Risk node detection method, device, equipment and storage medium

Abstract

The present invention relates to the field of data analysis, and discloses a method, device, equipment and storage medium for detecting risk nodes. The method includes: obtaining a user information node set, dividing the user information node set into a community node set of N categories, wherein N is a positive integer; performing assignment processing on the community nodes in the community node set of N categories according to a preset assignment algorithm to obtain a node assignment set of N categories; performing community screening processing on the community node set of N categories according to a preset community screening algorithm based on the node assignment set of N categories to obtain a screening community node set of M categories, wherein M is a positive integer not greater than N; receiving a designated instruction of an abnormal node in any category of the screening community node set, and performing association processing on the nodes in the screening community node set of any category based on the abnormal node to obtain a risk node set.

Description

Technical Field

[0001] The present invention relates to the field of data analysis, and in particular to a risk node detection method, device, equipment and storage medium. Background Art

[0002] With the development of information technology, using the Internet to commit fraud has become a common fraud method. Currently, anti-fraud strategy personnel mainly formulate anti-fraud rules based on the experience and lessons of historical fraud users by analyzing the characteristics and operations of historical fraud users, so as to discover fraudulent behavior based on the historical cases of fraudsters. When the user's operation behavior triggers the anti-fraud rule, it will be identified as fraudulent behavior and interception will be initiated to ensure the information and transaction security of other users. Although this method of discovering fraudulent means is relatively simple and easy to implement, this solution has many defects, such as low accuracy.

[0003] The above scheme relies on the fact that fraud detection personnel need to start from the identified fraud accounts, query along the relationship one by one, find the fraud-intensive subgraph, and judge the suspicious accounts by analyzing related businesses, actions, etc. Therefore, they can only associate and analyze existing fraud events, use several dimensions for calculation and identification, and cannot cover the relationship network between all factors. In addition, with the development of technology, there are certain limitations in personnel's understanding of current technology. Therefore, there is a certain lag in the recent fraudulent behaviors and fraudulent technologies. In addition, this scheme requires a lot of manpower, time and energy costs. Summary of the invention

[0004] The main purpose of the present invention is to solve the technical problem that the prior art cannot accurately and quickly find fraudulent suspicious accounts.

[0005] A first aspect of the present invention provides a method for detecting a risk node, comprising the steps of:

[0006] Obtain a user information node set, and divide the user information node set into N community node sets, where N is a positive integer;

[0007] According to a preset assignment algorithm, the community nodes in the N community node sets are assigned values ​​to obtain N node assignment sets;

[0008] Based on the N node value sets and a preset community screening algorithm, the N community node sets are subjected to community screening processing to obtain M screened community node sets, where M is a positive integer not greater than N;

[0009] For each of the screening community node sets, an abnormal instruction of the screening community node set is received, the abnormal instruction comprising: an abnormal node, and based on the abnormal node, node association processing is performed on the nodes in the screening community node set to obtain a risk node set.

[0010] Optionally, in a first implementation manner of the first aspect of the present invention, the obtaining of a user information node set and dividing the user information node set into N community node sets includes:

[0011] Obtaining a user information node set, and writing the user information node set into a preset undirected and unweighted graph to obtain a user undirected and unweighted graph;

[0012] According to a preset clustering algorithm, the number of triangular nodes constituting the user's undirected and unweighted graph is analyzed to obtain community node sets of N categories corresponding to the user information node set.

[0013] Optionally, in a second implementation of the first aspect of the present invention, performing assignment processing on the community nodes in the N community node sets according to a preset assignment algorithm to obtain N node assignment sets includes:

[0014] For each community node in the community node set, analyzing i information dimensions corresponding to the community node, where i is a positive integer;

[0015] According to the preset dimension assignment table, the i information dimensions are assigned a value and a query is performed to calculate the total assigned score of the i information dimensions;

[0016] The total valued score is determined as the node value of the community node.

[0017] Optionally, in a third implementation of the first aspect of the present invention, the performing community screening on the N community node sets based on the N node value sets and a preset community screening algorithm to obtain M screened community node sets includes:

[0018] Determine whether the number of nodes in the community node set exceeds a preset scale threshold;

[0019] If it exceeds the preset scale threshold, then based on the node assignment set corresponding to the community node set, the assignment average corresponding to the community node set is calculated to determine whether the assignment average is greater than the preset average threshold;

[0020] If it is greater than a preset average sharing threshold, the community node set is determined as a screening community node set;

[0021] If the preset scale threshold is not exceeded, the community node set is subjected to a value assignment calculation process of a specified dimension according to the dimension assignment table to obtain a total score assignment set;

[0022] Determine whether there is an element in the total score assignment set that is not less than a preset total score threshold;

[0023] If there is an element whose total score is not less than the preset total score threshold, the community node set is determined as the screening community node set.

