Risk determination method, device and medium for relational network topology

Abstract

The present invention provides a method, device and medium for determining the risk of a relationship network topology. The method comprises: obtaining a plurality of relationship network topologies that have been determined to be risks, wherein the relationship network topology is a connected graph composed of nodes and directed edges between nodes; extracting the common sub-topologies in the plurality of relationship network topologies that have been determined to be risks; for the nodes or directed edges in the common sub-topologies, adding the common elements of the nodes or directed edges in the plurality of relationship network topologies that have been determined to be risks, and using the added common sub-topologies as risk pattern sub-topologies; if the relationship network topology to be determined contains the risk pattern sub-topology, determining the relationship network topology to be determined to be a risk. The embodiments of the present invention make the risk determination of the relationship network topology more efficient and accurate.

Description

Technical Field

[0001] The present invention relates to the field of information processing, and in particular to a method, device and medium for determining risk of relational network topology. Background Art

[0002] In the era of big data, the relationships between entities (such as units, etc.) (such as invoicing, transfer, guarantee) are often very important data. Through these data, we can analyze whether the relationship between entities is normal, whether the entities are engaged in some inappropriate behavior, etc. The basis of entity relationship big data analysis is the relationship network topology. The relationship network topology is a connected graph composed of nodes and directed edges between nodes, where nodes represent entities and directed edges represent the relationships between entities (such as guarantee, transfer). The relationship network topology is formed by some visual relationship network products, based on the relationship behavior data between entities stored in the database (for example, entity A guarantees entity B, entity B invests in entity C, etc.), drawing entities into nodes and drawing the relationship behaviors between entities into directed edges between nodes. In this way, based on the relationship network topology, we can analyze whether the relationship between entities is normal, whether the entities are engaged in some illegal behavior, etc.

[0003] In the prior art, whether there are risks in these relationship network topologies is determined through risk pattern sub-topology. The risk pattern sub-topology is constructed in advance, which is also a connected graph composed of some nodes and directed edges between nodes. As long as the relationship network topology contains the risk pattern sub-topology, the relationship network topology is risky. For example, if three units A, B, and C form a circular guarantee, that is, A guarantees B, B guarantees C, and C guarantees A, this guarantee relationship is definitely risky, and the topology corresponding to the circular guarantee of the three units A, B, and C (a triangle composed of the three nodes A, B, and C connected by directed edges) can be used as a risk pattern sub-topology. If the relationship network topology contains the risk pattern sub-topology, it is determined that there is a risk.

[0004] Currently, there are two ways to construct risk model sub-topology: one is through code conversion, and the other is through the use of visualization tools, where the administrator manually draws the risk model sub-topology on the interface. Both methods rely on the administrator's business experience, which is inefficient, and rely on human subjective judgment, which has poor accuracy. Summary of the invention

[0005] In view of this, the present invention aims to make the risk determination of relationship network topology more efficient and accurate.

[0006] To achieve this objective, according to a first aspect of the present invention, an embodiment of the present invention provides a method for determining risk of a relationship network topology, comprising:

[0007] Acquire multiple relationship network topologies that have been determined to be risks, where the relationship network topology is a connected graph consisting of nodes and directed edges between the nodes;

[0008] Extracting common sub-topologies from the plurality of relationship network topologies that have been determined to be risky;

[0009] For a node or directed edge in the shared sub-topology, add the common elements of the node or directed edge in the plurality of relationship network topologies that have been determined to be risky, and use the added shared sub-topology as the risk mode sub-topology;

[0010] If the relationship network topology to be determined contains the risk pattern sub-topology, the relationship network topology to be determined is determined to be risky.

[0011] Optionally, the element is at least one element selected from the group consisting of: node type, node attribute, edge type and edge attribute.

[0012] Optionally, the shared sub-topology includes a connected graph consisting of shared nodes and directed edges between nodes in the multiple relationship network topologies that have been determined to be risky.

[0013] Optionally, the shared sub-topology includes a connected graph consisting of shared nodes and directed edges between nodes in the multiple relationship network topologies that have been determined to be at risk, and in the multiple relationship network topologies that have been determined to be at risk, some elements of these shared nodes and directed edges between nodes are also shared; for the nodes or directed edges in the shared sub-topology, adding the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk includes: for the nodes or directed edges in the shared sub-topology, adding the common elements among the remaining elements other than the part of the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk.

[0014] Optionally, after extracting the common sub-topologies from the plurality of relationship network topologies determined to be risky, the method includes: if the common sub-topology does not comply with a predetermined sub-topology rule, discarding the common sub-topology.

[0015] Optionally, after obtaining multiple relationship network topologies that have been determined to be risks, the method further includes: obtaining the risk types of the multiple relationship network topologies that have been determined to be risks; extracting common sub-topologies from the multiple relationship network topologies that have been determined to be risks, including: extracting common sub-topologies from relationship network topologies that have been determined to be risks in a specific risk type; adding common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be risks to the nodes or directed edges in the common sub-topology, and using the added common sub-topology as a risk pattern sub-topology, including: adding common elements of the nodes or directed edges in the relationship network topology that have been determined to be risks in the specific risk type to the nodes or directed edges in the common sub-topology, and using the added common sub-topology as the risk pattern sub-topology for the specific risk type.

[0016] Optionally, after extracting the common sub-topology in the relationship network topology determined as risk in a specific risk type, the method further includes: if the common sub-topology does not comply with a predetermined sub-topology rule corresponding to the specific risk type, discarding the common sub-topology.

[0017] Optionally, if the relationship network topology to be determined contains the risk pattern sub-topology, then the relationship network topology to be determined is determined to be a risk, including: comparing the relationship network topology to be determined with the risk pattern sub-topology of each risk type, and if the relationship network topology to be determined contains the risk pattern sub-topology of one of the risk types, then the relationship network topology to be determined is determined to be a risk.

[0018] Optionally, if the element is a node type, the common element is determined as follows: for a node in the common sub-topology, if the node type of the node in the multiple relationship network topologies that have been determined to be at risk is the same, or the node type belongs to the same node type group, then the same node type or the same node type group is a common element.

[0019] Optionally, if the element is a node attribute, the common element is determined as follows: for a node in the common sub-topology, if the specific non-numeric node attribute of the node in the multiple relationship network topologies that have been determined to be at risk is the same, or the specific numerical node attribute belongs to the same attribute value range, then the same non-numeric node attribute or the same attribute value range is a common element.

[0020] Optionally, if the element is an edge type, the common element is determined as follows: for a directed edge in the common sub-topology, if the edge type of the directed edge in the multiple relationship network topologies that have been determined to be at risk is the same, or the edge type belongs to the same edge type group, then the same edge type or the same edge type group is a common element.

