Community-based risk monitoring method, device and equipment and storage medium

Abstract

The present application relates to the field of data analysis, and discloses a community-based risk monitoring method, device, equipment and storage medium.The method comprises: acquiring a user information node set, dividing the user information node set into N community node sets, and performing value assignment processing on community nodes in the N community node sets to obtain N node value assignment sets, wherein N is a positive integer;performing community screening processing on the N community node sets according to corresponding parameter data of the N node value assignment sets to obtain M screened community node sets, wherein M is a positive integer not greater than N;receiving an exception instruction, the exception instruction being used to determine an abnormal node group in the M screened community node sets;and performing comparison processing on a single node in M-1 non-designated screened community node sets and the abnormal node group in turn to obtain a risk node set.

Description

Technical Field

[0001] The present invention relates to the field of data analysis, and in particular to a community-based risk monitoring method, device, equipment and storage medium. Background Art

[0002] Using historical fraud cases to identify fraudulent activity is a mature anti-fraud technique and tool. This approach is primarily based on the experience and lessons learned by anti-fraud strategists, who analyze the characteristics and actions of historically fraudulent users to develop anti-fraud rules. When a user's action request or behavior triggers an anti-fraud rule, it is identified as fraudulent and interception is initiated. Anti-fraud rules are primarily based on factors such as behavioral aggregation.

[0003] Although this technology for detecting fraud based on historical cases is relatively simple to implement and has strong interpretability, it also has obvious flaws, as follows:

[0004] Relevant experts can only correlate and analyze existing fraud incidents and use scalars in one or several dimensions for calculation and identification. There is no way to cover all factors and the complex internal relationships between factors, so this technology often has false positives or omissions.

[0005] Therefore, existing technologies cannot accurately find fraudulent and suspicious accounts, and a new technology is needed to solve the difficulties of current community anti-fraud detection. Summary of the Invention

[0006] The main purpose of the present invention is to solve the technical problem that the existing technology cannot accurately find fraudulent suspicious accounts.

[0007] A first aspect of the present invention provides a community-based risk monitoring method, comprising the steps of:

[0008] Obtaining a user information node set, dividing the user information node set into N community node sets, and performing value assignment processing on the community nodes in the N community node sets to obtain N node value assignment sets, where N is a positive integer;

[0009] Performing community screening on the N community node sets according to the parameter data corresponding to the N node value sets to obtain M screened community node sets, where M is a positive integer not greater than N;

[0010] receiving an abnormal instruction, wherein the abnormal instruction is used to determine an abnormal node group in the M screening community node sets;

[0011] The individual nodes in the non-specified M-1 screening community node sets are sequentially compared with the abnormal node group to obtain a risk node set.

[0012] Optionally, in a first implementation of the first aspect of the present invention,

[0013] The risk node set obtained by sequentially comparing a single node in the non-specified M-1 screening community node set with the abnormal node group includes:

[0014] Target any community node A in the set of non-specified M-1 screening community nodes;

[0015] According to the formula , calculate the association degree between community node A and abnormal node group, where F(A) is the association degree between community node A and abnormal node group, s is the damping coefficient, T1, T2, ..., T n is a node in the abnormal node group, C(T i ) is T i Node and non-T i The total number of links to a node, P(T i ) is T i The total number of links between the node and community node A;

[0016] Determining whether the correlation degree is greater than a preset correlation threshold;

[0017] If it is greater than the association threshold, the community node A is determined to be a risk node.

[0018] Optionally, in a second implementation of the first aspect of the present invention,

[0019] The obtaining of the user information node set and dividing the user information node set into N community node sets includes:

[0020] Obtaining a user information node set, and writing the user information node set into a preset undirected and unweighted graph to obtain a first undirected and unweighted graph;

[0021] Analyzing, according to a preset clustering algorithm, the number of triangular nodes constituting the first undirected unweighted graph, and splitting the first undirected unweighted graph based on the number of triangular nodes constituting the first undirected unweighted graph to obtain X second undirected unweighted graphs, where X is a positive integer and is greater than or equal to N;

[0022] The user information set is divided into X first community node sets based on the X second undirected unweighted graphs, and community screening is performed on the X first community node sets to obtain the N community node sets.

[0023] Optionally, in a third implementation of the first aspect of the present invention, performing community screening on the X first community node sets to obtain the N community node sets includes:

[0024] For each of the first community node sets, determining whether the number of nodes in the first community node set exceeds a preset community screening threshold;

[0025] If the preset community screening threshold is exceeded, obtaining a second undirected unweighted graph corresponding to the first community node set;

[0026] Calculate the Euclidean distance between any two community nodes in the second undirected unweighted graph based on the Euclidean distance algorithm, and select nodes with Euclidean distances less than a preset distance threshold as the second community node set;

[0027] Performing partition marking on the second community node set;

[0028] If the community screening threshold is not exceeded, the divided marking is performed on the first community node set; all first community node sets marked as divided and second community node sets marked as divided are acquired to obtain N community node sets.