[0024] Optionally, in a fourth implementation of the first aspect of the present invention,

[0025] The step of performing the assignment calculation processing of the specified dimension on the community node set according to the dimension assignment table to obtain the total score assignment set includes:

[0026] Extracting j information dimensions among i information dimensions corresponding to each node assignment from the node assignment set corresponding to the community node set, where j is a positive integer not greater than i;

[0027] According to the dimension assignment table, the total score assignments corresponding to the j information dimensions are queried and calculated.

[0028] Optionally, in a fifth implementation manner of the first aspect of the present invention, performing node association processing on the nodes in the screening community node set to obtain a risk node set includes:

[0029] According to the preset PPR algorithm, the nodes in the screening community node set are matched with the abnormal nodes to obtain a risk node set.

[0030] Optionally, in a sixth implementation of the first aspect of the present invention, after receiving a designated instruction for an abnormal node in the screening community node set of any category, and performing association processing on nodes in the screening community node set of any category based on the abnormal node to obtain a risk node set, the method further includes:

[0031] Based on the xgboost model, the risk nodes in the risk node set are classified to obtain a true risk node set.

[0032] A second aspect of the present invention provides a risk node detection device, the risk node detection device comprising:

[0033] An acquisition and division module is used to acquire a user information node set and divide the user information node set into N community node sets, where N is a positive integer;

[0034] An assignment module, used for performing assignment processing on the community nodes in the N community node sets according to a preset assignment algorithm to obtain N node assignment sets;

[0035] A community screening module, configured to perform community screening on the N community node sets based on the N node value sets and a preset community screening algorithm to obtain M screened community node sets, where M is a positive integer not greater than N;

[0036] The risk association module is used to receive an abnormal instruction of the screening community node set for each of the screening community node sets, wherein the abnormal instruction includes: an abnormal node, and based on the abnormal node, perform node association processing on the nodes in the screening community node set to obtain a risk node set.

[0037] The third aspect of the present invention provides a risk node detection device, comprising: a memory and at least one processor, wherein instructions are stored in the memory, and the memory and the at least one processor are interconnected via lines; the at least one processor calls the instructions in the memory so that the risk node detection device executes the above-mentioned risk node detection method.

[0038] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned risk node detection method.

[0039] In the embodiment of the present invention, on the one hand, this technology uses the method of user feature learning to determine the mapping relationship between user features and risk prediction from three dimensions: user features, relationship features, and associations between features. On the other hand, by constructing a user event association graph and using graph-related algorithms, the association information between nodes is mined. Through these two aspects, fraud groups and fraud users can be identified more comprehensively and accurately. Submitting the detection results of this technology to relevant experts greatly simplifies the work content of the experts, speeds up the detection and adoption of countermeasures, and solves the technical problem that the existing technology cannot accurately and quickly find suspicious accounts of fraud. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of an embodiment of a method for detecting risk nodes in an embodiment of the present invention;

[0041] Figure 2 A community association division schematic diagram of a risk node detection method according to an embodiment of the present invention;

[0042] Figure 3 Schematic diagram of an embodiment of a risk node detection device in an embodiment of the present invention;

[0043] Figure 4 It is a schematic diagram of another embodiment of a risk node detection device in an embodiment of the present invention;

[0044] Figure 5 The figure is a schematic diagram of an embodiment of a risk node detection device in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] Embodiments of the present invention provide a risk node detection method, device, equipment and storage medium.

[0046] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0047] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of a method for detecting risk nodes in an embodiment of the present invention includes:

[0048] 101. Obtain a user information node set, and divide the user information node set into N community node sets, where N is a positive integer;

[0049] Obtain a user information node set, and divide the user information node set into N categories of community node sets, where N is a positive integer;

