A method and system for identifying group fraud

Abstract

The present invention discloses a group fraud identification method and system, and relates to the field of computer technology. A specific implementation of the method includes: according to the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph, the policy information is loaded into the point-edge relationship graph to generate a corresponding policy relationship network; according to the set screening conditions, the sub-networks of the policy relationship network are labeled with risk levels to obtain the labeling results of the sub-networks, and the sub-networks belonging to the target risk level are combined into a group fraud network; a risk assessment request for a target policy is received, and according to the parameters of the risk assessment request, the correlation between the target policy and the group fraud network is calculated, and the fraud risk of the target policy is determined according to the correlation. This implementation can identify policies with group fraud in real time, efficiently, and completely, and reduce business risks.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a group fraud identification method and system. Background Art

[0002] In recent years, the accident rate and compensation rate of insurance products have gradually increased. Taking flight delay insurance (referred to as flight delay insurance) as an example, its compensation rate has increased from 8% in 2019 to 38% in 2021, an increase of 30 percentage points. Part of the reason for the above phenomenon is that insurance companies have various problems in underwriting and claims settlement, resulting in frequent insurance fraud. Therefore, in order to reduce business risks, it is necessary to identify insurance fraud and intercept it.

[0003] Insurance fraud includes individual fraud and group fraud. When identifying group fraud, the existing technology constructs a group fraud network by writing SQL statements. This method has cumbersome code, low operating efficiency and cannot identify the complete fraud group. In addition, the constructed group fraud network is usually applied in the form of a blacklist. In this method, the user will only be intercepted when purchasing insurance products again. The application scope is small and the value of the group fraud network cannot be fully utilized. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a group fraud identification method and system. The method generates a policy relationship network by loading policy information into a point-edge relationship graph created based on graph database technology, and then labels the sub-networks of the policy relationship network, so as to perform real-time fraud risk analysis on the target policy based on the labeling results. The method can identify policies with group fraud in real time, efficiently and completely, and reduce business risks.

[0005] To achieve the above objective, according to one aspect of an embodiment of the present invention, a group fraud identification method is provided.

[0006] A group fraud identification method according to an embodiment of the present invention includes: according to the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph, the policy information is loaded into the point-edge relationship graph to generate a corresponding policy relationship network; according to the set screening conditions, the sub-networks of the policy relationship network are labeled with risk levels to obtain the labeled results of the sub-networks, and the sub-networks belonging to the target risk level are combined into a group fraud network; a risk assessment request for a target policy is received, and according to the parameters of the risk assessment request, the correlation between the target policy and the group fraud network is calculated, and the fraud risk of the target policy is determined according to the correlation.

[0007] Optionally, loading the policy information into the point-edge relationship graph includes: creating a data loading task, wherein the data loading task is used to define a file to be loaded and a loading command, the file to be loaded is used to store the policy information, and the loading command is used to load field data of corresponding policy fields for the nodes and the edges; running the data loading task so that the field data of the file to be loaded is loaded into the corresponding nodes and edges of the point-edge relationship graph.

[0008] Optionally, the policy information includes policy records of multiple policies generated within a set time period; the generating of the corresponding policy relationship network includes: repeatedly executing the following steps until the set end condition is reached: a judgment step: selecting two current communities without repetition from multiple current communities, and judging whether the same target node of the two current communities has the same attribute information; wherein the initial value of the current community is a point-edge relationship graph loaded with a policy record of an insurance policy; a processing step: if yes, merging the two current communities into a new community, updating the new community to the current community, and executing the judgment step; if no, executing the judgment step.

[0009] Optionally, the method further includes: formatting the policy information to obtain formatted information; and storing the formatted information in the file to be loaded.

[0010] Optionally, the calculating the association degree between the target insurance policy and the group fraud network according to the parameters of the risk assessment request includes: querying a matching node as a key node in the insurance policy relationship network according to the parameters of the risk assessment request and the attribute information of the node; judging whether the key node belongs to a subnetwork of the group fraud network, and if so, determining that the target insurance policy is associated with the group fraud network; if not, determining that the target insurance policy is not associated with the group fraud network.

[0011] Optionally, the method further includes: creating the point-edge relationship graph using the entity objects of the policy information as the nodes and the relationships between the entity objects as the edges.

[0012] Optionally, the screening conditions include sub-conditions corresponding to different risk levels; and the risk levels of the sub-networks of the policy relationship network are marked according to the set screening conditions, including: judging the sub-conditions satisfied by the sub-network according to the attribute information of the nodes and the attribute information of the edges in the sub-network of the policy relationship network; obtaining the risk level corresponding to the sub-conditions, and marking the obtained risk level as the risk level of the sub-network.

[0013] To achieve the above objective, according to another aspect of an embodiment of the present invention, a group fraud identification system is provided.

[0014] A group fraud identification system according to an embodiment of the present invention includes: a network generation module, which is used to load the policy information into a point-edge relationship graph according to the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph, and generate a corresponding policy relationship network; a network combination module, which is used to label the risk levels of sub-networks of the policy relationship network according to set screening conditions, obtain the labeling results of the sub-networks, and combine the sub-networks belonging to the target risk level into a group fraud network; a fraud identification module, which is used to receive a risk assessment request for a target policy, calculate the correlation between the target policy and the group fraud network according to the parameters of the risk assessment request, and determine the fraud risk of the target policy according to the correlation.