[0021] Optionally, if the element is an edge attribute, the common element is determined as follows: for the directed edge in the common sub-topology, if the specific non-numeric edge attribute of the directed edge in the multiple relationship network topologies that have been determined to be at risk is the same, or the specific numerical edge attribute belongs to the same attribute value range, then the same non-numeric edge attribute or the same attribute value range is a common element.

[0022] Optionally, after adding the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be risky to the nodes or directed edges in the common sub-topology, and using the added common sub-topology as the risk mode sub-topology, the method further includes: adjusting the risk mode sub-topology based on the adjustment instructions input by the user.

[0023] According to a second aspect of the present invention, there is provided a risk determination device for a relationship network topology, comprising:

[0024] processor;

[0025] A memory storing a computer executable code, wherein the computer executable code is called by the processor to execute:

[0026] Acquire multiple relationship network topologies that have been determined to be risks, where the relationship network topology is a connected graph consisting of nodes and directed edges between the nodes;

[0027] Extracting common sub-topologies from the plurality of relationship network topologies that have been determined to be risky;

[0028] For a node or directed edge in the shared sub-topology, add the common elements of the node or directed edge in the plurality of relationship network topologies that have been determined to be risky, and use the added shared sub-topology as the risk mode sub-topology;

[0029] If the relationship network topology to be determined contains the risk pattern sub-topology, the relationship network topology to be determined is determined to be risky.

[0030] Optionally, the element is at least one element selected from the group consisting of: node type, node attribute, edge type and edge attribute.

[0031] Optionally, the shared sub-topology includes a connected graph consisting of shared nodes and directed edges between nodes in the multiple relationship network topologies that have been determined to be risky.

[0032] Optionally, the shared sub-topology includes a connected graph consisting of shared nodes and directed edges between nodes in the multiple relationship network topologies that have been determined to be at risk, and in the multiple relationship network topologies that have been determined to be at risk, some elements of these shared nodes and directed edges between nodes are also shared; for the nodes or directed edges in the shared sub-topology, adding the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk includes: for the nodes or directed edges in the shared sub-topology, adding the common elements among the remaining elements other than the part of the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk.

[0033] Optionally, the computer executable code is called by the processor to execute: after extracting the common sub-topologies from the multiple relationship network topologies that have been determined to be risky, if the common sub-topologies do not comply with a predetermined sub-topology rule, discarding the common sub-topologies.

[0034] Optionally, the computer executable code is called by the processor to execute: adding the common elements of the node or directed edge in the multiple relationship network topologies that have been determined to be risky to the node or directed edge in the common sub-topology, and after the added common sub-topology is used as the risk mode sub-topology, adjusting the risk mode sub-topology based on the adjustment instructions input by the user.

[0035] According to a third aspect of the present invention, there is provided a computer-readable medium, wherein the computer-readable medium stores computer instructions executable by a terminal device, and when the computer instructions are executed, the following are implemented:

[0036] Acquire multiple relationship network topologies that have been determined to be risks, where the relationship network topology is a connected graph consisting of nodes and directed edges between the nodes;

[0037] Extracting common sub-topologies from the plurality of relationship network topologies that have been determined to be risky;

[0038] For a node or directed edge in the shared sub-topology, add the common elements of the node or directed edge in the plurality of relationship network topologies that have been determined to be risky, and use the added shared sub-topology as the risk mode sub-topology;

[0039] If the relationship network topology to be determined contains the risk pattern sub-topology, the relationship network topology to be determined is determined to be risky.

[0040] In the embodiment of the present invention, instead of relying on the subjective judgment of the administrator to establish the risk model sub-topology, full use is made of the relationship network topology that has been judged as risky in the past, and the common sub-topology is extracted therefrom. On this basis, the risk model sub-topology is established, which not only improves the efficiency of establishing the risk model sub-topology, but also reduces the impact of human judgment on the established risk model sub-topology, making the risk determination of the relationship network topology more efficient and accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The above and other objects, features and advantages of the present invention will become more apparent through the description of the embodiments of the present invention with reference to the following drawings, in which:

[0042] Figure 1 A system architecture diagram is shown for use in a risk determination method for a relationship network topology according to an embodiment of the present invention;

[0043] Figure 2A -C shows three examples of relationship network topologies that have been identified as risks;

[0044] Figure 3A The embodiment of extracting the common sub-topology only according to the common topology graph according to the present invention is shown. Figure 2A -The common sub-topologies extracted from the three relationship network topologies of C, Figure 3B The following table shows the common elements of each node and directed edge in the corresponding three relationship network topologies. Figure 3C Shown in Figure 3A Based on the combination Figure 3B The risk pattern sub-topology formed by the list of common elements;

[0045] Figure 4A -C shows three examples of relationship network topologies that have been identified as risks;

[0046] Figure 5A The embodiment of extracting the common sub-topology according to the common topology graph and the common node type according to the present invention is shown. Figure 4A -The common sub-topologies extracted from the three relationship network topologies of C, Figure 5B The following table shows the common elements of each node and directed edge in the corresponding three relationship network topologies. Figure 5C Shown in Figure 5A Based on the combination Figure 5B The risk pattern sub-topology formed by the list of common elements;

[0047] Fig. 6A -C shows three examples of relationship network topologies that have been identified as risks;

[0048] Fig. 7AThe embodiment of extracting the common sub-topology according to the common topology graph, common node type and common edge type according to the present invention is shown. Fig. 6A -The common sub-topologies extracted from the three relationship network topologies of C, Figure 7B The following table shows the common elements of each node and directed edge in the corresponding three relationship network topologies. Figure 7C Shown in Fig. 7A Based on the combination Figure 7B The risk pattern sub-topology formed by the list of common elements;

[0049] Figure 8 A flowchart showing a method for determining risk of a relationship network topology according to an embodiment of the present invention is shown;

[0050] Fig. 9 A flowchart showing a method for determining risk of a relationship network topology according to an embodiment of the present invention is shown;

[0051] Fig.10 A block diagram showing a risk determination device for a relationship network topology according to an embodiment of the present invention;

[0052] Fig.11 A structural diagram of a risk determination device for a relationship network topology according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0053] The present invention is described below based on embodiments, but the present invention is not limited to these embodiments. In the detailed description of the present invention below, some specific details are described in detail. It is possible for a person skilled in the art to fully understand the present invention without the description of these details. In order to avoid confusing the essence of the present invention, known methods, processes, and procedures are not described in detail. In addition, the drawings are not necessarily drawn to scale.