[0050] In this embodiment, the user information node is an abstract point of user information, which includes user device, user payment account, user GPS+ (GPS address appears within 7 days), user login IP+ time window, user registration IP address, user registration mobile phone number, and all information is combined on the user information. According to the association between user device, user payment account, user GPS+ (GPS address appears within 7 days), user login IP+ time window, user registration IP address, and user registration mobile phone number, the user information is divided into different communities. The division process can be to select any point in the graph to be divided, and then find out whether there is a point that exceeds the threshold value for the preset correlation algorithm at this point. If so, create a community for these two points, and then traverse from these two nodes as starting points to find the points that exceed the threshold value for the preset correlation algorithm. If so, divide the points that exceed the threshold value into the same community, and continue the above operation until all nodes have been traversed. The original relationship graph is divided into several independent communities, and all nodes in the community are directly related. For example, if Figure 2 As shown in the community association division diagram, there are four nodes ABCD, among which AB nodes are directly associated, and CD nodes are associated. The algorithm divides AB into one community and CD into one community, and then traverses the four nodes ABCD in turn to see if there are other associations. It is found that there are none, so the algorithm execution ends and the division results of the two communities are output.

[0051] Further, step 101 may perform the following steps:

[0052] 1011. Obtain a user information node set, and write the user information node set into a preset undirected and unweighted graph to obtain a user undirected and unweighted graph;

[0053] 1012. According to a preset clustering algorithm, the number of triangular nodes constituting the user undirected unweighted graph is analyzed to obtain N community node sets corresponding to the user information node set.

[0054] In steps 1011-1012, the user information node set is written into an undirected unweighted graph G=(V, E), where V is a set divided into n parts: V1, V2, ..., V n , E is the total set of unweighted graphs without items, r2∈V2,…,r n ∈V n , r1, r2, …, r n For nodes from E, the total set of unweighted and unitemized graphs, interconnected communities are mined by maximizing the index.

[0055] Among them, since the community is composed of dense nodes, the probability of nodes forming a triangle is high. For node x and community C, set t(x, C) to the number of triangles formed by x and the nodes in C, and vt(x, C) represents the number of nodes in C that can form a triangle with x. Then the condensation degree of x and community C is F(x, C). When t(x, C) = 0, F(x, C) = 0. When t(x, C) ≠ 0, F(x, C) = {t(x, C) / t(x, V)}*{vt(x, C) / (|C\{x}|+vt(x, V\C))}.

[0056] Furthermore, the condensation degree of community C is Then F(C) is the average value of F(x, C) of all nodes in C. Given a partition graph P = {C1, C2, ..., C n}, and community C = C1∩C2∩…∩C n , then the condensation of P is the weighted average of all communities in the partition, and the expression of P is:

[0057] Among them, F(C i ) is C i The cohesion of the community.

[0058] Based on the calculation of the condensation degree, the user undirected unweighted graph G = (V, E) is classified to obtain N community node sets.

[0059] 102. Performing value assignment processing on the community nodes in the N community node sets according to a preset value assignment algorithm to obtain N node value assignment sets;

[0060] In this embodiment, a community node set is taken out from N community node sets, and based on the user devices, user payment accounts, user GPS+ (GPS address appears within 7 days), user login IP+ time window, user registered IP address, and user registered mobile phone number of the community nodes of the community node set, whether there are user shared devices, user shared payment accounts, user shared WiFi, user shared GPS+ (GPS address appears within 7 days), user shared login IP+ time window, user shared registered IP address, and user shared registered mobile phone numbers, the user shared devices, user shared payment accounts, user shared GPS+ (GPS address appears within 7 days), user shared login IP+ time window, user shared registered IP address, and user shared registered mobile phone numbers are assigned values.

[0061] For example, the value of shared device is 2, the value of shared payment account is 2, the value of shared registered mobile phone number is 1, the value of shared WiFi is 1, the value of shared GPS+ (GPS address appears within 7 days) is 0.7 if the interval is less than 12 hours, 0.6 if the interval is less than 24 hours, 0.5 if the interval is less than 48 hours, 0.4 if the interval is less than 72 hours, and 0.1 if it is greater than 72 hours. The value of shared login IP+ time window is 0.7 if the interval is less than 3 hours, 0.6 if the interval is less than 6 hours, 0.5 if the interval is less than 9 hours, 0.4 if the interval is less than 12 hours, and 0.1 if it is greater than 12 hours. The value of shared registered IP address is 0.7 if the interval is less than 24 hours, 0.6 if the interval is less than 48 hours, 0.5 if the interval is less than 72 hours, 0.4 if the interval is less than 96 hours, and 0.1 if it is greater than 96 hours.

[0062] Further, step 102 may perform the following steps:

[0063] 1021. For each community node in the community node set, analyze i information dimensions corresponding to the community node, where i is a positive integer;

[0064] 1022. According to the preset dimension assignment table, perform assignment query processing and calculation on the i information dimensions to obtain the total assignment score of the i information dimensions;

[0065] 1023. Determine the total value assigned as the node value of the community node.

