, 3 minutes, 10 minutes, 30 minutes, 1 hour, 3 hours, 8 hours, 12 hours, 20 hours, 1 day, 3 days, 7 days, 15 days, 27 days, 1 month, 3 months, half a year, 1 year or longer, etc.

[0089] For example, if the same directly associated medium of the risk medium has resource transfer data for the risk medium and the indirectly associated medium within a preset time interval, the indirectly associated medium will be regarded as a suspicious risk medium.

[0090] Figure 7 A schematic diagram schematically shows a preset rule according to an embodiment of the present disclosure.

[0091] like Figure 7 As shown, suspicious cards that have transferred money to a certain intermediary card together with a fraud card within a period of time, or that have received money transfers from a certain intermediary card together with a fraud card within a period of time are screened out. These suspicious cards are found through the model and rules, and the probability of them being fraud cards is higher, so they are stored in the list of suspicious fraud cards. Within the scope of the second-transaction card, the first-transaction card is not directly regarded as a suspicious card, which effectively reduces the screening scope. It should be noted that this embodiment does not exclude the possibility of the intermediary card being a suspicious card. Figure 7 Only some transaction associations and some fraudulent cards are shown in the figure. The preset rules make Figure 7 The middle card is not Figure 7 However, since the aggregated class can include multiple fraudulent cards, Figure 7 The middle card in the Figure 7 The disclosed embodiment adopts the method of selecting suspicious cards from the secondary transaction cards, which effectively reduces the screening scope, effectively considers the characteristics of concealment and network distribution of fraudulent behavior, and effectively improves the risk identification efficiency.

[0092] In some embodiments, clustering resource transfer features may include the following operations: First, normalizing the resource transfer features to obtain a resource transfer feature vector. Then, clustering the resource transfer feature vector to obtain at least two risk classes.

[0093] Specifically, the resource transfer characteristics may include an amount characteristic.

[0094] Accordingly, normalizing the resource transfer feature to obtain the resource transfer feature vector may include the following operations. First, the resource transfer feature is smoothed by a logarithmic function to obtain a resource transfer smooth feature. Then, the resource transfer smooth feature is normalized to map the resource transfer smooth feature to a specified space. Through the above feature smoothing, the problem of small numbers being submerged by large numbers due to the large numerical gap between the amount feature and the number feature is effectively improved.

[0095] For example, we first use the log function to smooth the features. For the amount feature, we use the log function log10(x+1) with a base of 10, and other quantity features use the natural logarithm ln(x+1). Then we use the maximum and minimum normalization (x-min) / (max-min) to map each feature to the range of [0,1], which is convenient for subsequent clustering.

[0096] The disclosed embodiment constructs a knowledge graph for personal risk transfer, extracts associated transaction features related to fraudulent cards, and uses K-means clustering and rule screening to output a list of fraudulent cards. This can improve the accuracy of identifying fraudulent cards compared to existing methods, thereby combating telecommunications fraud crimes and reducing losses to customers and institutions.

[0097] Another aspect of the present disclosure provides an apparatus for identifying risks.

[0098] Figure 8 A block diagram of a device for identifying risks according to an embodiment of the present disclosure is schematically shown.

[0099] like Figure 8 As shown, the risk identification device 800 may include: a resource transfer data acquisition module 810, a knowledge graph construction module 820, a resource transfer feature acquisition module 830, a feature clustering module 840 and a suspicious risk medium acquisition module 850.

[0100] The resource transfer data acquisition module 810 is used to acquire at least one resource transfer data, where the resource transfer data is data between the determined risk medium and the associated medium.

[0101] The knowledge graph construction module 820 is used to construct a knowledge graph, with risk media and associated media as nodes of the knowledge graph and resource transfer data as edges of the knowledge graph.

[0102] The resource transfer feature acquisition module 830 is used to acquire resource transfer features based on the knowledge graph, and the resource transfer features include resource transfer association data for risk media and / or for associated media.

[0103] The feature clustering module 840 is used to cluster the resource transfer features to obtain a first risk class, in which a first proportion of risk media in the first risk class among the media included in the first risk class is greater than a second proportion of risk media in the second risk class among the media included in the second risk class.

[0104] The suspicious risk medium acquisition module 850 is used to acquire suspicious risk medium from the media other than the risk medium in the first risk category.