[0015] Optionally, the network generation module is also used to create a data loading task, wherein the data loading task is used to define a file to be loaded and a loading command, the file to be loaded is used to store the policy information, and the loading command is used to load field data of corresponding policy fields for the nodes and the edges; the data loading task is run so that the field data of the file to be loaded is loaded into the corresponding nodes and corresponding edges of the point-edge relationship graph.

[0016] Optionally, the policy information includes policy records of multiple policies generated within a set time period; the network generation module is also used to repeatedly execute the following steps until the set end condition is reached: judgment step: select two current communities without repetition from multiple current communities, and judge whether the same target node of the two current communities has the same attribute information; wherein the initial value of the current community is a point-edge relationship graph loaded with a policy record of an insurance policy; processing step: if yes, merge the two current communities into a new community, update the new community to the current community, and execute the judgment step; if not, execute the judgment step.

[0017] Optionally, the system further includes: a formatting processing module, configured to format the policy information to obtain formatted information; and store the formatted information into the file to be loaded.

[0018] Optionally, the fraud identification module is also used to query the matching nodes in the policy relationship network as key nodes based on the parameters of the risk assessment request and the attribute information of the node; determine whether the key node belongs to a subnetwork of the group fraud network, and if so, determine that the target policy is associated with the group fraud network; if not, determine that the target policy is not associated with the group fraud network.

[0019] Optionally, the system further includes: a relationship graph construction module, which is used to create the point-edge relationship graph using the entity objects of the policy information as the nodes and the relationships between the entity objects as the edges.

[0020] Optionally, the screening conditions include sub-conditions corresponding to different risk levels; the network combination module is also used to determine the sub-conditions satisfied by the sub-network based on the attribute information of the nodes and the attribute information of the edges in the sub-network of the policy relationship network; obtain the risk level corresponding to the sub-condition, and mark the obtained risk level as the risk level of the sub-network.

[0021] To achieve the above objective, according to another aspect of an embodiment of the present invention, an electronic device is provided.

[0022] An electronic device according to an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement a group fraud identification method according to an embodiment of the present invention.

[0023] To achieve the above objective, according to another aspect of the embodiments of the present invention, a computer readable medium is provided.

[0024] A computer-readable medium according to an embodiment of the present invention stores a computer program, and when the program is executed by a processor, a group fraud identification method according to an embodiment of the present invention is implemented.

[0025] An embodiment of the above invention has the following advantages or beneficial effects: by loading the policy information into the point-edge relationship graph created based on the graph database technology, a policy relationship network is generated, and then the sub-network of the policy relationship network is annotated, so as to perform real-time fraud risk analysis on the target policy according to the annotated results, and the policy with group fraud can be identified in real time, efficiently and completely, thereby reducing business risks. Through the data loading task, the policy information is automatically mapped to the point-edge relationship graph, which facilitates the subsequent generation of the policy relationship network.

[0026] By merging the current communities corresponding to the point-edge relationship graph, community calculation of policy information can be realized, and a policy relationship network can be generated, which is convenient for subsequent labeling of the policy relationship network according to risk level. By formatting the policy information, the files to be loaded can be quickly imported into the graph database. By matching and associating the target policy with the group fraud network in real time, real-time fraud association analysis of the target policy is realized, which is convenient for subsequent real-time interception of policies associated with the group fraud network.

[0027] By creating a point-edge relationship graph with entity objects as nodes and the relationships between entity objects as edges, the subsequent social computing of hundreds of millions of insurance policy information can be completed in a few minutes. Based on the set screening conditions including multiple sub-conditions, multi-level classification and labeling of the insurance policy relationship network is realized, supporting user-defined sub-conditions and online adjustments according to needs.

[0028] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0030] Figure 1 is a schematic diagram of the main steps of a group fraud identification method according to an embodiment of the present invention;

[0031] Figure 2 is a business process diagram of a group fraud identification method according to an embodiment of the present invention;

[0032] Figure 3 is a schematic diagram of the architecture of a graph computing and analysis platform in a group fraud identification method according to an embodiment of the present invention;

[0033] Figure 4 is a schematic diagram of the main process of the group fraud identification method according to an embodiment of the present invention;

[0034] Figure 5 is a schematic diagram of the structure of a point-edge relationship graph according to an embodiment of the present invention;

[0035] Figure 6 It is a schematic diagram of the generation process of the insurance policy relationship network according to an embodiment of the present invention;

[0036] Figure 7 is a schematic diagram of main modules of a group fraud identification system according to an embodiment of the present invention;

[0037] Figure 8 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0038] Fig. 9 It is a schematic diagram of the structure of a computer device suitable for implementing the electronic device of the embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0040] Figure 1 FIG. 1 is a schematic diagram of the main steps of the group fraud identification method according to an embodiment of the present invention. Figure 1 As shown, the group fraud identification method of the embodiment of the present invention mainly includes the following steps:

[0041] Step S101: According to the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph, the policy information is loaded into the point-edge relationship graph to generate a corresponding policy relationship network. The policy information is a policy record of a policy formed by a business transaction between a customer and an insurance company within a set time period. The policy record of each policy includes multiple policy fields, such as policy number, insurance type code and other fields. The point-edge relationship graph includes multiple nodes and edges, where nodes are used to represent entity objects of policy information and edges are used to represent relationships between entity objects.

[0042] In the embodiment, entity objects refer to a collection of certain things, which can be specific people and things, or abstract concepts and connections, such as people, policy numbers, accounts, etc. Relationships between entity objects, such as policyholder relationships, insured relationships, and payment relationships, etc. Nodes and edges can contain attribute information, such as a person's name, a person's gender, and the creation time of the policy, etc. The specific values ​​of these attribute information are derived from the policy fields.