[0029] Optionally, in a fourth implementation of the first aspect of the present invention, performing value assignment processing on the community nodes in the N community node sets to obtain N node value assignment sets includes:

[0030] Reading a community node in the community node set, and analyzing i information dimensions corresponding to the community node, where i is a positive integer;

[0031] According to the preset dimension assignment table, the i information dimensions are assigned a value query process to obtain the total assigned score of the i information dimensions;

[0032] The total assigned points are determined as the node assignment of the community node.

[0033] Optionally, in a fifth implementation of the first aspect of the present invention, performing community screening on the N community node sets based on the parameter data corresponding to the N node value sets to obtain the M screened community node sets includes:

[0034] Determining whether the number of nodes in the community node set exceeds a preset size threshold;

[0035] If the size exceeds the preset threshold, then the assignment average corresponding to the community node set is calculated based on the node assignment set corresponding to the community node set, and it is determined whether the assignment average is greater than the preset average threshold;

[0036] If it is greater than the preset average sharing threshold, the community node set is determined as the screening community node set;

[0037] If the preset scale threshold is not exceeded, the node value set corresponding to the community node set is queried, and the j information dimensions among the i information dimensions corresponding to the node values ​​in the node value set are extracted. According to the dimension value table, the total score values ​​corresponding to the j information dimensions are queried and calculated, where j is a positive integer not greater than i;

[0038] Determine whether there is an element in the total score assignment set that is not less than a preset total score threshold;

[0039] If there is an element whose total score is not less than the preset total score threshold, the community node set is determined as the screening community node set.

[0040] Optionally, in a sixth implementation of the first aspect of the present invention, after receiving an abnormal instruction, wherein the abnormal instruction is used to determine an abnormal node group in the M screening community node sets, and before sequentially comparing a single node in the non-designated M-1 screening community node sets with the abnormal node group to obtain a risk node set, the method further includes:

[0041] Determine whether the number of nodes in the abnormal node group exceeds a preset numerical threshold;

[0042] If the value does not exceed the threshold, the abnormal node group is re-determined as the screening community node set.

[0043] A second aspect of the present invention provides a community-based risk monitoring device, the community-based risk monitoring device comprising:

[0044] An acquisition and assignment module, configured to acquire a user information node set, divide the user information node set into N community node sets, and perform assignment processing on the community nodes in the N community node sets to obtain N node assignment sets, where N is a positive integer;

[0045] A community screening module, configured to perform community screening on the N community node sets according to the parameter data corresponding to the N node value sets, to obtain M screened community node sets, where M is a positive integer not greater than N;

[0046] a designated determination module, configured to receive an abnormal instruction, wherein the abnormal instruction is used to determine an abnormal node group in the M screening community node sets;

[0047] The risk association module is used to sequentially compare a single node in the non-specified M-1 screening community node set with the abnormal node group to obtain a risk node set.

[0048] A third aspect of the present invention provides a community-based risk monitoring device, comprising: a memory and at least one processor, wherein instructions are stored in the memory, and the memory and the at least one processor are interconnected via a line; the at least one processor calls the instructions in the memory so that the community-based risk monitoring device executes the above-mentioned community-based risk monitoring method.

[0049] A fourth aspect of the present invention provides a computer-readable storage medium having instructions stored therein, which, when executed on a computer, enables the computer to execute the above-mentioned community-based risk monitoring method.

[0050] In this embodiment, a graph-related algorithm is used to mine association information between nodes. These two approaches enable more comprehensive and accurate identification of fraudulent groups and users. The detection results of this technology are shared with relevant experts, resolving the technical issue of existing technologies that still prevent them from accurately identifying suspicious fraudulent accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a schematic diagram of an embodiment of a community-based risk monitoring method in an embodiment of the present invention;

[0052] Figure 2 A schematic diagram of community association division in a community-based risk monitoring method according to an embodiment of the present invention;

[0053] Figure 3 This is a schematic diagram of an embodiment of a community-based risk monitoring device in an embodiment of the present invention;

[0054] Figure 4 This is a schematic diagram of another embodiment of a community-based risk monitoring device according to an embodiment of the present invention;

[0055] Figure 5 Schematic diagram of an embodiment of a community-based risk monitoring device in an embodiment of the present invention. DETAILED DESCRIPTION

[0056] Embodiments of the present invention provide a community-based risk monitoring method, apparatus, device, and storage medium.

[0057] The terms "first," "second," "third," "fourth," and so on (if any) in the description and claims of the present invention and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that shown or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, product, or apparatus.