[0105] Fig. 9A logical diagram of identifying risks according to an embodiment of the present disclosure is schematically shown.

[0106] like Fig. 9 As shown, the risk identification device 800 can perform the operations shown below.

[0107] First, the resource transfer data required for the composition is obtained. For example, the resource transfer data may include: fraudulent transactions that match the transaction rules, personal transfer transaction data of customers corresponding to fraudulent cards in fraudulent transactions complained by customers, etc.

[0108] Then, a personal risk transfer relationship graph is constructed based on the resource transfer data obtained in the previous operation. The knowledge graph can be simply understood as a multi-relationship graph, which is composed of points and edges. In the knowledge graph, we usually use entities to represent points and relationships to represent edges. The present invention uses the existing fraud card as the starting point of the composition and the transaction data of a period of time as the edge to construct a knowledge graph including transaction relationships.

[0109] Next, the resource transfer characteristics are calculated based on the knowledge graph for personal risk transfer constructed based on the above operations.

[0110] Then, the resource transfer features calculated in the previous operation are processed to facilitate the subsequent clustering operation.

[0111] Next, the K-means algorithm is used to cluster all fraudulent cards and first-time transaction cards. There are certain differences in transaction behavior characteristics between fraudulent cards and non-fraudulent cards, so clustering can be used to find more cards with transaction behaviors similar to those of fraudulent cards. The K-means clustering used in the embodiment of the present disclosure is an unsupervised machine learning algorithm. Its basic idea is to divide a given sample set into K classes according to the distance between samples. Let the points within a class be as closely connected as possible, and let the distance between classes be as large as possible.

[0112] Then, from the classes obtained in the previous operation, the cards in the class with the highest proportion of fraudulent cards are filtered by rules. The rules used are referenced Figure 7 shown.

[0113] The above method can quickly and accurately screen out suspicious risk media with high suspicion.

[0114] It should be noted that the implementation methods, technical problems solved, functions realized, and technical effects achieved of each module / unit in the device part embodiment are the same or similar to the implementation methods, technical problems solved, functions realized, and technical effects achieved of each corresponding step in the method part embodiment, and they will not be repeated here one by one.

[0115] According to the modules and units of the embodiments of the present disclosure, any multiple or at least part of the functions of any multiple thereof can be implemented in one module. According to the modules and units of the embodiments of the present disclosure, any one or more can be split into multiple modules for implementation. According to the modules and units of the embodiments of the present disclosure, any one or more can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware of any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, according to the modules and units of the embodiments of the present disclosure, one or more can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0116] For example, any multiple of the resource transfer data acquisition module 810, the knowledge graph construction module 820, the resource transfer feature acquisition module 830, the feature clustering module 840, and the suspicious risk medium acquisition module 850 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the resource transfer data acquisition module 810, the knowledge graph construction module 820, the resource transfer feature acquisition module 830, the feature clustering module 840, and the suspicious risk medium acquisition module 850 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the resource transfer data acquisition module 810, the knowledge graph construction module 820, the resource transfer feature acquisition module 830, the feature clustering module 840 and the suspicious risk medium acquisition module 850 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0117] Fig.10 A block diagram of an electronic device according to an embodiment of the present disclosure is schematically shown. Fig.10 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0118] like Fig.10 As shown, the electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include an onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0119] In RAM 1003, various programs and data required for the operation of electronic device 1000 are stored. Processor 1001, ROM 1002 and RAM 1003 are connected to each other through bus 1004. Processor 1001 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1002 and / or RAM 1003. It should be noted that the program can also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0120] According to an embodiment of the present disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The electronic device 1000 may further include one or more of the following components connected to the I / O interface 1005: an input portion 1006 including a keyboard, a mouse, etc.; an output portion 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1008 including a hard disk, etc.; and a communication portion 1009 including a network interface card such as a LAN card, a modem, etc. The communication portion 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage portion 1008 as needed.

[0121] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0122] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0123] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1002 and / or RAM 1003 described above and / or one or more memories other than ROM 1002 and RAM 1003.

[0124] An embodiment of the present disclosure also includes a computer program product, which includes a computer program, which contains program code for executing the method provided by the embodiment of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the image model training method or image processing method provided by the embodiment of the present disclosure.