[0043] In this step, in order to generate the policy relationship network, the policy information needs to be loaded into the pre-created point-edge relationship graph, and one point-edge relationship graph loads the policy record of one policy. In the embodiment, the data loading of the policy information is realized by creating a data loading task and running the data loading task. The data loading task defines the file to be loaded and the loading command, wherein the file to be loaded is used to store the policy information; the loading command is respectively set with the policy fields that the nodes and edges should map to be loaded according to the mapping relationship between the policy fields and the nodes and edges.

[0044] In the embodiment, there are two types of loading commands, one of which is used to load the policy fields of the policy information to the corresponding nodes, and the other is used to load the policy fields of the policy information to the corresponding edges. For example, the loading command: LOAD f1 TOVERTEX Person VALUES($"applicant_id",$"applicant_name")USING SEPARATOR=",",HEADER="true", is used to load the applicant_id field and the applicant_name field of the file f1 to be loaded to the node with the type name of Person. Among them, SEPARATOR indicates the separator of each policy field (i.e., each column) in the file f1 to be loaded, and HEADER="true" means that the file f1 to be loaded has column names.

[0045] For another example, the load command: LOAD f1 TO EDGE SubPolicy_InsuredPhone VALUES($"sub_policy_no",$"insured_phone_number")USING SEPARATOR="",HEADER="true" is used to load the sub_policy_no field and the insured_phone_number field of the file f1 to be loaded to the edge with the type name SubPolicy_InsuredPhone.

[0046] By loading the policy information into the point-edge relationship graph, the point-edge relationship graph corresponding to each policy can be obtained (the policy field of the policy is loaded in the point-edge relationship graph), and each point-edge relationship graph is regarded as a community. Then, it is determined whether there is a connection between the two communities, and then the communities are merged according to the judgment result to obtain a new community. The above operation is repeated until there is no connection between the new communities. At this point, the policy relationship network can be obtained. In the embodiment, if the same target node of two communities has the same attribute information, it is considered that the two communities are related.

[0047] Step S102: According to the set screening conditions, the sub-networks of the policy relationship network are labeled with risk levels, the labeling results of the sub-networks are obtained, and the sub-networks belonging to the target risk level are combined into a group fraud network. It can be seen from the policy relationship network generation process of step S101 that the final policy relationship network includes multiple communities, each of which is a sub-network. Different sub-networks have different claims amounts, proportions of insurance policies incurred, etc., and the risk levels of group fraud are also different. In order to reasonably and accurately identify fraud groups, each sub-network can be labeled according to the risk level.

[0048] In this step, the screening conditions can be used to screen out sub-networks that may have group fraud from the policy relationship network. Then, the sub-networks screened out by the screening conditions are further labeled with risk levels through manual or automatic labeling, and the sub-networks labeled with the target risk level are combined into a group fraud network.

[0049] In the embodiment, the risk level can be divided into three categories, such as high risk, medium risk and low risk, and also into black network, gray network and white network. Among them, the sub-network corresponding to the high risk (black network) is the sub-network determined to have group fraud, the sub-network corresponding to the medium risk (gray network) is the sub-network to be further confirmed, and the sub-network corresponding to the low risk (white network) is the sub-network determined to have no group fraud. Therefore, the sub-networks marked as high risk can be combined into a group fraud network.

[0050] Step S103: Receive a risk assessment request for a target policy, calculate the correlation between the target policy and the group fraud network based on the parameters of the risk assessment request, and determine the fraud risk of the target policy based on the correlation. The target policy is the policy for which fraud risk is to be identified. When a risk assessment request for a target policy is received, query the policy relationship network for nodes whose attribute information matches the parameter based on the parameters of the risk assessment request. If the attribute information of a node contains the parameter, the node matches the parameter.

[0051] Then, it is determined whether the node belongs to the group fraud network to determine the correlation between the target policy and the group fraud network. If the node belongs to the group fraud network, the target policy is associated with the group fraud network, and it can be considered that the target policy has a fraud risk; if the node does not belong to the group fraud network, the target policy is not associated with the group fraud network, and it can be considered that the target policy does not have a fraud risk. At this point, the fraud risk assessment of the target policy is completed.

[0052] This embodiment can perform real-time fraud risk analysis on target insurance policies, and can identify insurance policies with group fraud risks in real time, efficiently and completely, thereby reducing business risks.

[0053] Figure 2 Schematic diagram of the business process of the group fraud identification method according to an embodiment of the present invention. Figure 2 As shown, the group fraud identification method of the embodiment of the present invention is implemented by a group fraud identification system. The group fraud identification system includes a unified risk control platform and a graph computing and analysis platform. The business process of the group fraud identification method is described below.

[0054] The business process of the group fraud identification method of the embodiment of the present invention includes a network construction process, a screening and marking process, and a real-time underwriting process. Among them, the network construction process includes: the big data platform pushes the policy information to the risk control database; the risk control database formats the policy information to generate formatted information; creates a point-edge relationship graph on the graph computing and analysis platform, and maps the formatted information with the points and edges of the point-edge relationship graph, and then imports the formatted information into the point-edge relationship graph to generate a policy relationship network.

[0055] The screening and labeling process includes: operating personnel (such as claims operations and underwriting personnel) input screening conditions such as claim amount, number of people, and proportion of insurance policies incurred based on the policy relationship network, and query and analyze potential high-risk sub-networks (i.e. sub-networks with the possibility of group fraud); then, based on their own business experience, the above-mentioned potential high-risk sub-networks are further labeled into three categories: black network, white network, and gray network, and the sub-networks labeled as black network are combined into a group fraud network.