[0058] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 An embodiment of a community-based risk monitoring method in an embodiment of the present invention includes:

[0059] 101. Obtain a user information node set, divide the user information node set into N community node sets, and perform value assignment processing on the community nodes in the N community node sets to obtain N node value assignment sets, where N is a positive integer;

[0060] In this embodiment, the user information node is an abstract point of user information, which includes user device, user payment account, user GPS+ (GPS address appears within 7 days), user login IP+ time window, user registration IP address, user registered mobile phone number, and all information is combined on the user information. According to the association between user device, user payment account, user GPS+ (GPS address appears within 7 days), user login IP+ time window, user registration IP address, and user registered mobile phone number, user information is divided into different communities. The division process can be to select any point in the graph to be divided, and then find out whether the point is associated with other points. If so, create a community for the two points, and then traverse from these two nodes as starting points to see if there is an association with other nodes. If so, divide the associated nodes into the same community, and continue the above operation until all nodes have been traversed. The original relationship graph is divided into several independent communities, and all nodes in the community are directly or indirectly related. For example, if Figure 2 As shown in the community association division diagram, there are four nodes ABCD, among which nodes AB are directly associated, and nodes CD are associated with each other. The algorithm divides AB into one community and CD into another community, and then traverses the four nodes ABCD in turn to see if there are other associations. If no other associations are found, the algorithm ends and outputs the division results of the two communities.

[0061] A community node set is taken out from N community node sets, and based on the user device, user payment account, user GPS+ (GPS address appears within 7 days), user login IP+ time window, user registered IP address, and user registered mobile phone number of the community node set, whether there are user shared devices, user shared payment accounts, user shared WiFi, user shared GPS+ (GPS address appears within 7 days), user shared login IP+ time window, user shared registered IP address, and user shared registered mobile phone numbers, the user shared devices, user shared payment accounts, user shared GPS+ (GPS address appears within 7 days), user shared login IP+ time window, user shared registered IP address, and user shared registered mobile phone numbers are assigned values. For example, if a user shares a device, a value of 2 is assigned to the user, a value of 2 is assigned to the user, a value of 1 is assigned to the user, and a value of 1 is assigned to the user sharing a Wi-Fi connection. If a user shares a GPS+ (GPS address appears within 7 days) with an interval of less than 12 hours, a value of 0.7 is assigned to the user, an interval of less than 24 hours, a value of 0.6 is assigned to the user, an interval of less than 48 hours, a value of 0.4 is assigned to the user, and an interval of more than 72 hours is assigned to the user. If a user shares a login IP+ time window with an interval of less than 3 hours, a value of 0.7 is assigned to the user, an interval of less than 6 hours, a value of 0.6 is assigned to the user, an interval of less than 9 hours, a value of 0.5 is assigned to the user, an interval of less than 12 hours, a value of 0.4 is assigned to the user, and an interval of more than 12 hours is assigned to the user. If a user shares a registered IP address with an interval of less than 24 hours, a value of 0.7 is assigned to the user, an interval of less than 48 hours, a value of 0.6 is assigned to the user, an interval of less than 72 hours, a value of 0.5 is assigned to the user, an interval of less than 96 hours, a value of 0.4 is assigned to the user, and an interval of more than 96 hours is assigned to the user.

[0062] Furthermore, the step of "obtaining a user information node set and dividing the user information node set into N community node sets" may perform the following steps:

[0063] 1011. Obtain a user information node set, and write the user information node set into a preset undirected and unweighted graph to obtain a first undirected and unweighted graph;

[0064] 1012. Analyze the number of triangular nodes in the first undirected unweighted graph according to a preset clustering algorithm, and split the first undirected unweighted graph based on the number of triangular nodes to obtain X second undirected unweighted graphs, where X is a positive integer and is greater than or equal to N.

[0065] 1013. Divide the user information set into X first community node sets based on the X second undirected unweighted graphs, and perform community screening on the X first community node sets to obtain the N community node sets.

[0066] In steps 1011-1013, the user information node set is written into an undirected unweighted graph G = (V, E), where V is a set divided into n parts: V1, V2, ..., V n , E is the total set of unitemized and unweighted graphs, s . t .∀( r 1, r 2,…, r n )∈ E ,∃ r 1∈ V 1, r 2∈ V 2,…, r n ∈ V n, r 1, r 2,…, r n For nodes from the total set of unweighted and unentered graphs, E, we mine interconnected communities by maximizing the metric. Since communities are composed of densely packed nodes, the probability of nodes forming triangles is high. For node x and community C, let t(x, C) be the number of triangles formed by x and nodes in C, and vt(x, C) be the number of nodes in C that can form triangles with x. Then, the degree of cohesion between x and community C is F(x, C). When t(x, C) = 0, F(x, C) = 0. When t(x, C) ≠ 0, F(x, C) = {t(x, C) / t(x, V)} * {vt(x, C) / (|C\{x}| + vt(x, V\C))}.

[0067] Then the cohesion of community C is F(C) = * , then F(C) is the average value of F(x, C) of all nodes in C. Given a partition graph P={C1, C2, ..., C n}, and C1∩C2∩…∩C n , then the condensation of P is the weighted average of all communities in the partition, and the expression of P is:

[0068] , where F(C i ) is C i The cohesion of the community.

[0069] Based on the calculation of condensation, the user undirected unweighted graph G = (V, E) is classified to obtain N community node sets.