[0054] The risk determination method of the relationship network topology according to the embodiment of the present invention can be used in scenarios such as enterprise map analysis. The enterprise map is a product that provides one-stop enterprise data services for enterprises. By integrating enterprises and enterprise-related information, mining massive unstructured data on the Internet, and combining multi-dimensional cross-analysis and intelligent algorithms, it provides enterprises with the ability to profile their customers and analyze related problems. By analyzing and mining the information of enterprises on the Internet, the dynamics of enterprises can be grasped in real time and the behavior of enterprises can be accurately predicted, providing enterprises with intelligent applications and customized solutions. An important function of the enterprise map is the relationship display between enterprises and other enterprises. In the map of relationship display, the enterprise is taken as a node, and other enterprises or organizations that have various relationships with the enterprise (such as guarantee relationship analysis, fund transfer relationship, equity investment relationship, invoice issuance relationship, contract cooperation relationship, etc.) are also taken as nodes, and the relationship between the enterprise and other enterprises or organizations (such as guarantee, fund transfer, equity investment, invoicing, etc.) is taken as a directed edge between nodes, thereby drawing an enterprise map. The enterprise map can not only provide customized solutions for the enterprise to analyze enterprise dynamics and accurately predict enterprise behavior, but also can be used by banks and others to predict whether there are some improper behaviors in the enterprise.

[0055] Figure 1 The diagram shows a system architecture diagram of a risk determination method for a relational network topology according to an embodiment of the present invention applied in the above scenario. The system architecture includes a database 120 , a server 110 , a network 130 and a query terminal 140 .

[0056] The query terminal 140 is a terminal for querying whether a relationship network topology has risks. In the scenario where the bank uses the enterprise map to check whether the enterprise and other organizations have improper behavior, it can be the bank's verification terminal. It can be embodied as a desktop computer, a laptop computer, a mobile terminal (mobile phone, PDA, etc.), a car terminal or other special terminals. Bank staff can generate the relationship network topology to be determined on the query terminal 140 with the help of a visual relationship network product, or select the relationship network topology to be determined on the interface provided by the query terminal 140, and send it to the server 110 through the network 130. The relationship network topology to be determined can be the above-mentioned enterprise map, that is, according to the relationship between the enterprise and other organizations, the enterprise or other organizations are depicted as nodes, and the relationship between the enterprise and other organizations (such as loan relationship, guarantee relationship, etc.) is depicted as a directed edge between nodes, and a connected graph representing the relationship between the enterprise and other organizations is formed. The purpose of the bank staff's query through the query terminal 140 is to determine whether there are risks in the transactions between the enterprise and other organizations before the bank lends money to the bank, such as whether they are engaged in money laundering, fraud, etc., so as to take appropriate measures.

[0057] The network 130 may be the Internet, a wired telecommunication network, a wireless telecommunication network, or the like.

[0058] The server 110 is the execution subject of the risk determination method of the relationship network topology of the embodiment of the present invention. In the above scenario, it can be an enterprise graph server. It makes full use of the relationship network topologies that have been determined to be risky in the relationship network topologies obtained in the past and stored in the database 120, extracts their common sub-topologies, and establishes risk model sub-topologies on this basis, so as to use it to determine whether the relationship network topology to be determined received from the query terminal 140 is risky.

[0059] Database 120 is a library for storing various historically obtained relationship network topologies and entity relationship basic data. In the above scenario, it can be an enterprise graph database. The relationship network topology is a connected graph formed by using nodes to represent entities and directed edges between nodes to represent the relationships between entities. It represents the interaction relationship between various entities in the entity relationship network. Generally speaking, starting from an entity, it is regarded as a node, and which entities have relationships with it are examined as its adjacent nodes, and directed edges are formed between the node and the adjacent nodes. Then examine which entities each adjacent node has a relationship with, and radiate layer by layer. The entity relationship basic data is the data relied on for drawing the relationship network topology, that is, each entity data and the data representing the relationship between these entities, for example, a guarantee record representing entity A guaranteeing entity B.

[0060] like Figure 8 As shown, a risk determination method for a relationship network topology according to an embodiment of the present invention is provided. A relationship network topology is a connected graph consisting of nodes and directed edges between nodes, which is used to simulate various relationships between entities (units, etc.). The risk determination method refers to a method for determining whether there is a risk in the relationship network topology. The risk refers to the existence of unsafe hidden dangers such as money laundering, fraud, and circular guarantees. The method is implemented by the server 110.

[0061] In step 310, a plurality of relationship network topologies that have been determined to be risky are obtained.

[0062] As described above, the historical relationship network topology can be generated by the visual relationship network product on the server 110 based on the entity relationship basic data stored in the database 120. Specifically, it can be generated by drawing the involved entities into nodes and drawing the relationships between the involved entities into directed edges between the nodes based on the entity relationship basic data. The historical relationship network topology is stored in the database 120 after being generated.

[0063] In one embodiment, obtaining multiple relationship network topologies that have been determined to be risky can be achieved by displaying the relationship network topologies stored in the database 120 to the administrator through an interface one by one, and then the administrator marks whether there is risk on the interface based on manual experience. That is, displaying the historical relationship network topologies stored in advance, receiving the user's selection of the risky relationship network topologies in the displayed relationship network topologies, and thus obtaining the multiple relationship network topologies that have been determined to be risky.

[0064] In step 320 , common sub-topologies among the plurality of relationship network topologies determined to be risky are extracted.

[0065] The shared sub-topology may be different depending on the requirements of the specific application scenario, and there may be two different situations, namely, the shared sub-topology that only considers the shape of the graph, and the shared sub-topology that considers the shape of the graph and some common elements of the nodes or directed edges at the same time. The element is at least one element selected from the following element group: node type, node attribute, edge type and edge attribute. The common element refers to the element that is the same among the multiple relationship network topologies that have been determined to be risks.

[0066] The node type is the entity property of the entity represented by the node. For example, if the node represents a bank entity, then bank is the node type of the node. The node attribute is other information about the entity represented by the node except the type. For example, the region, address, telephone number, legal representative, number of people, etc. of the entity can all be used as node attributes. The edge type is the name of the specific relationship between entities. For example, if entity A guarantees entity B, then the guarantee is the type of the directed edge from node A to node B. The edge attribute refers to other properties of the specific relationship between entities except the name. For example, for a guarantee, the guarantee amount can be an edge attribute, and the guarantee date can also be an edge attribute.

[0067] Let us first discuss the shared sub-topology when only the shared sub-topology of the graph shape is considered. The shared sub-topology when only the shared sub-topology of the graph shape is a connected graph composed of the shared nodes and directed edges between the nodes in the multiple relationship network topologies that have been determined to be risks. In other words, the multiple relationship network topologies that have been determined to be risks all contain these nodes and directed edges between these nodes. These nodes are connected by these directed edges to form a connected graph, and this connected graph is the shared sub-topology. Connectivity means that for any node in the graph, it can pass through several directed edges in the graph (either along the direction of the directed edges or in the opposite direction of the directed edges) to reach any other node in the graph.