[0056] The real-time underwriting process includes: when the business system receives a new policy, it calls the unified risk control platform for risk assessment; the unified risk control platform queries the group fraud network of the graph computing analysis platform, and the graph computing analysis platform calculates in real time whether the new policy is associated with the existing group fraud network, and returns the result to the unified risk control platform; the unified risk control platform makes corresponding decisions on "underwriting passed", "underwriting rejected", or "transfer to manual underwriting" based on the return results of the graph computing analysis platform, and returns them to the business system.

[0057] Figure 3 Schematic diagram of the architecture of the graph computing and analysis platform in the group fraud identification method according to an embodiment of the present invention. Figure 3 As shown, the graph computing and analysis platform of the embodiment of the present invention mainly includes three functional modules: graph data import, graph computing and graph analysis. Among them, the import of graph data relies on the formatted information generated by the big data platform for formatting the policy information, and then imports it into the graph database (GraphDB) through Spark. Graph computing relies on Python and Java services to implement real-time graph computing, and load balancing is implemented based on Nginx. At the same time, a visual background service can be built on the graph computing and analysis platform to support graph analysis functions such as query of point-edge relationship graphs, visual interactive analysis, network screening and labeling.

[0058] Among them, Spark is a fast and general computing engine designed for large-scale data processing. HDFS stands for Hadoop Distributed File System, which is a distributed file system. GraphDB is a graph database. Python is an interpreted, object-oriented, high-level programming language with dynamic data types. Java is an object-oriented programming language. Nginx is a high-performance HTTP and reverse proxy server. GraphX ​​is a distributed graph processing framework. OLAP stands for Online Analytical Processing, also known as online analytical processing. Plato is the code name for an OLAP server. OLTP stands for Online Transaction Processing, also known as online transaction processing.

[0059] Figure 4 FIG. 1 is a schematic diagram of the main flow of the group fraud identification method according to an embodiment of the present invention. Figure 4 As shown, the group fraud identification method of the embodiment of the present invention mainly includes the following steps:

[0060] Step S401: The graph computing and analysis platform uses the entity objects of the insurance policy information as nodes and the relationships between the entity objects as edges to create a node-edge relationship graph. Figure 2 The big data platform can push the existing policy information (which can be called historical policy information) and the policy information of T+1 day increment (which can be called incremental policy information) to the risk control database. In the embodiment, the policy information can be the policy records of underwriting, claims settlement, etc. of insurance products such as flight delay insurance, accident health insurance, and auto insurance.

[0061] In order to quickly import the policy information into the graph database, the risk control database can use the SPOOL tool to format the historical policy information, use the written code program to format the incremental policy information, obtain the formatted information, and then store the formatted information in the file to be loaded. The SPOOL tool is used to export data in a specified format. In the embodiment, the policy information can be formatted into a CSV file, a JSON file, etc., preferably a more concise and efficient CSV file.

[0062] After receiving the file to be loaded, the graph computing and analysis platform creates a point-edge relationship graph with the entity objects of the insurance policy information as nodes and the relationships between the entity objects as edges. The specific implementation process is: create a relationship graph task, including creating nodes and creating undirected edges for connecting nodes; then run the relationship graph task to obtain the created point-edge relationship graph.

[0063] In practical applications, nodes and edges are selected based on business characteristics and policy information. Figure 5Schematic diagram of the structure of the point-edge relationship diagram of an embodiment of the present invention. Figure 5 As shown in the figure, the point-edge relationship graph includes 8 nodes and 22 undirected edges. The 8 nodes are: SubPolicy, Claim, Phone, Email, Person, Policy, Account and Community.

[0064] Take the creation of the node Person as an example, which can be achieved using the following statement: ADD VERTEX Person(PRIMARY_ID id STRING, name STRING, gender STRING)WITH PRIMARY_ID_AS_ATTRIBUTE="true". In the above statement, the ADD VERTEX keyword is used to create a node, Person is the custom node type name, PRIMARY_ID is the node identifier, and name and gender are custom attributes.

[0065] 22 undirected edges, namely: the edge connecting the SubPolicy node and the Phone node (SubPolicy_ApplicantPhone, SubPolicy_InsuredPhone), the edge connecting the Claim node and the Phone node (Claim_ReportorPhone, Claim_ApplicantPhone, Claim_InsuredPhone), the edge connecting the SubPolicy node and the Email node (SubPolicy_ApplicantEmail, SubPolicy_InsuredEmail), the edge connecting the SubPolicy node and the Person node (SubPolicy_Applicant, SubPolicy_Insured), the edge connecting the Policy node and the SubPolicy node (Policy_SubPolicy), the edge connecting the Policy node and the Claim node (Policy_Claim), the edge connecting the Claim node and the Acc node ount's edge (Claim_Account), the edge connecting the node Community and the node SubPolicy (Community_SubPolicy), the edge connecting the node Community and the node Phone (Community_Phone), the edge connecting the node Community and the node Email (Community_Email), the edge connecting the node Community and the node Person (Community_Person), the edge connecting the node Claim and the node Person (Claim_Applicant, Claim_Insured), the edge connecting the node Claim and the node Email (Claim_ApplicantEmail, Claim_InsuredEmail), the edge connecting the node Community and the node Claim (Community_Claim), and the edge connecting the node Community and the node Account (Community_Account). Among them, Applicant refers to the policyholder, Insured refers to the insured, and Reportor refers to the reporter.