[0070] Furthermore, in step 1012, the following steps may be performed:

[0071] 10121. For each of the first community node sets, determine whether the number of nodes in the first community node set exceeds a preset community screening threshold;

[0072] 10122. If the preset community screening threshold is exceeded, obtain a second undirected unweighted graph corresponding to the first community node set;

[0073] 10123. Calculate the Euclidean distance between any two community nodes in the second undirected unweighted graph based on the Euclidean distance algorithm, and select nodes with Euclidean distances less than a preset distance threshold as the second community node set;

[0074] 10124. Perform division marking on the second community node set;

[0075] 10125. If the number of nodes in the first community does not exceed the community screening threshold, perform the division marking on the first community node set;

[0076] 1026. Acquire all first community node sets marked as divided and second community node sets marked as divided, to obtain N community node sets.

[0077] In steps 10121-10126, a preliminary division is performed in step 10121. Since the community is composed of dense nodes, the probability of nodes forming a triangle is high. For node x and community C, set t(x, C) to the number of triangles formed by x and the nodes in C, and vt(x, C) to the number of nodes in C that can form a triangle with x. Then the condensation degree of x and community C is F(x, C). When t(x, C) = 0, F(x, C) = 0. When t(x, C) ≠ 0, F(x, C) = {t(x, C) / t(x, V)} * {vt(x, C) / (|C\{x}| + vt(x, V\C))}.

[0078] Among them, the cohesion of community C is F(C)= * , then F(C) is the average value of F(x, C) of all nodes in C. Given a partition graph P={C1, C2, ..., C n}, and community C = C1∩C2∩…∩C n , then the condensation of P is the weighted average of all communities in the partition, and the expression of P is:

[0079] , where F(C i ) is C i The cohesion of the community.

[0080] Based on the calculation of condensation, the user undirected unweighted graph G = (V, E) is classified to obtain a set of X community nodes.

[0081] Then, the number of nodes in each community node set is read, and then it is determined whether the number of nodes exceeds the re-division threshold. If it exceeds the re-division threshold, it means that the number of nodes in the first division is too large and further division is required. Based on the Euclidean distance algorithm:

[0082] d(x,y) = , where x and y are the two selected community nodes, d(x, y) is the Euclidean distance between x and y, and x1, x2, ..., x i is the parameter of the i-th dimension of the x node, y1, y2, ..., y i is the parameter for the i-th dimension of node y. If d(x, y) is less than the repartition distance, x and y are classified into the same category. Each node is partitioned by distance, and the subset is ultimately determined as a new community node set, which is marked as partitioned. If the number of nodes does not exceed the community screening threshold, it indicates that the number of nodes is not large and no further partitioning is required. The community node set is then determined as partitioned. Finally, the partitioned community node set is determined to be N community node sets.

[0083] Furthermore, the step of “performing value assignment processing on the community nodes in the N community node sets to obtain N node value assignment sets” may execute the following steps:

[0084] 1014. Read the community nodes in the community node set, and analyze i information dimensions corresponding to the community nodes, where i is a positive integer;

[0085] 1015. Perform assignment query processing on the i information dimensions according to the preset dimension assignment table to obtain the total assignment score of the i information dimensions;

[0086] 1016. Determine the total assigned score as the node assignment of the community node.

[0087] In steps 1014-1016, the information dimensions include seven dimensions: users sharing devices, users sharing payment accounts, users sharing WiFi, users sharing GPS+ (GPS address appears within 7 days), users sharing login IP+ time window, users sharing registered IP address, and users sharing registered mobile phone number. However, not all dimensions must be scored. You can choose to perform assignment calculations on four dimensions: users sharing devices, users sharing payment accounts, users sharing WiFi, and users sharing GPS+ (GPS address appears within 7 days). According to the assignment correspondence in the assignment table, the total assignment score of the four dimensions can be obtained.

[0088] 102. Perform community screening on the N community node sets according to the parameter data corresponding to the N node value sets to obtain M screened community node sets, where M is a positive integer not greater than N;

[0089] In this embodiment, N node value sets are calculated to obtain N node means, and it is determined whether the means are greater than a mean threshold. If so, the community node set corresponding to the node mean is determined as the screening community node set, and the sizes of the N node means are cyclically compared to screen out M screening community node sets from the N community node sets.

[0090] Furthermore, step 102 may perform the following steps:

[0091] 1021. Determine whether the number of nodes in the community node set exceeds a preset size threshold;

[0092] 1022. If the size exceeds the preset threshold, then based on the node assignment set corresponding to the community node set, calculate the assignment average corresponding to the community node set, and determine whether the assignment average is greater than the preset average threshold;

[0093] 1023. If it is greater than the preset average sharing threshold, the community node set is determined as the screening community node set;

[0094] 1024. If the preset scale threshold is not exceeded, the node value set corresponding to the community node set is queried, and the j information dimensions among the i information dimensions corresponding to the node values ​​in the node value set are extracted. According to the dimension value table, the total score values ​​corresponding to the j information dimensions are queried and calculated, where j is a positive integer not greater than i.