[0125] When the computer program is executed by the processor 1001, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0126] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1009, and / or installed from the removable medium 1011. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0127] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0128] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. These embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the various embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, all of which should fall within the scope of the present disclosure.

Claims

1. A method for identifying risks executed by a server, include: Acquire at least one resource transfer data, wherein the at least one resource transfer data is data between a determined risk medium and an associated medium of the risk medium; Constructing a knowledge graph, wherein the risk medium and the associated medium serve as nodes of the knowledge graph, and the resource transfer data serve as edges of the knowledge graph; Acquiring resource transfer features based on the knowledge graph, wherein acquiring resource transfer features based on the knowledge graph includes: Acquire, from the knowledge graph, first resource transfer data for the risk medium and second resource transfer data for a directly associated medium of the risk medium; and Acquire a resource transfer feature based on the first resource transfer data and the second resource transfer data; Clustering the resource transfer characteristics to obtain a first risk class, wherein a first proportion of risk media in the first risk class to media included in the first risk class is greater than a second proportion of risk media in the second risk class to media included in the second risk class, The clustering of the resource transfer features includes: Normalizing the resource transfer feature to obtain a resource transfer feature vector; and Clustering the resource transfer feature vector to obtain at least two risk classes; and Suspicious risk media are obtained from media other than the risk media in the first risk category.

2. The method according to claim 1, in, The account number of the risky medium and the account number of the medium directly associated with the risky medium are allocated by the server.

3. The method according to claim 1, in, The obtaining of suspicious risk media from media other than the risk media in the first risk category includes: The suspicious risk medium is obtained from the associated medium of the risk medium in the first risk class based on a preset rule.

4. The method according to claim 3, in, The obtaining of suspicious risk media from the associated media of the risk media in the first risk category based on the preset rule includes: The suspicious risk medium is obtained from the indirect associated medium of the risk medium in the first risk class based on a preset rule.

5. The method according to claim 4, in, The preset rules include at least one of the following: If the risk medium and the indirectly associated medium have resource transfer-out data for the same directly associated medium of the risk medium within a preset time interval, the indirectly associated medium is regarded as the suspicious risk medium; or If the same directly associated medium of the risk medium has resource transfer data for the risk medium and the indirectly associated medium within a preset time interval, the indirectly associated medium is regarded as the suspicious risk medium.

6. The method according to claim 1, in, The resource transfer characteristics include amount characteristics; The normalizing the resource transfer feature to obtain a resource transfer feature vector includes: Performing feature smoothing processing on the resource transfer feature through a logarithmic function to obtain a resource transfer smoothing feature; as well as The resource transfer smoothing feature is normalized to map the resource transfer smoothing feature to a specified space.

7. The method according to any one of claims 1 to 6, further comprising: include: storing the suspicious risk medium; and / or The suspicious risk medium is sent to the client.

8. A device for identifying risk, arranged in a server, wherein the device include: A resource transfer data acquisition module, used to acquire at least one resource transfer data, wherein the resource transfer data is data between the determined risk medium and the associated medium; A knowledge graph construction module, used to construct a knowledge graph, wherein the risk medium and the associated medium serve as nodes of the knowledge graph, and the resource transfer data serve as edges of the knowledge graph; A resource transfer feature acquisition module is used to acquire resource transfer features based on the knowledge graph, wherein acquiring resource transfer features based on the knowledge graph includes: Acquire, from the knowledge graph, first resource transfer data for the risk medium and second resource transfer data for a directly associated medium of the risk medium; and Acquire a resource transfer feature based on the first resource transfer data and the second resource transfer data; a feature clustering module, configured to cluster the resource transfer features to obtain a first risk class, wherein a first proportion of risk media in the first risk class among media included in the first risk class is greater than a second proportion of risk media in the second risk class among media included in the second risk class, The clustering of the resource transfer features includes: Normalizing the resource transfer feature to obtain a resource transfer feature vector; and Clustering the resource transfer feature vector to obtain at least two risk classes; and The suspicious risk medium acquisition module is used to acquire suspicious risk medium from the medium other than the risk medium in the first risk category.

9. An electronic device, include: one or more processors; A storage device for storing executable instructions, wherein when the executable instructions are executed by the processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing computer-executable instructions, wherein when the executable instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images