[0066] Taking the creation of the edge SubPolicy_ApplicantPhone as an example, the following statement can be used to implement it: ADDUNDIRECTED EDGE SubPolicy_ApplicantPhone(FROM SubPolicy,TO Phone). In this statement, the ADD...EDGE keywords are used to create the edge, and UNDIRECTED indicates that it is an undirected edge.

[0067] Step S402: The graph computing and analysis platform loads the policy information into the point-edge relationship graph according to the mapping relationship between the policy fields of the policy information and the nodes and edges of the point-edge relationship graph, and generates a corresponding policy relationship network. The policy fields of the file to be loaded are mapped to the nodes and edges of the point-edge relationship graph to load the policy fields into the corresponding nodes and edges, and then the formatted information is imported.

[0068] Specifically, a data loading task is created, which is used to define the file to be loaded and the loading command, the file to be loaded is used to store formatting information, and the loading command is used to load the field data of the corresponding policy field for the node and edge; then the data loading task is run so that the field data of the file to be loaded is loaded into the corresponding node and corresponding edge of the point-edge relationship graph. Among them, the implementation statement of the loading command is as described above and will not be repeated here.

[0069] After the policy information is loaded into the point-edge relationship graph, the corresponding policy relationship network is generated according to the nodes, edges, and attribute information of the point-edge relationship graph. Figure 6 Related description.

[0070] Step S401 and step S402 create a point-edge relationship graph with entity objects as nodes and the relationships between entity objects as edges, so that community calculations on billions of insurance policy information can be completed within a few minutes, and the insurance policy relationship network can be incrementally updated on T+1 day.

[0071] Step S403: The graph computing and analysis platform annotates the risk levels of the subnetworks of the policy relationship network according to the set screening conditions, obtains the annotated results of the subnetworks, and combines the subnetworks belonging to the target risk level into a group fraud network. In an embodiment, the screening conditions may include subconditions corresponding to different risk levels, and each subcondition is provided with an indicator threshold of multiple dimensional indicators, which is used to determine whether the current value of each dimensional indicator meets the corresponding indicator threshold. The selection of dimensional indicators and the value of the indicator threshold can be set according to business experience.

[0072] For example, risk levels can be divided into three categories: high risk, medium risk, and low risk. The sub-conditions corresponding to high risk can be that the claim amount is greater than or equal to 1,000 yuan, the proportion of insurance policies incurred is greater than or equal to 50%, and the number of people is greater than 5. In this step, the sub-conditions satisfied by the sub-network need to be determined based on the attribute information of the nodes and the attribute information of the edges in the sub-network of the insurance policy relationship network; then the risk level corresponding to the sub-condition is obtained, and the obtained risk level is marked as the risk level of the sub-network. For example, if a sub-network meets the sub-condition corresponding to high risk, the risk level of the sub-network is marked as high risk.

[0073] The target risk level is the risk level that the business personnel believe there is group fraud. In the embodiment, the target risk level can be high risk, or high risk and medium risk. Taking the target risk level as high risk as an example, the sub-networks marked as high risk are combined to obtain a group fraud network. This step supports online input of screening conditions, and the risk level of the sub-network is marked, and supports one-click addition to the group fraud network.

[0074] Step S404: When the unified risk control platform receives a risk assessment request for the target policy sent by the business system, it generates a query request based on the parameters of the risk assessment request and sends the query request to the graph computing analysis platform. The target policy may be a new policy to be subject to fraud risk assessment. When the business system receives a new policy, it generates a corresponding risk assessment request based on the policy information of the new policy and sends it to the unified risk control platform. The parameters of the risk assessment request include the policy number, the insured's ID number, the insured's mobile phone number, and the insured's email address.

[0075] After receiving the risk assessment request, the unified risk control platform parses the parameters of the risk assessment request to generate a query request and sends it to the graph computing analysis platform. The query request parameters include the policy number, the insured's ID number, the insured's mobile phone number, and the insured's email address.

[0076] Step S405: The graph computing and analysis platform calculates the correlation between the target policy and the group fraud network in real time, determines the fraud risk of the target policy and returns the determination result to the unified risk control platform. According to the query request parameters and node attribute information, the matching nodes are queried in the policy relationship network as key nodes; then it is determined whether the key node belongs to the sub-network of the group fraud network. If so, it is determined that the target policy is associated with the group fraud network; if not, it is determined that the target policy is not associated with the group fraud network.

[0077] When matching key nodes, if any parameter value in the parameter is the same as the attribute information of the node in the policy relationship network, then the node is a key node. Taking the mobile phone number in the parameter as an example, if there is a node in the mobile phone number node of the policy relationship network that is the same as the mobile phone number in the parameter, then the node is a key node.

[0078] If the key node belongs to the group fraud network, the target policy is considered to be associated with the group fraud network; if the key node does not belong to the group fraud network, the target policy is considered to be unassociated with the group fraud network. The graph computing and analysis platform returns the fraud risk determination result to the unified risk control platform. For example, if the target policy is associated with the group fraud network, the determination result is that there is a fraud risk, and the number "1" can be returned; if the target policy is not associated with the group fraud network, the determination result is that there is no fraud risk, and the number "0" can be returned.

[0079] Step S406: The unified risk control platform makes an underwriting decision based on the results returned by the graph computing and analysis platform, and returns it to the business system. The unified risk control platform makes a decision of "underwriting approved" or "underwriting rejected" based on the results and returns it to the business system, thus achieving real-time interception of high-risk groups.