[0095] 1025. Determine whether there is an element in the total score assignment set that is not less than a preset total score threshold;

[0096] 1026. If there is an element with a total score not less than the preset threshold, the community node set is determined as the screening community node set.

[0097] In steps 1021-1026, it can be determined whether the number of nodes in the community node set is greater than 20. If it is greater than 20, the total number of weight assignments is divided by the number of community nodes to obtain the assignment average, and then it is determined whether the assignment average is greater than 2. If it is greater than 2, the community node set is determined to be a screening community node set.

[0098] When the number of nodes in the community node set is less than 20, the community nodes of the community node set are assigned and calculated in turn to obtain the total assigned score of each community node, and it is determined whether there is a node with a total assigned score of not less than 5 for each community node. If so, the community node set is determined to be the screening community node set.

[0099] Among them, in step 1024, among the seven dimensions of user shared devices, user shared payment accounts, user shared WiFi, user shared GPS+ (GPS address appears within 7 days), user shared login IP+time window, user shared registered IP address, and user shared registered mobile phone number, the three dimensions of user shared devices, user shared payment accounts, and user shared registered mobile phone numbers are extracted, and the total scores of user shared devices, user shared payment accounts, and user shared registered mobile phone numbers are calculated.

[0100] 103. Receive an abnormal instruction, where the abnormal instruction is used to determine an abnormal node group in the M screening community node sets;

[0101] In this embodiment, abnormal nodes are designated based on the category of the screening community. Abnormal nodes are designated in community groups, and all nodes in each community designated as abnormal are determined as abnormal node groups.

[0102] Preferably, between steps 103 and 104, there are the following steps:

[0103] 1031. Determine whether the number of nodes in the abnormal node group exceeds a preset numerical threshold;

[0104] 1032. If the numerical threshold is not exceeded, the abnormal node group is re-determined as a screening community node set.

[0105] In steps 1031-1032, there needs to be a certain amount of data in the abnormal node group as the overall comparison object, and it is necessary to determine whether the number of nodes in the abnormal node group is sufficient. The judgment method can compare the number of nodes with the set numerical threshold of 20. If the number of nodes exceeds 20, step 104 is performed. If the number of nodes does not exceed 20, the designation of the abnormal node group is reversed, and the abnormal node group is re-determined to be the screening community node set.

[0106] 104. Compare the individual nodes in the non-designated M-1 screening community node sets with the abnormal node group in sequence to obtain a risk node set.

[0107] In this example, a single designated node is required to be compared with the abnormal node group to determine whether the correlation between each node in the M-1 non-designated M-1 screening community node set and the abnormal node group is greater than the set threshold. If it is greater than the set threshold, the compared node and the entire abnormal node group are determined to be risky. If it is not greater than the set threshold, it is considered that there is no risk. The nodes in the non-designated M-1 screening community node set are traversed to obtain the risk node set.

[0108] Furthermore, at step 104 , the following steps may be performed:

[0109] 1041. Target any community node A in the set of non-specified M-1 screening community nodes;

[0110] 1042. According to the formula , calculate the association degree between community node A and abnormal node group, where F(A) is the association degree between community node A and abnormal node group, s is the damping coefficient, T1, T2, ..., T n is a node in the abnormal node group, C(T i ) is T i Node and non-T i The total number of links to a node, P(T i ) is T i The total number of links between the node and community node A;

[0111] 1043. Determine whether the correlation degree is greater than a preset correlation threshold;

[0112] 1044. If it is greater than the association threshold, the community node A is determined as a risk node.

[0113] In steps 1041-1044, a community node A is extracted from the non-specified M-1 screening community node set, and the formula , calculate the correlation between community node A and abnormal node group, where F(A) is the correlation between community node A and abnormal node group, s is the damping coefficient, T1, T2, ..., T n is a node in the abnormal node group, C(T i ) is T i The total number of links between the node and the outside world, P(T i ) is T i The total number of links between the node and node A. In this step, a community node A in the non-specified M-1 screening community node set is continuously extracted until all the non-specified M-1 screening community node sets are extracted to become an empty set.

[0114] After processing the correlation between a particular community node A and the entire community in the filtered community node set, determine whether the correlation is greater than the correlation threshold. For example, if the correlation is 1.2 and the correlation threshold is 0.8, then 1.2 is greater than 0.8, and the corresponding community node A is identified as a risk node. After looping through all nodes in the M-1 filtered community node sets, the risk node set is obtained.

[0115] After step 104, the following steps may be performed:

[0116] 105. Based on the xgboost model, the risk nodes in the risk node set are classified and processed to obtain the true risk node set.