[0066] In steps 1021-1023, the information dimensions include 7 dimensions: user-shared devices, user-shared payment accounts, user-shared WiFi, user-shared GPS+ (GPS address appears within 7 days), user-shared login IP+ time window, user-shared registered IP address, and user-shared registered mobile phone number. However, it is not necessary to assign points to all dimensions. You can select 4 dimensions: user-shared devices, user-shared payment accounts, user-shared WiFi, and user-shared GPS+ (GPS address appears within 7 days) for assignment calculation. According to the assignment correspondence in the assignment table, the total score of the 4 dimensions is obtained. For example, the user-shared device is assigned a value of 2, the user-shared payment account is assigned a value of 2, the user-shared registered mobile phone number is assigned a value of 1, and the user-shared WiFi is assigned a value of 1. The user-shared GPS+ (GPS address appears within 7 days) interval is less than 12 hours and is assigned 0.7, the interval is less than 24 hours and is assigned 0.6, the interval is less than 48 hours and is assigned 0.5, the interval is less than 72 hours and is assigned 0.4, and the interval is greater than 72 hours and is assigned 0.1. If the interval between users' shared login IP+time windows is less than 3 hours, the value is 0.7; if the interval is less than 6 hours, the value is 0.6; if the interval is less than 9 hours, the value is 0.5; if the interval is less than 12 hours, the value is 0.4; and if it is greater than 12 hours, the value is 0.1. If the interval between users' shared registration IP addresses is less than 24 hours, the value is 0.7; if the interval is less than 48 hours, the value is 0.6; if the interval is less than 72 hours, the value is 0.5; if the interval is less than 96 hours, the value is 0.4; and if the interval is greater than 96 hours, the value is 0.1. The total score of the four dimensions is calculated as 2+2+1+0.7=5.7, and the total score of 5.7 is determined as the node value of the community node.

[0067] 103. Based on the N node value sets and a preset community screening algorithm, perform community screening on the N community node sets to obtain M screened community node sets, where M is a positive integer not greater than N;

[0068] In this embodiment, the node value sets of N categories are calculated to obtain N node means, and it is determined whether the means are greater than the mean threshold. If so, the community node set corresponding to the node mean is determined as the screening community node set, and the sizes of the N node means are cyclically compared to screen out M categories of screening community node sets from the N community node sets.

[0069] Further, step 103 may perform the following steps:

[0070] 1031. Determine whether the number of nodes in the community node set exceeds a preset scale threshold;

[0071] 1032. If the preset scale threshold is exceeded, then based on the node value set corresponding to the community node set, the value assignment average corresponding to the community node set is calculated to determine whether the value assignment average is greater than the preset value assignment threshold;

[0072] 1033. If it is greater than a preset average sharing threshold, the community node set is determined as a screening community node set;

[0073] 1034. If the preset scale threshold is not exceeded, performing a value calculation process on the community node set of the specified dimension according to the dimension value table to obtain a total score value set;

[0074] 1035. Determine whether the total score assignment set contains an element that is not less than a preset total score threshold;

[0075] 1036. If there is an element with a total score not less than the preset total score threshold, the community node set is determined as the screening community node set. In steps 1031-1036, it can be seen that it is first determined whether the number of nodes in the community node set is greater than 20. If it is greater than 20, the total weight assignment is divided by the number of community nodes to obtain the assignment average, and then it is determined whether the assignment average is greater than 2. If it is greater than 2, the community node set is determined to be the screening community node set.

[0076] When the number of nodes in the community node set is less than 20, the community nodes of the community node set are assigned values ​​in turn to obtain the total assigned score of each community node, and it is determined whether there is a node with a total assigned score of not less than 5 for each community node. If so, the community node set is determined to be a screening community node set.

[0077] Preferably, step 1034 may further perform the following steps:

[0078] 10341. Extracting j information dimensions among i information dimensions corresponding to each node value from the node value set corresponding to the community node set, where j is a positive integer not greater than i;

[0079] 10342. According to the dimension assignment table, query and calculate the total score assignments corresponding to the j information dimensions.

[0080] In steps 10341-10342, among the seven dimensions of users' shared devices, users' shared payment accounts, users' shared WiFi, users' shared GPS+ (the time interval between GPS addresses is within 7 days), users' shared login IP+ time window, users' shared registered IP address, and users' shared registered mobile phone numbers, three dimensions of users' shared devices, users' shared payment accounts, and users' shared registered mobile phone numbers are extracted, and the total scores of users' shared devices, users' shared payment accounts, and users' shared registered mobile phone numbers are calculated.