[0068] For example, for Figure 2A , 2B, 2C, and the three relationship network topologies that have been determined to be risky, each relationship network topology includes nodes 210 connected by directed edges 220. These topologies obviously contain the three nodes D, B, and C, and also contain directed edges from node D to node B, from node B to node C, and from node C to node D, so they are extracted, as shown in Figure 3A As shown, Figure 2A -The common subtopology of C.

[0069] In the above case, when determining the shared sub-topology, only the graph shape is considered, that is, whether it includes the same nodes and directed edges between nodes. As long as multiple relationship network topologies include common nodes and directed edges between nodes, and these directed edges connect the nodes into a connected graph, they can be extracted as shared sub-topologies. But sometimes only considering the graph shape is not enough. For example, Figure 3A In the example, assuming that the directed edges BC, CD, and DB all represent guarantees, a circular guarantee is constituted. This pattern is problematic and may involve illegality. However, if the directed edges BC, CD, and DB all represent outbound visits, this pattern is not problematic. Therefore, in some embodiments, when determining a shared sub-topology, in addition to considering the shape of the graph, a portion of the common elements of the nodes or directed edges must also be considered. At this time, the shared sub-topology includes a connected graph composed of shared nodes and directed edges between nodes in the multiple relationship network topologies that have been determined to be risky, and these shared nodes and a portion of the elements of the directed edges between nodes are also shared in the multiple relationship network topologies that have been determined to be risky. In other words, it not only requires that the nodes and directed edges between nodes in the shared sub-topology are shared by multiple relationship network topologies, but also requires that the shared nodes and a portion of the elements of the directed edges between nodes are also shared, such as shared node types, or shared node types and edge types at the same time.

[0070] For example, the shared sub-topology requires not only the shared directed edges between nodes but also the shared node types. Figure 4A -C shows the topology of three relationship networks that have been identified as risks. If we follow the principle of only requiring nodes and directed edges between nodes to be shared, not only nodes B, C, D and the directed edges between them will be extracted, Figure 4A The node H, Figure 4B Node I, Figure 4C Node J will also be extracted because although these nodes are represented by different letters, there is a same directed edge from node C to this node, and there is also a same directed edge from this node to node D. However, due to Figure 4A The node type of the middle node H is bank. Figure 4B The node type of node I is school. Figure 4C The node type of the middle node J is store, which is not a common node type. Therefore, Figure 5AAs shown, only nodes BD and the directed edges between them are extracted as the common sub-topology, where the node types of nodes BD are all banks.

[0071] For example, the shared sub-topology requires not only the shared nodes and directed edges between nodes, but also the shared node types and edge types. Fig. 6A -C shows the topology of three relationship networks that have been identified as risks. If we follow the principle of requiring nodes and directed edges between nodes to be shared, as well as node types to be shared, not only nodes B, C, D and the directed edges between them will be extracted, Fig. 6A The node H, Figure 6B The node L, Figure 6C The node M will also be extracted because although these nodes are represented by different letters, there is a same directed edge from node C to this node, and there is also a same directed edge from this node to node D, and their node types are both banks. Figure 6B The edge type of the directed edge CL in is loan, and Fig. 6A and the corresponding edge type in C is guaranteed, and Figure 6C The edge type of the directed edge ND in is loan, and Fig. 6A -The corresponding edge type in B is guarantee, so if Fig. 7A As shown, only nodes BD and the directed edges between them are extracted as the common sub-topology, where the node type of nodes BD is all bank, and the edge type of the directed edges between them is all guarantee.

[0072] like Figure 8 As shown, after step 320, the process proceeds to step 330, that is, if the shared sub-topology does not conform to the predetermined sub-topology rule, the shared sub-topology is discarded. However, this step can be omitted.

[0073] The predetermined sub-topology rules are pre-established rules that the risk pattern sub-topology should satisfy. Step 330 takes into account that some commonly used patterns are likely to appear in the relationship network between entities. In step 320, the corresponding shared sub-topology is likely to be extracted, but it may not be harmful and is not the risk of these relationship network topologies determined to be risky. Therefore, some rules are established in advance. Only when these rules are met can it be considered risky. If these rules are not met, it is not considered risky and the corresponding shared sub-topology is discarded. The benefit of this step is to avoid identifying some common patterns as risk pattern sub-topologies, which affects the accuracy of risk determination.

[0074] Then, in step 340, for the nodes or directed edges in the shared sub-topology, the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be risky are added, and the added shared sub-topology is used as the risk pattern sub-topology, that is, the risk pattern sub-topology is completed.

[0075] In practice, it is unlikely to determine that a network topology is risky based on all nodes and directed edges between nodes in the risk pattern subtopology. Generally, requirements such as node type, node attribute, edge type, and edge attribute should be considered. Figure 3A As shown, when determining the shared sub-topology, only the same nodes and directed edges between nodes are considered. When forming the final risk pattern sub-topology, the elements must also be completed, that is, the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined as risks are added. Then, when determining whether the relationship network topology to be determined contains the risk pattern sub-topology, not only whether it contains the nodes and directed edges in the risk pattern sub-topology, but also whether it contains the same common elements.

[0076] The rules for determining common elements are discussed below.

[0077] If the element is a node type, the common element is determined as follows: for the node in the shared sub-topology, if the node type of the node in the multiple relationship network topologies that have been determined to be risky is the same, or the node type belongs to the same node type group, then the same node type or the same node type group is a common element. A node type group is a group that is pre-divided into nodes of similar types. For example, a bank and a credit union are two different node types, but in fact their functions are similar. If the specific nodes of the two relationship network topologies are only different in type as a bank or a credit union, it is inappropriate to think that they are very different. The mapping relationship table between node types and node type groups is set in advance, and the mapping relationship table can be searched to obtain the node type group to which the node type belongs.

[0078]

[0079] Table 1

[0080] As shown in Table 1, if the types of nodes 1-3 are all banks, the bank is the common element; if the types of nodes 1-2 are banks and the type of node 3 is a credit union, the financial unit is the common element; if the types of nodes 1 and 3 are banks and the type of node 2 is a school, there is no common element.