[0117] The model ultimately outputs whether each node is a fraudulent node, which is a binary classification problem. In order to evaluate the performance of the model, a binary classifier is introduced, which divides the samples into the following four categories:

[0118] 1. True Positive (TP): samples that are actually positive and predicted as positive by the model

[0119] 2. False Positive (FP): Samples that are actually negative but are predicted as positive by the model

[0120] 3. True Negative (TN): samples that are actually negative and predicted as negative by the model

[0121] 4. False Negative (FN): Samples that are actually positive but are predicted as negative by the model

[0122] After training, the xgboost model classifies the risk node set and filters each node in the risk node set to obtain the true risk node set.

[0123] In this embodiment, a graph-related algorithm is used to mine association information between nodes. These two approaches enable more comprehensive and accurate identification of fraudulent groups and users. The detection results of this technology are shared with relevant experts, resolving the technical issue of existing technologies that still prevent them from accurately identifying suspicious fraudulent accounts.

[0124] The above describes the community-based risk monitoring method in the embodiment of the present invention. The following describes the community-based risk monitoring device in the embodiment of the present invention. Figure 3 In one embodiment of the present invention, a community-based risk monitoring device includes:

[0125] An acquisition and assignment module 301 is configured to acquire a user information node set, divide the user information node set into N community node sets, and perform assignment processing on the community nodes in the N community node sets to obtain N node assignment sets, where N is a positive integer;

[0126] A community screening module 302 is configured to perform community screening on the N community node sets based on the parameter data corresponding to the N node value sets to obtain M screened community node sets, where M is a positive integer not greater than N.

[0127] A designated determination module 303 is configured to receive an abnormal instruction, wherein the abnormal instruction is configured to determine an abnormal node group in the M screening community node sets;

[0128] The risk association module 304 is configured to sequentially compare individual nodes in the non-specified M-1 screening community node sets with the abnormal node group to obtain a risk node set.

[0129] In this embodiment, a graph-related algorithm is used to mine association information between nodes. These two approaches enable more comprehensive and accurate identification of fraudulent groups and users. The detection results of this technology are shared with relevant experts, resolving the technical issue of existing technologies that still prevent them from accurately identifying suspicious fraudulent accounts.

[0130] See also Figure 4 Another embodiment of the community-based risk monitoring device in the embodiment of the present invention includes:

[0131] An acquisition and assignment module 301 is configured to acquire a user information node set, divide the user information node set into N community node sets, and perform assignment processing on the community nodes in the N community node sets to obtain N node assignment sets, where N is a positive integer;

[0132] A community screening module 302 is configured to perform community screening on the N community node sets based on the parameter data corresponding to the N node value sets to obtain M screened community node sets, where M is a positive integer not greater than N.

[0133] A designated determination module 303 is configured to receive an abnormal instruction, wherein the abnormal instruction is configured to determine an abnormal node group in the M screening community node sets;

[0134] The risk association module 304 is configured to sequentially compare individual nodes in the non-specified M-1 screening community node sets with the abnormal node group to obtain a risk node set.

[0135] The risk association module 304 is specifically configured to:

[0136] Target any community node A in the set of non-specified M-1 screening community nodes;

[0137] According to the formula , calculate the association degree between community node A and abnormal node group, where F(A) is the association degree between community node A and abnormal node group, s is the damping coefficient, T1, T2, ..., T n is a node in the abnormal node group, C(T i ) is T i Node and non-T i The total number of links to a node, P(T i ) is T i The total number of links between the node and community node A;

[0138] Determining whether the correlation degree is greater than a preset correlation threshold;

[0139] If it is greater than the association threshold, the community node A is determined to be a risk node.

[0140] The acquisition and assignment module 301 is specifically used for:

[0141] Obtaining a user information node set, and writing the user information node set into a preset undirected and unweighted graph to obtain a first undirected and unweighted graph;

[0142] Analyzing, according to a preset clustering algorithm, the number of triangular nodes constituting the first undirected unweighted graph, and splitting the first undirected unweighted graph based on the number of triangular nodes constituting the first undirected unweighted graph to obtain X second undirected unweighted graphs, where X is a positive integer and is greater than or equal to N;

[0143] The user information set is divided into X first community node sets based on the X second undirected unweighted graphs, and community screening is performed on the X first community node sets to obtain the N community node sets.

[0144] The acquisition and assignment module 301 may also be specifically used for:

[0145] For each of the first community node sets, determining whether the number of nodes in the first community node set exceeds a preset community screening threshold;

[0146] If the preset community screening threshold is exceeded, obtaining a second undirected unweighted graph corresponding to the first community node set;

[0147] Calculate the Euclidean distance between any two community nodes in the second undirected unweighted graph based on the Euclidean distance algorithm, and select nodes with Euclidean distances less than a preset distance threshold as the second community node set;

[0148] Performing partition marking on the second community node set;

[0149] If the community screening threshold is not exceeded, performing the division marking on the first community node set;

[0150] All first community node sets marked as divided and second community node sets marked as divided are obtained to obtain N community node sets.