[0081] 104. For each of the screening community node sets, receive an abnormal instruction of the screening community node set, the abnormal instruction comprising: an abnormal node, and based on the abnormal node, perform node association processing on the nodes in the screening community node set to obtain a risk node set.

[0082] In this embodiment, a screening community node in a screening community node set is selected from the screening community node sets of M categories to be determined as an abnormal node. According to the association relationship of the abnormal nodes in the selected screening community node set, the nodes of community C whose condensation degree F(x, C) is greater than the threshold are classified as abnormal nodes of the same category. After clustering the abnormal nodes of the entire screening community node set, all abnormal nodes in the screening community node set are copied and combined into a risk node set.

[0083] Preferably, step 104 may perform the following steps:

[0084] 1041. According to a preset PPR algorithm, the nodes in the screening community node set are matched with the abnormal nodes in terms of correlation to obtain a risk node set.

[0085] In step 1041, based on the PPR algorithm, the user nodes to be detected in each community need to be analyzed, that is, each algorithm execution starts from an abnormal user node in the community to calculate the risk level of each node. By executing PPR once for all nodes in the abnormal node group, the strength of the association between each node to be detected and the abnormal node is obtained, and the fraud risk assessment score value of each node to be detected is obtained by accumulating and averaging. A high score value indicates that it has more associations with the fraud nodes in the community, is more important, and has a greater risk of fraud. The risk node set is finally obtained through cyclic processing.

[0086] After step 104, the following steps may be performed:

[0087] 105. Based on the xgboost model, classify the risk nodes in the risk node set to obtain a true risk node set.

[0088] The model finally outputs whether each node is a fraudulent node, which is a binary classification problem. In order to evaluate the performance of the model, a binary classifier is introduced, which divides the samples into the following four categories:

[0089] 1. True Positive (TP): samples that are actually positive and predicted as positive by the model

[0090] 2. False Positive (FP): Samples that are actually negative but predicted as positive by the model

[0091] 3. True Negative (TN): samples that are actually negative and predicted as negative by the model

[0092] 4. False Negative (FN): Samples that are actually positive but predicted as negative by the model

[0093] After training, the xgboost model will classify the risk node set and filter each node in the risk node set to obtain the true risk node set.

[0094] In the embodiment of the present invention, on the one hand, this technology uses the method of user feature learning to determine the mapping relationship between user features and risk prediction from three dimensions: user features, relationship features, and associations between features. On the other hand, by constructing a user event association graph and using graph-related algorithms, the association information between nodes is mined. Through these two aspects, fraud groups and fraud users can be identified more comprehensively and accurately. Submitting the detection results of this technology to relevant experts greatly simplifies the work content of the experts, speeds up the detection and adoption of countermeasures, and solves the technical problem that the existing technology cannot accurately and quickly find suspicious accounts of fraud.

[0095] The above describes the risk node detection method in the embodiment of the present invention. The following describes the risk node detection device in the embodiment of the present invention. Figure 3 , an embodiment of a risk node detection device in an embodiment of the present invention includes:

[0096] An acquisition and division module 301 is used to acquire a user information node set and divide the user information node set into N community node sets, where N is a positive integer;

[0097] The assignment module 302 is used to perform assignment processing on the community nodes in the N community node sets according to a preset assignment algorithm to obtain N node assignment sets;

[0098] A community screening module 303 is used to perform community screening processing on the N community node sets based on the N node value sets and a preset community screening algorithm to obtain M screened community node sets, where M is a positive integer not greater than N;

[0099] The risk association module 304 is used to receive an abnormal instruction of the screening community node set for each of the screening community node sets, the abnormal instruction including: abnormal nodes, and based on the abnormal nodes, perform node association processing on the nodes in the screening community node set to obtain a risk node set.

[0100] In the embodiment of the present invention, on the one hand, this technology uses the method of user feature learning to determine the mapping relationship between user features and risk prediction from three dimensions: user features, relationship features, and associations between features. On the other hand, by constructing a user event association graph and using graph-related algorithms, the association information between nodes is mined. Through these two aspects, fraud groups and fraud users can be identified more comprehensively and accurately. Submitting the detection results of this technology to relevant experts greatly simplifies the work content of the experts, speeds up the detection and adoption of countermeasures, and solves the technical problem that the existing technology cannot accurately and quickly find suspicious accounts of fraud.