[0081] If the element is a node attribute, the common element is determined as follows: for a node in the shared sub-topology, if the specific non-numerical node attribute of the node in the multiple relationship network topologies that have been determined to be risky is the same, or the specific numerical node attribute belongs to the same attribute value range, then the same non-numerical node attribute or the same attribute value range is a common element. Non-numerical node attributes refer to node attributes that are not expressed numerically, such as region. Numerical node attributes refer to node attributes expressed numerically, such as the number of employees. For non-numerical node attributes, they need to be exactly the same to be considered the same. For example, if the regions are both Beijing, two nodes are considered the same in terms of region. However, for numerical node attributes, as long as they belong to the same attribute value range, they are considered similar, and the specific values ​​are not that different. The same attribute value range can be used as a common element. Taking the number of employees as an example, 1-20 people are considered micro-units, 21-100 people are considered small units, 101-1000 people are considered medium-sized units, and more than 1001 people are considered large units, so 35 people and 48 people are considered not to be very different. Therefore, as long as the numeric node attributes belong to the same attribute value range, they are considered similar, and the same attribute value range is used as a common element. The attribute value range is pre-set, and the preset attribute value range can be searched to obtain the attribute value range to which the numeric node attribute belongs.

[0082]

[0083] Table 2

[0084] As shown in Table 2, if the node attribute of the number of employees of nodes 1-3 is 35, then 21-100 people are the common elements; if the number of employees of nodes 1-3 is 35, 68, and 53 respectively, then 21-100 people are the common elements; if the number of employees of nodes 1-3 is 35, 138, and 75 respectively, then there is no common element.

[0085] If the element is an edge type, the common element is determined as follows: for the directed edge in the shared sub-topology, if the edge type of the directed edge in the multiple relationship network topologies that have been determined to be risky is the same, or the edge type belongs to the same edge type group, then the same edge type or the same edge type group is a common element. An edge type group is a pre-divided group into which some edges of similar types are grouped together. For example, guarantee and joint investment are two different edge types, but in fact, both are jointly and severally liable in law, and there is not much difference in the sense of legal liability, so they are divided into the common interest group. The mapping relationship table between edge types and edge type groups is set in advance, and the mapping relationship table can be searched to obtain the edge type group to which the edge type belongs.

[0086]

[0087] Table 3

[0088] As shown in Table 3, if the types of edges 1-3 are all guarantees, then the guarantee is the common element; if the types of edges 1-2 are guarantees and the type of edge 3 is joint investment, then the common interest is the common element; if the types of edges 1-3 are guarantees, loans, and joint investment respectively, then there is no common element.

[0089] If the element is an edge attribute, the common element is determined as follows: for the directed edge in the shared sub-topology, if the specific non-numerical edge attribute of the directed edge in the multiple relationship network topologies that have been determined to be risky is the same, or the specific numerical edge attribute belongs to the same attribute value range, then the same non-numerical edge attribute or the same attribute value range is a common element. Non-numerical edge attributes refer to edge attributes that are not expressed numerically, such as the guaranteed region. Numerical node attributes refer to edge attributes expressed numerically, such as the guaranteed amount. For non-numerical edge attributes, they need to be exactly the same to be considered the same, but for numerical edge attributes, that is, as long as they are within the same range, the properties may be the same, and it can be considered that there is little difference, and the same attribute value range is the common element. Taking the guaranteed amount as an example, a guaranteed amount below 10,000 yuan may be considered a micro guarantee, 10,000-100,000 yuan may be considered a small guarantee, 100,000-1 million yuan may be considered a medium guarantee, and more than 1 million yuan may be considered a large guarantee. Guarantees of 350,000 yuan and 480,000 yuan are considered to be of the same nature, and 100,000-1 million yuan can be used as a common element. The attribute value range is set in advance, and the preset attribute value range can be searched to obtain the attribute value range to which the edge node attribute belongs.

[0090]

[0091] Table 4

[0092] As shown in Table 4, if the attribute of the guarantee amount of edges 1-3 is all 350,000 yuan, then 210,000-1,000,000 yuan is the common element; if the guarantee amounts of edges 1-3 are 350,000, 680,000, and 530,000 yuan respectively, then 210,000-1,000,000 yuan is the common element; if the guarantee amounts of edges 1-3 are 350,000, 1,380,000 yuan, and 750,000 yuan respectively, then there is no common element.

[0093] If a portion of the elements of the nodes and directed edges between nodes are considered when extracting the shared sub-topology in step 320, the commonality of the portion of the elements has been considered in step 320. In this step, only the common elements of the remaining elements other than the portion of the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be risky need to be added to the nodes or directed edges in the shared sub-topology. Figure 5CThe common sub-topology shown in the figure takes into account the commonality of node types when generating the common sub-topology. In this step, only the remaining elements such as node attributes, edge types, and edge attributes need to be considered. Figure 5A The common sub-topology shown in the figure takes into account the commonality of node types when generating the common sub-topology. In this step, only the remaining elements such as node attributes, edge types, and edge attributes need to be considered. Fig. 7A The common sub-topology shown takes into account the commonality of node types and edge types when generating the common sub-topology. Therefore, this step only needs to consider the remaining elements such as node attributes and edge attributes.

[0094] for Figure 3A The common sub-topology of , examines the requirements of each node and edge. Figure 3A The elements of nodes and edges are as follows Figure 3B As shown. The node type of node BC is bank, and the node type of node D is credit union. They all belong to the group of financial units. On the basis of 3A, "financial unit" is added to each node. For the node geographical attributes, the geographical attributes of node BD are Beijing, Beijing, and Shenzhen respectively. There are no common elements, so they are not added. For the edge type, the edge types of the three directed edges are all guarantees. Add "guarantee" to each edge. For the attribute of guarantee amount, the guarantee amounts of edges DB, BC, and CD are 200,000, 250,000, and 400,000 respectively. Add 100,000 to 1 million yuan to each edge. Finally, it is generated. Figure 3C The risk pattern sub-topology.

[0095] for Figure 5A The common sub-topology of each node and edge is as follows Figure 5B As shown. Figure 5A When creating the shared sub-topology, the node type factor has been considered. Here, we only need to consider the remaining factors such as node attributes, edge types, and edge attributes. For the node geographical attributes, the geographical attributes of node BD are Beijing, Beijing, and Shenzhen respectively. There are no common elements, so they are not added. For the edge type, the edge types of edges DB and BC are both guarantees, and the edge type of edge CD is joint investment, which belongs to the "common interests" group. Add "common interests" to each edge. For the edge attribute of the guarantee amount, the guarantee amounts of edges DB, BC, and CD are 200,000, 250,000, and 400,000 respectively, which are all in the range of 100,000 to 1 million yuan. Add "100,000 to 1 million yuan" to each edge. Finally, it is generated. Figure 5C The risk pattern sub-topology.

[0096] for Fig. 7A The common sub-topology of each node and edge is as follows Figure 7B As shown. Fig. 7AWhen we were creating the shared sub-topology, we already considered the node type and edge type elements. Here, we only need to consider the remaining elements such as node attributes and edge attributes. For the node geographical attributes, the geographical attributes of node BD are Beijing, Beijing, and Shenzhen. There are no common elements, so they are not added. For the edge attribute of guarantee amount, the guarantee amounts of edges DB, BC, and CD are 200,000, 250,000, and 400,000 respectively, all of which are in the range of 100,000 to 1 million yuan. Add "100,000 to 1 million yuan" to each edge. Finally, we generated Figure 7C The risk pattern sub-topology.