[0080] Figure 6 FIG. 1 is a schematic diagram of the generation process of the insurance policy relationship network according to an embodiment of the present invention. Figure 6 As shown, the generation process of the insurance policy relationship network of the embodiment of the present invention mainly includes the following steps:

[0081] Step S601: Select two current communities from multiple current communities without duplication. The initial value of the current community is a point-edge relationship graph loaded with a policy record of an insurance policy. Since the insurance policy information includes insurance policy records of multiple policies, after the previous insurance policy information loading process, one insurance policy corresponds to one point-edge relationship graph. One point-edge relationship graph is regarded as one community, and the number of communities is the number of policies in the insurance policy information. Select two communities arbitrarily and without duplication from all communities as the current communities.

[0082] Step S602: Determine whether the same target node of the two selected current communities has the same attribute information. If so, execute step S603; otherwise, execute step S604. The target node can be a policy number, claim number, person, phone number, email address, etc. If the attribute information of any node such as policy number, claim number, person, phone number, email address, etc. of the two communities is the same, that is, it comes from the same policy, the same claim case, the same person, the same phone number, the same email address, etc., it can be said that there is a connection between the two communities.

[0083] Step S603: merge the two current communities into a new community, update the new community as the current community, and execute step S604. If there is a relationship between the two communities, the two communities are merged.

[0084] Step S604: Determine whether the set end condition is met. If the end condition is not met, execute step S601; if the end condition is met, end. The end condition can be that there is no attribute information that can be associated between communities, or that all the associated policies are already associated. Assuming that after multiple rounds of community selection, merging, and end condition judgment, the end condition is met, the result of the merger is the final policy relationship network.

[0085] The group fraud identification method of the embodiment of the present invention is further described below by taking the flight delay insurance policy information as an example.

[0086] In this embodiment, the underwriting and claim records (i.e., policy information) of flight delay insurance for a total of 27 months from January 2019 to March 2021 are selected to build a policy relationship network, and high-risk sub-networks are marked according to the screening conditions to generate a group fraud network, and then the policies generated from April to July 2021 (i.e., target policies) are selected to simulate the online call of underwriting. The specific implementation is as follows:

[0087] First, the underwriting data table and claim data table of more than 5 million flight delay insurance policies with a processing time range of January 2019 to March 2021 are processed on the big data platform. Among them, the policy fields of the underwriting table include: policy number, sales plan code, sales plan name, quota plan number, quota plan name, insurance type code, insurance type name, insurance type code, insurance type name, policyholder name, policyholder type, policyholder ID number, policyholder gender, policyholder birthday, policyholder mobile number, policyholder email, insured name, insured type, insured ID number, insured gender, insured birthday, insured mobile number, insured email, insurance date, insurance start date, insurance end date, creator, creator Creation time, modifier, modification time, sub-policy number, group flag 1: individual policy; 2: group policy, policy status, sales channel code, channel name, business department code, business department name, division name, cancellation date, cancellation interval, premium, insured amount, whether the insured is on the blacklist, the insured blacklist type, the insured blacklist reason, whether the insured is on the blacklist, the insured blacklist type, the insured blacklist reason, original premium, flight, origin, destination, start time, arrival time, whether there is an accident.

[0088] The policy fields of the claim form include: case number, insurance code, insurance name, insurance compensation amount, case compensation amount, policy number, sub-policy number, premium, insured mobile number, insured name, insured ID type, insured ID number, insured gender, insured age, insured date of birth, insured email, insured province, insurance type code, insurance type name, insurance type code, insurance type name, sales plan code, sales plan name, quota plan code, quota plan name, channel code, channel name, business department code, business department name, accident date, report Date, case filing date, case closing date, case reporting number, location of accident, whether the policy is renewed, policy effective date, whether the policy is valid, disease name, policyholder’s mobile number, policyholder’s name, policyholder’s ID type, policyholder’s ID number, policyholder’s gender, policyholder’s age, policyholder’s date of birth, policyholder’s email address, policyholder’s province, China Insurance Information Service query results, positive label, creator, creation time, modifier, modification time, group logo, collection account, reporter’s name, reporter’s mobile number, relationship between reporter and insured, flight, origin, destination, start time, arrival time.

[0089] After that, the data processed by the big data platform is pushed to the risk control database, and a CSV file is automatically generated and pushed to the graph computing analysis platform. A point-edge relationship graph is created on the graph computing analysis platform, and the CSV file is mapped to the nodes and edges of the point-edge relationship graph, and then the data is imported and the policy relationship network is calculated and constructed.

[0090] Afterwards, the operator inputs the screening conditions based on the policy relationship network: the claim amount is greater than or equal to 1,000 yuan, and the proportion of insurance policies incurred is 50%. The operator queries and analyzes the sub-networks that may have group fraud. Then, based on their own business experience, the operator labels the sub-networks that may have group fraud, such as black network, gray network, and white network, and adds the sub-networks labeled as black network to the group fraud network. In this embodiment, a total of 222 sub-networks are labeled as black networks and added to the group fraud network. Table 1 is a schematic diagram of the field structure of the group fraud network in this embodiment.

[0091] Table 1

[0092]

[0093] Finally, we selected 400,000 insurance policies from April to July 2021, queried the group fraud network of the graph computing analysis platform, and intercepted 996 high-risk policies, including 762 insurance policies that were insured. The group fraud identification system has an interception rate of 0.25%, a production ratio of 433%, an accuracy rate of 77%, and an estimated annual loss reduction of 400,000 yuan.