[0151] The acquisition and assignment module 301 may also be specifically used for:

[0152] Reading a community node in the community node set, and analyzing i information dimensions corresponding to the community node, where i is a positive integer;

[0153] According to the preset dimension assignment table, the i information dimensions are assigned a value query process to obtain the total assigned score of the i information dimensions;

[0154] The total assigned points are determined as the node assignment of the community node.

[0155] The community screening module 302 is specifically used to:

[0156] Determining whether the number of nodes in the community node set exceeds a preset size threshold;

[0157] If the size exceeds the preset threshold, then the assignment average corresponding to the community node set is calculated based on the node assignment set corresponding to the community node set, and it is determined whether the assignment average is greater than the preset average threshold;

[0158] If it is greater than the preset average sharing threshold, the community node set is determined as the screening community node set;

[0159] If the preset scale threshold is not exceeded, the node value set corresponding to the community node set is queried, and the j information dimensions among the i information dimensions corresponding to the node values ​​in the node value set are extracted. According to the dimension value table, the total score values ​​corresponding to the j information dimensions are queried and calculated, where j is a positive integer not greater than i;

[0160] Determine whether there is an element in the total score assignment set that is not less than a preset total score threshold;

[0161] If there is an element whose total score is not less than the preset total score threshold, the community node set is determined as the screening community node set.

[0162] The community-based risk monitoring device further includes a scale analysis module 305, which is specifically configured to:

[0163] Determine whether the number of nodes in the abnormal node group exceeds a preset numerical threshold;

[0164] If the value does not exceed the threshold, the abnormal node group is re-determined as the screening community node set.

[0165] In this embodiment, a graph-related algorithm is used to mine association information between nodes. These two approaches enable more comprehensive and accurate identification of fraudulent groups and users. The detection results of this technology are shared with relevant experts, resolving the technical issue of existing technologies that still prevent them from accurately identifying suspicious fraudulent accounts.

[0166] above Figure 3 and Figure 4The community-based risk monitoring apparatus in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The community-based risk monitoring device in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0167] Figure 5 Figure 5 is a schematic diagram of the structure of a community-based risk monitoring device provided by an embodiment of the present invention. This community-based risk monitoring device 500 may vary significantly depending on configuration or performance. It may include one or more central processing units (CPUs) 510 (e.g., one or more processors), memory 520, and one or more storage media 530 (e.g., one or more mass storage devices) storing applications 533 or data 532. The memory 520 and storage media 530 may be either transient or persistent storage. The program stored in the storage medium 530 may include one or more modules (not shown), each of which may include a series of instructions for operating on the community-based risk monitoring device 500. Furthermore, the processor 510 may be configured to communicate with the storage medium 530 to execute the series of instructions stored in the storage medium 530 on the community-based risk monitoring device 500.

[0168] The community-based risk monitoring device 500 may further include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input and output interfaces 560, and / or one or more operating systems 531, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. It will be understood by those skilled in the art that Figure 5 The illustrated structure of the community-based risk monitoring device does not limit the community-based risk monitoring device, and may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0169] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. The computer-readable storage medium stores instructions, which, when executed on a computer, cause the computer to execute the steps of the community-based risk monitoring method.

[0170] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0171] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0172] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A community-based risk monitoring method, characterized in that: Including steps: Obtaining a user information node set, dividing the user information node set into N community node sets, and performing value assignment processing on the community nodes in the N community node sets to obtain N node value assignment sets, where N is a positive integer; Performing community screening on the N community node sets according to the parameter data corresponding to the N node value sets to obtain M screened community node sets, where M is a positive integer not greater than N; receiving an abnormal instruction, wherein the abnormal instruction is used to determine an abnormal node group in the M screening community node sets; Sequentially compare individual nodes in the non-specified M-1 screening community node sets with the abnormal node group to obtain a risk node set; The step of obtaining a user information node set and dividing the user information node set into N community node sets includes: Obtaining a user information node set, and writing the user information node set into a preset undirected and unweighted graph to obtain a first undirected and unweighted graph; Analyzing, according to a preset clustering algorithm, the number of triangular nodes constituting the first undirected unweighted graph, and splitting the first undirected unweighted graph based on the number of triangular nodes constituting the first undirected unweighted graph to obtain X second undirected unweighted graphs, where X is a positive integer and is greater than or equal to N; Dividing the user information set into X first community node sets based on the X second undirected unweighted graphs, and performing community screening on the X first community node sets to obtain the N community node sets; The performing community screening on the X first community node sets to obtain the N community node sets includes: For each of the first community node sets, determining whether the number of nodes in the first community node set exceeds a preset community screening threshold; If the preset community screening threshold is exceeded, obtaining a second undirected unweighted graph corresponding to the first community node set; Calculate the Euclidean distance between any two community nodes in the second undirected unweighted graph based on the Euclidean distance algorithm, and select nodes with Euclidean distances less than a preset distance threshold as the second community node set; Performing partition marking on the second community node set; If the community screening threshold is not exceeded, performing the division marking on the first community node set; All first community node sets marked as divided and second community node sets marked as divided are obtained to obtain N community node sets.