[0097] Then, enter step 350, and adjust the risk model sub-topology based on the adjustment instruction input by the user. This step can be omitted. The significance of this step is that the risk model sub-topology derived entirely by the machine may have blind spots. For example, the setting of the predetermined sub-topology rules may not cover all situations, and inaccuracies may occur in some cases. For example, some non-dangerous node relationships are still attributed to the risk model sub-topology. At this time, people need to manually adjust the risk model sub-topology generated by the machine. This step can further increase the accuracy of risk determination.

[0098] exist Figure 1 In the illustrated system architecture, the administrator can sit in front of one of the query terminals 140, and the risk model sub-topology generated in step 340 is displayed on the query terminal 140. The administrator inputs an adjustment instruction on the interface to generate an adjustment command. After receiving the adjustment instruction sent by the query terminal 140 through the network 130, the server 110 adjusts the risk model sub-topology.

[0099] Then, in step 360, if the to-be-determined relationship network topology contains the risk pattern sub-topology, the to-be-determined relationship network topology is determined to be risky.

[0100] The relationship network topology to be determined contains the risk model sub-topology, which means that the relationship network topology to be determined contains not only all nodes and edges of the risk model sub-topology, but also the common elements in the risk model sub-topology. Figure 3C For example, the relationship network topology to be determined needs to contain three nodes: B, C, and D. Among them, node D guarantees node B, with an amount between 100,000 and 1 million; node B guarantees node C, with an amount between 100,000 and 1 million; node C guarantees node D, with an amount between 100,000 and 1 million. Only when all of these are met, the relationship network topology to be determined is considered to contain the risk mode sub-topology, and the relationship network topology to be determined is determined to be risky.

[0101] The relationship network topology to be determined is the relationship network topology that needs to be determined whether it has risks. Figure 1In the system architecture, it is input or selected by the user at the query terminal 140 and transmitted to the server 110 via the network 130. After the server 110 generates the determination result, it is transmitted to the query terminal 140 via the network 130 for display.

[0102] In another embodiment of the present invention, instead of extracting common sub-topologies for all relationship network topologies that have been determined to be risky, the relationship network topologies of different risk types (such as money laundering, fraud, and wool-pulling) are put together to extract common sub-topologies. The advantage of this is that the risk patterns of relationship network topologies of a certain risk type are often similar. Extracting common sub-topologies from the same type of relationship network topology can better reflect the inherent rules of this type of relationship network topology. Compared with extracting all risk relationship networks together, the extracted common sub-topologies are more in line with objective reality and the risk determination is more accurate.

[0103] In this embodiment, after step 310, the method further includes: obtaining risk types of the plurality of relationship network topologies that have been determined to be risks.

[0104] In one embodiment, step 310 may be implemented by receiving a user's input of the risk types of the plurality of relationship network topologies that have been determined to be risky. Figure 1 In the system architecture, the administrator user can be in front of one of the query terminals 140. The server 100 sends the multiple relationship network topologies that have been determined to be risks to the query terminal 140 through the network 130 and displays them to the administrator user. The administrator user enters the risk type determined on the interface, which is sent back to the server 110 via the network 130.

[0105] In this embodiment, step 320 includes: extracting the common sub-topology in the relationship network topology that has been determined as a risk in the specific risk type. That is, step 320 extracts the common sub-topology for each specific risk type's relationship network topology that has been determined as a risk, so that each risk type will generate a common sub-topology.

[0106] In this embodiment, step 330 includes: if the shared sub-topology does not conform to the predetermined sub-topology rule corresponding to the specific risk type, the shared sub-topology is discarded. That is, as the risk type is different, its predetermined sub-topology rule may also be different. For each risk type, a corresponding sub-topology rule is set respectively. In this way, when determining whether to discard the shared sub-topology, it is judged whether the shared sub-topology conforms to the predetermined sub-topology rule corresponding to this specific risk type, rather than using a general predetermined sub-topology rule for judgment, so that the established risk model topology better reflects the characteristics of this risk type, and the risk judgment is more accurate.

[0107] In this embodiment, step 340 includes: for the nodes or directed edges in the shared sub-topology, add the common elements of the nodes or directed edges in the relationship network topology that has been determined as a risk in the specific risk type, and use the added shared sub-topology as the risk model sub-topology of the specific risk type. That is to say, when adding common elements, the common sub-topology of each risk type is added, and the common elements of the nodes or directed edges in the relationship network topology that has been determined as a risk in the specific risk type are added, thereby improving the pertinence of the established risk model topology.

[0108] In this embodiment, in step 350, the risk model topology is adjusted based on the adjustment instruction input by the user, and this is also done for each risk type. For each risk type, the risk model topology of the corresponding type is adjusted based on the adjustment instruction input by the user for the risk type.

[0109] In this embodiment, after steps 310-350, a risk pattern sub-topology is formed for each risk type. In step 360, the relationship network topology to be determined is compared with the risk pattern sub-topology of each risk type. If the relationship network topology to be determined contains a risk pattern sub-topology of one of the risk types, it is proved that there is a risk therein, and the relationship network topology to be determined is determined to be a risk.

[0110] like Fig.10 As shown, according to one embodiment of the present invention, a risk determination device for a relationship network topology is provided. Figure 1 In the architecture of FIG. 1 , it is equivalent to the server 110. In other architectures, it has other forms of expression. For example, in the case of a single machine, it can be the single machine itself.

[0111] like Fig.10 As shown, the risk determination device of the relationship network topology includes:

[0112] The risk relationship network topology acquisition unit 410 is used to acquire a plurality of relationship network topologies that have been determined to be risky, wherein the relationship network topology is a connected graph consisting of nodes and directed edges between nodes;

[0113] A common sub-topology extraction unit 420, configured to extract common sub-topologies from the plurality of relationship network topologies that have been determined to be risky;

[0114] The risk pattern topology generating unit 440 is used to add the common elements of the nodes or directed edges in the plurality of relationship network topologies that have been determined to be risky to the nodes or directed edges in the shared sub-topology, and use the added shared sub-topology as the risk pattern sub-topology;

[0115] The risk determination unit 460 is configured to determine that the relationship network topology to be determined is risky if the relationship network topology to be determined contains the risk mode sub-topology.

[0116] In one embodiment, the element is at least one element selected from the group consisting of: node type, node attribute, edge type, and edge attribute.