[0094] The embodiment of the present invention provides a group fraud identification method based on big data and graph database technology. The method generates a policy relationship network by loading policy information into a point-edge relationship graph created based on graph database technology, and then labels the sub-networks of the policy relationship network, so as to perform real-time fraud risk analysis on the target policy according to the labeling results. The method can identify in real time, efficiently and completely the policies with group fraud, and then intercept the policies with group fraud in real time, with a wider and more accurate interception range, effectively reducing the risk of fraud.

[0095] Figure 7 Schematic diagram of the main modules of the group fraud identification system according to an embodiment of the present invention. Figure 7 As shown, the group fraud identification system 700 of the embodiment of the present invention mainly includes:

[0096] The network generation module 701 is used to load the policy information into the point-edge relationship graph according to the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph, and generate the corresponding policy relationship network. In order to generate the policy relationship network, the policy information needs to be loaded into the pre-created point-edge relationship graph, and one point-edge relationship graph loads the policy record of one policy. In the embodiment, data loading of the policy information is achieved by creating a data loading task and running the data loading task.

[0097] By loading the policy information into the point-edge relationship graph, the point-edge relationship graph corresponding to each policy can be obtained. Each point-edge relationship graph is regarded as a community. Then, it is determined whether there is a connection between two communities. Then, the communities are merged according to the judgment result to obtain a new community. The above operation is repeated until there is no connection between the new communities. At this point, the policy relationship network can be obtained.

[0098] The network combination module 702 is used to mark the risk level of the sub-networks of the policy relationship network according to the set screening conditions, obtain the marking results of the sub-networks, and combine the sub-networks belonging to the target risk level into a group fraud network. It can be seen from the policy relationship network generation process that the final policy relationship network includes multiple communities, each of which is a sub-network. Different sub-networks have different claims amounts, proportions of insurance policies incurred, etc., and have different risk levels for group fraud. In order to reasonably and accurately identify fraud groups, each sub-network can be marked according to the risk level. Then, the sub-networks marked as the target risk level are combined into a group fraud network.

[0099] The fraud identification module 703 is used to receive a risk assessment request for a target policy, calculate the correlation between the target policy and the group fraud network according to the parameters of the risk assessment request, and determine the fraud risk of the target policy according to the correlation. The target policy is the policy to be identified for fraud risk. When a risk assessment request for a target policy is received, the policy relationship network is queried for nodes whose attribute information matches the parameters according to the parameters of the risk assessment request.

[0100] Then, it is determined whether the node belongs to the group fraud network to determine the correlation between the target policy and the group fraud network. If the node belongs to the group fraud network, the target policy is associated with the group fraud network, and it can be considered that the target policy has a fraud risk; if the node does not belong to the group fraud network, the target policy is not associated with the group fraud network, and it can be considered that the target policy does not have a fraud risk. At this point, the fraud risk assessment of the target policy is completed.

[0101] In addition, the group fraud identification system 700 of the embodiment of the present invention may also include: a formatting processing module and a relationship graph construction module ( Figure 7 The formatting processing module is used to format the policy information to obtain formatted information; and store the formatted information in the file to be loaded. The relationship graph construction module is used to create the point-edge relationship graph with the entity objects of the policy information as the nodes and the relationships between the entity objects as the edges.

[0102] From the above description, it can be seen that by loading the insurance policy information into the point-edge relationship graph created based on graph database technology, a policy relationship network is generated, and then the sub-network of the policy relationship network is labeled, so that real-time fraud risk analysis of the target policy can be performed based on the labeled results. This can identify insurance policies with group fraud in real time, efficiently and completely, and reduce business risks.

[0103] Figure 8 An exemplary system architecture 800 is shown to which a group fraud identification method or a group fraud identification system according to an embodiment of the present invention can be applied.

[0104] like Figure 8 As shown, system architecture 800 may include servers 801, 802, 803 and networks 804, 805. Network 804 is used to provide a medium for a communication link between server 801 and server 802. Network 805 is used to provide a medium for a communication link between server 802 and server 803. Networks 804, 805 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0105] Servers 801, 802, and 803 may be servers that provide various services. For example, when receiving a new insurance policy, server 801 may call server 802 to perform risk assessment. Server 802 may receive insurance policy information, generate an insurance policy relationship network, build a group fraud network, identify fraud risks of new insurance policies, and feed back processing results (e.g., risk identification results) to server 801. Server 803 may send insurance policy information to server 802.

[0106] It should be noted that the group fraud identification method provided in the embodiment of the present application is generally executed by the server 802 , and accordingly, the group fraud identification system is generally set in the server 802 .

[0107] It should be understood that Figure 8 The number of networks and servers in the embodiment is only for illustration. Any number of networks and servers may be provided as required.

[0108] According to an embodiment of the present invention, the present invention also provides an electronic device and a computer-readable medium.

[0109] The electronic device of the present invention comprises: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement a group fraud identification method of an embodiment of the present invention.

[0110] The computer-readable medium of the present invention stores a computer program thereon, and when the program is executed by a processor, a group fraud identification method according to an embodiment of the present invention is implemented.

[0111] Reference below Fig. 9 , which shows a schematic diagram of the structure of a computer system 900 suitable for implementing an electronic device of an embodiment of the present invention. Fig. 9 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0112] like Fig. 9 As shown, the computer system 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the computer system 900 are also stored. The CPU 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0113] The following components are connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage section 908 as needed.

[0114] In particular, according to the embodiments disclosed in the present invention, the process described in the main step diagram above can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the main step diagram. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the central processing unit (CPU) 901, the above-mentioned functions defined in the system of the present invention are executed.