2. The community-based risk monitoring method according to claim 1, characterized in that: The risk node set obtained by sequentially comparing a single node in the non-specified M-1 screening community node set with the abnormal node group includes: Target any community node A in the set of non-specified M-1 screening community nodes; According to the formula , calculate the association degree between community node A and abnormal node group, where F(A) is the association degree between community node A and abnormal node group, s is the damping coefficient, T1, T2, ..., T n is a node in the abnormal node group, C(T i ) is T i Node and non-T i The total number of links to a node, P(T i ) is T i The total number of links between the node and the community node A; Determining whether the correlation degree is greater than a preset correlation threshold; If it is greater than the association threshold, the community node A is determined to be a risk node.

3. The community-based risk monitoring method according to claim 1, characterized in that: The performing of value assignment processing on the community nodes in the N community node sets to obtain N node value assignment sets includes: Reading a community node in the community node set, and analyzing i information dimensions corresponding to the community node, where i is a positive integer; According to the preset dimension assignment table, the i information dimensions are assigned a value query process to obtain the total assigned score of the i information dimensions; The total assigned points are determined as the node assignment of the community node.

4. The community-based risk monitoring method according to claim 3, characterized in that: The N community node sets are subjected to community screening processing according to the parameter data corresponding to the N node value sets to obtain M screened community node sets including: Determining whether the number of nodes in the community node set exceeds a preset size threshold; If the size exceeds the preset threshold, then the assignment average corresponding to the community node set is calculated based on the node assignment set corresponding to the community node set, and it is determined whether the assignment average is greater than the preset average threshold; If it is greater than the preset average sharing threshold, the community node set is determined as the screening community node set; If the preset scale threshold is not exceeded, the node value set corresponding to the community node set is queried, and the j information dimensions among the i information dimensions corresponding to the node values ​​in the node value set are extracted. According to the dimension value table, the total score values ​​corresponding to the j information dimensions are queried and calculated, where j is a positive integer not greater than i; Determine whether there is an element in the total score assignment set that is not less than a preset total score threshold; If there is an element whose total score is not less than the preset total score threshold, the community node set is determined as the screening community node set.

5. The community-based risk monitoring method according to claim 1, characterized in that: After receiving an abnormal instruction, wherein the abnormal instruction is used to determine an abnormal node group in the M screening community node sets, and before sequentially comparing a single node in the non-specified M-1 screening community node sets with the abnormal node group to obtain a risk node set, the method further includes: Determine whether the number of nodes in the abnormal node group exceeds a preset numerical threshold; If the value does not exceed the threshold, the abnormal node group is re-determined as the screening community node set.

6. A community-based risk monitoring device, characterized in that: The community-based risk monitoring device includes: An acquisition and assignment module, configured to acquire a user information node set, divide the user information node set into N community node sets, and perform assignment processing on the community nodes in the N community node sets to obtain N node assignment sets, where N is a positive integer; A community screening module, configured to perform community screening on the N community node sets according to the parameter data corresponding to the N node value sets, to obtain M screened community node sets, where M is a positive integer not greater than N; a designated determination module, configured to receive an abnormal instruction, wherein the abnormal instruction is used to determine an abnormal node group in the M screening community node sets; A risk association module is used to sequentially compare individual nodes in the non-specified M-1 screening community node sets with the abnormal node group to obtain a risk node set; The acquisition and assignment module is specifically used for: Obtaining a user information node set, and writing the user information node set into a preset undirected and unweighted graph to obtain a first undirected and unweighted graph; Analyzing, according to a preset clustering algorithm, the number of triangular nodes constituting the first undirected unweighted graph, and splitting the first undirected unweighted graph based on the number of triangular nodes constituting the first undirected unweighted graph to obtain X second undirected unweighted graphs, where X is a positive integer and is greater than or equal to N; Dividing the user information set into X first community node sets based on the X second undirected unweighted graphs, and performing community screening on the X first community node sets to obtain the N community node sets; The acquisition and assignment module may also be specifically used for: For each of the first community node sets, determining whether the number of nodes in the first community node set exceeds a preset community screening threshold; If the preset community screening threshold is exceeded, obtaining a second undirected unweighted graph corresponding to the first community node set; Calculate the Euclidean distance between any two community nodes in the second undirected unweighted graph based on the Euclidean distance algorithm, and select nodes with Euclidean distances less than a preset distance threshold as the second community node set; Performing partition marking on the second community node set; If the community screening threshold is not exceeded, performing the division marking on the first community node set; All first community node sets marked as divided and second community node sets marked as divided are obtained to obtain N community node sets.

7. A community-based risk monitoring device, characterized in that: The community-based risk monitoring device includes: a memory and at least one processor, wherein instructions are stored in the memory, and the memory and the at least one processor are interconnected via a line; The at least one processor calls the instructions in the memory to enable the community-based risk monitoring device to execute the community-based risk monitoring method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the community-based risk monitoring method according to any one of claims 1 to 5 is implemented.

Images