[0117] In one embodiment, the shared sub-topology includes a connected graph consisting of shared nodes and directed edges between nodes in the plurality of relationship network topologies determined to be risky.

[0118] In one embodiment, the shared sub-topology includes a connected graph consisting of shared nodes and directed edges between nodes in the multiple relationship network topologies that have been determined to be at risk, and in the multiple relationship network topologies that have been determined to be at risk, some elements of these shared nodes and directed edges between nodes are also shared; the risk pattern topology generation unit 440 is further used to: for the nodes or directed edges in the shared sub-topology, add the common elements among the remaining elements other than the part of the common elements of the node or directed edge in the multiple relationship network topologies that have been determined to be at risk.

[0119] In one embodiment, the device further comprises: a sub-topology rule determination unit 430, which is used to

[0120] After extracting the common sub-topologies from the plurality of relationship network topologies that have been determined to be risky, if the common sub-topologies do not conform to a predetermined sub-topology rule, the common sub-topologies are discarded.

[0121] In one embodiment, the device also includes: a risk type acquisition unit (not shown), which is used to obtain the risk types of multiple relationship network topologies that have been determined to be risks after obtaining multiple relationship network topologies that have been determined to be risks; the common sub-topology extraction unit 420 is further used to: extract the common sub-topology in the relationship network topology that has been determined to be a risk in a specific risk type; the risk pattern sub-topology generation unit is further used to: for the nodes or directed edges in the common sub-topology, add the common elements of the nodes or directed edges in the relationship network topology that has been determined to be a risk in the specific risk type, and the added common sub-topology is used as the risk pattern sub-topology of the specific risk type.

[0122] In an embodiment, the sub-topology rule determination unit 430 is further configured to: if the shared sub-topology does not comply with a predetermined sub-topology rule corresponding to the specific risk type, discard the shared sub-topology.

[0123] In one embodiment, the risk determination unit 460 is further used to: compare the relationship network topology to be determined with the risk pattern sub-topology of each risk type; if the relationship network topology to be determined contains a risk pattern sub-topology of one of the risk types, the relationship network topology to be determined is determined to be a risk.

[0124] In one embodiment, if the element is a node type, the common element is determined as follows: for a node in the common sub-topology, if the node type of the node in the multiple relationship network topologies that have been determined to be at risk is the same, or the node type belongs to the same node type group, then the same node type or the same node type group is a common element.

[0125] In one embodiment, if the element is a node attribute, the common element is determined as follows: for a node in the common sub-topology, if the specific non-numeric node attributes of the node in the multiple relationship network topologies that have been determined to be at risk are the same, or the specific numeric node attributes belong to the same attribute value range, then the same non-numeric node attribute or the same attribute value range is a common element.

[0126] In one embodiment, if the element is an edge type, the common element is determined as follows: for a directed edge in the common sub-topology, if the edge type of the directed edge in the multiple relationship network topologies that have been determined to be at risk is the same, or the edge type belongs to the same edge type group, then the same edge type or the same edge type group is a common element.

[0127] In one embodiment, if the element is an edge attribute, the common element is determined as follows: for a directed edge in the common sub-topology, if the specific non-numeric edge attributes of the directed edge in the multiple relationship network topologies that have been determined to be at risk are the same, or the specific numerical edge attributes belong to the same attribute value range, then the same non-numeric edge attribute or the same attribute value range is a common element.

[0128] In one embodiment, the device also includes: an adjustment unit 450, which is used to add the common elements of the node or directed edge in the multiple relationship network topologies that have been determined to be risky to the node or directed edge in the common sub-topology, and after the added common sub-topology is used as the risk mode sub-topology, the risk mode sub-topology is adjusted based on the adjustment instructions input by the user.

[0129] Refer to the following Fig.11 Detailed description of the hardware structure of the risk determination device 110 for the relationship network topology according to the embodiment of the present disclosure. Fig.11 The risk determination device 110 of the displayed relationship network topology is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0130] like Fig.11 As shown, the risk determination device 110 of the relationship network topology is presented in the form of a general computing device. The components of the risk determination device 110 of the relationship network topology may include but are not limited to: the at least one processing unit 810, the at least one storage unit 820, and a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810).

[0131] The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 performs the steps of various exemplary embodiments of the present invention described in the description of the exemplary method above. For example, the processing unit 810 can perform the following steps: Figure 8 The steps shown in .

[0132] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0133] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0134] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0135] The risk determination device 110 of the relational network topology may also communicate with one or more external devices 700 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the risk determination device 110 of the relational network topology, and / or communicate with any device that enables the risk determination device 110 of the relational network topology to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 850. In addition, the risk determination device 110 of the relational network topology may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 860. As shown in the figure, the network adapter 860 communicates with other modules of the risk determination device 110 of the relational network topology through a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the risk determination device 110 of the relational network topology, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0136] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0137] In an exemplary embodiment of the present disclosure, a computer program medium is further provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer is caused to execute the method described in the above method embodiment.

[0138] According to one embodiment of the present disclosure, a program product for implementing the method in the above method embodiment is also provided, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0139] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0140] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0141] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0142] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0143] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0144] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0145] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0146] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. An information processing method, characterized in that: include: For any one of the different risk types, a plurality of relationship network topologies corresponding to the risk type and having been determined to be risks are obtained, wherein the relationship network topology is a connected graph consisting of nodes and directed edges between nodes; the relationship network topology is formed based on the relationship behavior data between entities stored in a database, by drawing entities as nodes and drawing the relationship behaviors between entities as directed edges between nodes; the entities include enterprises; the relationship behaviors between entities include the relationships between enterprises; Extracting a common sub-topology from the plurality of relationship network topologies that have been determined to be risky, wherein the common sub-topology includes a connected graph consisting of common nodes and directed edges between nodes in the plurality of relationship network topologies that have been determined to be risky; For the nodes or directed edges in the shared sub-topology, add the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk, and use the added shared sub-topology as the risk pattern sub-topology to obtain the risk pattern sub-topology corresponding to each risk type; wherein the common elements refer to the elements that are the same among the multiple relationship network topologies that have been determined to be at risk; and the elements are at least one element selected from the following element group: node type, node attribute, edge type and edge attribute; If the relationship network topology to be determined contains a risk pattern sub-topology of one of the risk types, the relationship network topology to be determined is determined to be a risk.

2. The method according to claim 1, characterized in that: In the plurality of relationship network topologies determined to be risky, some elements of the shared nodes and directed edges between the nodes are also shared; The adding, for the nodes or directed edges in the common sub-topology, common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk, includes: for the nodes or directed edges in the common sub-topology, adding common elements among the remaining elements other than a part of the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk.