[0115] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0116] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0117] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be set in a processor, for example, they may be described as: a processor including a network generation module, a network combination module and a fraud identification module. The names of these modules do not constitute a limitation on the modules themselves in some cases. For example, the network generation module may also be described as "a module that loads the policy information into the point-edge relationship graph and generates a corresponding policy relationship network based on the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph."

[0118] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs. When the above one or more programs are executed by a device, the device includes: according to the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph, the policy information is loaded into the point-edge relationship graph to generate a corresponding policy relationship network; according to the set screening conditions, the sub-networks of the policy relationship network are labeled with risk levels to obtain the labeling results of the sub-networks, and the sub-networks belonging to the target risk level are combined into a group fraud network; a risk assessment request for a target policy is received, and according to the parameters of the risk assessment request, the correlation between the target policy and the group fraud network is calculated, and the fraud risk of the target policy is determined according to the correlation.

[0119] According to the technical solution of the embodiment of the present invention, by loading the insurance policy information into a point-edge relationship graph created based on graph database technology, a policy relationship network is generated, and then the sub-networks of the policy relationship network are labeled, so as to conduct real-time fraud risk analysis on the target policy based on the labeled results, so as to identify in real time, efficiently and completely the insurance policies with group fraud behaviors, and reduce business risks.

[0120] The above product can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not described in detail in this embodiment, please refer to the method provided by the embodiment of the present invention.

[0121] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for identifying group fraud, It is characterized in that include: According to the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph, the policy information is loaded into the point-edge relationship graph to generate a corresponding policy relationship network; The point-edge relationship graph includes 8 nodes, which are: sub-policy number, claim number, mobile phone number, email address, person, policy number, payment account and community; According to the set screening conditions, the sub-networks of the policy relationship network are labeled with risk levels to obtain the labeling results of the sub-networks, and the sub-networks belonging to the target risk level are combined into a group fraud network; Receiving a risk assessment request for a target insurance policy, calculating the correlation between the target insurance policy and the group fraud network according to the parameters of the risk assessment request, and determining the fraud risk of the target insurance policy according to the correlation; The step of loading the insurance policy information into the point-edge relationship graph includes: Creating a data loading task, wherein the data loading task is used to define a file to be loaded and a loading command, the file to be loaded is used to store the insurance policy information, and the loading command is used to load field data of corresponding insurance policy fields for the node and the edge; Running the data loading task so that the field data of the file to be loaded is loaded into the corresponding nodes and corresponding edges of the point-edge relationship graph; Use the SPOOL tool to format the policy information to obtain formatted information; The formatting information is stored in the file to be loaded.

2. The method according to claim 1, It is characterized in that The insurance policy information includes insurance policy records of multiple insurance policies generated within a set time period; The generating of the corresponding insurance policy relationship network includes: repeatedly executing the following steps until the set end condition is reached: Determination step: selecting two current communities without duplication from multiple current communities, and determining whether the same target node of the two current communities has the same attribute information; wherein the initial value of the current community is a point-edge relationship graph of a policy record loaded with an insurance policy; Processing steps: If yes, merge the two current communities into a new community, update the new community as the current community, and execute the judgment step; if no, execute the judgment step.

3. The method according to claim 1, It is characterized in that Calculating the degree of association between the target insurance policy and the group fraud network according to the parameters of the risk assessment request includes: According to the parameters of the risk assessment request and the attribute information of the node, searching for a matching node in the policy relationship network as a key node; Determine whether the key node belongs to a sub-network of the group fraud network. If so, determine that the target insurance policy is associated with the group fraud network; if not, determine that the target insurance policy is not associated with the group fraud network.

4. The method according to claim 1, It is characterized in that The method further comprises: The point-edge relationship graph is created by taking the entity objects of the insurance policy information as the nodes and the relationships between the entity objects as the edges.

5. The method according to any one of claims 1 to 4, It is characterized in that The screening conditions include sub-conditions corresponding to different risk levels; The risk level marking of the sub-network of the policy relationship network according to the set screening conditions includes: According to the attribute information of the nodes and the attribute information of the edges in the sub-network of the policy relationship network, determining the sub-conditions satisfied by the sub-network; The risk level corresponding to the sub-condition is obtained, and the obtained risk level is marked as the risk level of the sub-network.

6. A group fraud identification system, It is characterized in that include: A network generation module, configured to load the policy information into the point-edge relationship graph according to the mapping relationship between the policy fields of the policy information and the nodes and edges of the pre-created point-edge relationship graph, and generate a corresponding policy relationship network; The point-edge relationship graph includes 8 nodes, which are: sub-policy number, claim number, mobile phone number, email, person, policy number, collection account and community; and, creating a data loading task, wherein the data loading task is used to define a file to be loaded and a loading command, the file to be loaded is used to store the policy information, and the loading command is used to load the field data of the corresponding policy field for the node and the edge; running the data loading task so that the field data of the file to be loaded is loaded into the corresponding node and the corresponding edge of the point-edge relationship graph; and, using the SPOOL tool to format the policy information to obtain formatted information; storing the formatted information in the file to be loaded; A network combination module is used to label the risk levels of the sub-networks of the policy relationship network according to the set screening conditions, obtain the labeling results of the sub-networks, and combine the sub-networks belonging to the target risk level into a group fraud network; The fraud identification module is used to receive a risk assessment request for a target policy, calculate the correlation between the target policy and the group fraud network based on the parameters of the risk assessment request, and determine the fraud risk of the target policy based on the correlation.

7. An electronic device, It is characterized in that include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

8. A computer readable medium having a computer program stored thereon, It is characterized in that When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images