3. The method according to claim 1, characterized in that After extracting the common sub-topologies from the plurality of relationship network topologies that have been determined to be risky, the method includes: If the shared sub-topology does not comply with a predetermined sub-topology rule, the shared sub-topology is discarded.

4. The method according to claim 1, characterized in that: After obtaining a plurality of relationship network topologies that have been determined to be risky, the method further includes: obtaining risk types of the plurality of relationship network topologies that have been determined to be risky; The extracting the common sub-topologies in the plurality of relationship network topologies that have been determined to be risks comprises: extracting the common sub-topologies in the relationship network topologies that have been determined to be risks in a specific risk type; The method of adding the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be risks to the nodes or directed edges in the common sub-topology, and using the added common sub-topology as the risk pattern sub-topology, includes: adding the common elements of the nodes or directed edges in the relationship network topologies that have been determined to be risks in the specific risk type to the nodes or directed edges in the common sub-topology, and using the added common sub-topology as the risk pattern sub-topology of the specific risk type.

5. The method according to claim 4, characterized in that After extracting the common sub-topologies in the relationship network topology determined as risks in the specific risk type, the method further includes: If the shared sub-topology does not comply with a predetermined sub-topology rule corresponding to the specific risk type, the shared sub-topology is discarded.

6. The method according to claim 5, characterized in that If the to-be-determined relationship network topology contains the risk mode sub-topology, determining that the to-be-determined relationship network topology is risky includes: The relationship network topology to be determined is compared with the risk pattern sub-topology of each risk type. If the relationship network topology to be determined contains the risk pattern sub-topology of one of the risk types, the relationship network topology to be determined is determined to be a risk.

7. The method according to claim 1, characterized in that If the element is a node type, the common element is determined as follows: for a node in the common sub-topology, if the node type of the node in the multiple relationship network topologies that have been determined to be at risk is the same, or the node type belongs to the same node type group, then the same node type or the same node type group is a common element.

8. The method according to claim 1, characterized in that If the element is a node attribute, the common element is determined as follows: for a node in the common sub-topology, if the specific non-numeric node attributes of the node in the multiple relationship network topologies that have been determined to be at risk are the same, or the specific numeric node attributes belong to the same attribute value range, then the same non-numeric node attribute or the same attribute value range is a common element.

9. The method according to claim 1, characterized in that: If the element is an edge type, the common element is determined as follows: for a directed edge in the common sub-topology, if the edge type of the directed edge in the multiple relationship network topologies that have been determined to be at risk is the same, or the edge type belongs to the same edge type group, then the same edge type or the same edge type group is a common element.

10. The method according to claim 1, characterized in that If the element is an edge attribute, the common element is determined as follows: for a directed edge in the common sub-topology, if the specific non-numeric edge attributes of the directed edge in the multiple relationship network topologies that have been determined to be at risk are the same, or the specific numerical edge attributes belong to the same attribute value range, then the same non-numeric edge attribute or the same attribute value range is a common element.

11. The method according to claim 1, characterized in that: After adding the common elements of the node or directed edge in the multiple relationship network topologies that have been determined to be risky to the node or directed edge in the common sub-topology, and using the added common sub-topology as the risk mode sub-topology, the method further includes: adjusting the risk mode sub-topology based on an adjustment instruction input by a user.

12. A risk determination device for a relational network topology, characterized in that: include: processor; A memory storing a computer executable code, wherein the computer executable code is called by the processor to execute: For any one of the different risk types, a plurality of relationship network topologies corresponding to the risk type and having been determined to be risks are obtained, wherein the relationship network topology is a connected graph consisting of nodes and directed edges between nodes; the relationship network topology is formed based on the relationship behavior data between entities stored in a database, by drawing entities as nodes and drawing the relationship behaviors between entities as directed edges between nodes; the entities include enterprises; the relationship behaviors between entities include the relationships between enterprises; Extracting a common sub-topology from the plurality of relationship network topologies that have been determined to be risky, wherein the common sub-topology includes a connected graph consisting of common nodes and directed edges between nodes in the plurality of relationship network topologies that have been determined to be risky; For the nodes or directed edges in the shared sub-topology, add the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk, and use the added shared sub-topology as the risk pattern sub-topology to obtain the risk pattern sub-topology corresponding to each risk type; wherein the common elements refer to the elements that are the same among the multiple relationship network topologies that have been determined to be at risk; and the elements are at least one element selected from the following element group: node type, node attribute, edge type and edge attribute; If the relationship network topology to be determined contains a risk pattern sub-topology of one of the risk types, the relationship network topology to be determined is determined to be a risk.

13. The device according to claim 12, characterized in that In the plurality of relationship network topologies determined to be risky, some elements of the shared nodes and directed edges between the nodes are also shared; The adding, for the nodes or directed edges in the common sub-topology, common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk, includes: for the nodes or directed edges in the common sub-topology, adding common elements among the remaining elements other than a part of the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk.

14. The device according to claim 12, characterized in that The computer executable code is called by the processor to execute: after extracting the common sub-topologies from the plurality of relationship network topologies determined to be at risk, if the common sub-topologies do not comply with a predetermined sub-topology rule, discarding the common sub-topologies.

15. The device according to claim 12, characterized in that The computer executable code is called by the processor to execute: for the nodes or directed edges in the common sub-topology, add the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be risky, and after the added common sub-topology is used as the risk mode sub-topology, adjust the risk mode sub-topology based on the adjustment instructions input by the user.

16. A computer readable medium, characterized in that The computer readable medium stores computer instructions executable by a terminal device, and when the computer instructions are executed, the following are implemented: For any one of the different risk types, a plurality of relationship network topologies corresponding to the risk type and having been determined to be risks are obtained, wherein the relationship network topology is a connected graph consisting of nodes and directed edges between nodes; the relationship network topology is formed based on the relationship behavior data between entities stored in a database, by drawing entities as nodes and drawing the relationship behaviors between entities as directed edges between nodes; the entities include enterprises; the relationship behaviors between entities include the relationships between enterprises; Extracting a common sub-topology from the plurality of relationship network topologies that have been determined to be risky, wherein the common sub-topology includes a connected graph consisting of common nodes and directed edges between nodes in the plurality of relationship network topologies that have been determined to be risky; For the nodes or directed edges in the shared sub-topology, add the common elements of the nodes or directed edges in the multiple relationship network topologies that have been determined to be at risk, and use the added shared sub-topology as the risk pattern sub-topology to obtain the risk pattern sub-topology corresponding to each risk type; wherein the common elements refer to the elements that are the same among the multiple relationship network topologies that have been determined to be at risk; and the elements are at least one element selected from the following element group: node type, node attribute, edge type and edge attribute; If the relationship network topology to be determined contains a risk pattern sub-topology of one of the risk types, the relationship network topology to be determined is determined to be a risk.

Images