[0101] See also Figure 4 Another embodiment of the risk node detection device in the embodiment of the present invention includes:

[0102] An acquisition and division module 301 is used to acquire a user information node set and divide the user information node set into N community node sets, where N is a positive integer;

[0103] The assignment module 302 is used to perform assignment processing on the community nodes in the N community node sets according to a preset assignment algorithm to obtain N node assignment sets;

[0104] A community screening module 303 is used to perform community screening processing on the N community node sets based on the N node value sets and a preset community screening algorithm to obtain M screened community node sets, where M is a positive integer not greater than N;

[0105] The risk association module 304 is used to receive an abnormal instruction of the screening community node set for each of the screening community node sets, the abnormal instruction including: abnormal nodes, and based on the abnormal nodes, perform node association processing on the nodes in the screening community node set to obtain a risk node set.

[0106] The acquisition and division module 301 is specifically used for:

[0107] Obtaining a user information node set, and writing the user information node set into a preset undirected and unweighted graph to obtain a user undirected and unweighted graph;

[0108] According to a preset clustering algorithm, the number of triangular nodes constituting the user's undirected and unweighted graph is analyzed to obtain community node sets of N categories corresponding to the user information node set.

[0109] The community screening module 303 is specifically used for:

[0110] For each community node in the community node set, analyzing i information dimensions corresponding to the community node, where i is a positive integer;

[0111] According to the preset dimension assignment table, the i information dimensions are assigned a value and a query is performed to calculate the total assigned score of the i information dimensions;

[0112] The total valued score is determined as the node value of the community node.

[0113] The risk association module 304 is specifically used for:

[0114] Determine whether the number of nodes in the community node set exceeds a preset scale threshold;

[0115] If it exceeds the preset scale threshold, then based on the node assignment set corresponding to the community node set, the assignment average corresponding to the community node set is calculated to determine whether the assignment average is greater than the preset average threshold;

[0116] If it is greater than a preset average sharing threshold, the community node set is determined as a screening community node set;

[0117] If the preset scale threshold is not exceeded, the community node set is subjected to a value assignment calculation process of a specified dimension according to the dimension assignment table to obtain a total score assignment set;

[0118] Determine whether there is an element in the total score assignment set that is not less than a preset total score threshold;

[0119] If there is an element whose total score is not less than the preset total score threshold, the community node set is determined as the screening community node set.

[0120] The risk association module 304 may also be specifically used for:

[0121] Extracting j information dimensions among i information dimensions corresponding to each node assignment from the node assignment set corresponding to the community node set, where j is a positive integer not greater than i;

[0122] According to the dimension assignment table, the total score assignments corresponding to the j information dimensions are queried and calculated.

[0123] The risk association module 304 is specifically used for:

[0124] According to the preset PPR algorithm, the nodes in the screening community node set are matched with the abnormal nodes to obtain a risk node set.

[0125] The risk node detection device further includes a classification module 305, and the classification module 305 is specifically used for:

[0126] Based on the xgboost model, the risk nodes in the risk node set are classified to obtain a true risk node set.

[0127] In the embodiment of the present invention, on the one hand, this technology uses the method of user feature learning to determine the mapping relationship between user features and risk prediction from three dimensions: user features, relationship features, and associations between features. On the other hand, by constructing a user event association graph and using graph-related algorithms, the association information between nodes is mined. Through these two aspects, fraud groups and fraud users can be identified more comprehensively and accurately. Submitting the detection results of this technology to relevant experts greatly simplifies the work content of the experts, speeds up the detection and adoption of countermeasures, and solves the technical problem that the existing technology cannot accurately and quickly find suspicious accounts of fraud.

[0128] above Figure 3 and Figure 4 The risk node detection device in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The risk node detection device in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0129] Figure 5 : is a schematic diagram of the structure of a risk node detection device provided by an embodiment of the present invention. The risk node detection device 500 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 510 (for example, one or more processors) and a memory 520, and one or more storage media 530 (for example, one or more mass storage devices) storing application programs 533 or data 532. Among them, the memory 520 and the storage medium 530 can be short-term storage or permanent storage. The program stored in the storage medium 530 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the risk node detection device 500. Furthermore, the processor 510 can be configured to communicate with the storage medium 530 to execute a series of instruction operations in the storage medium 530 on the risk node detection device 500.

[0130] The risk node-based detection device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input and output interfaces 560, and / or one or more operating systems 531, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. It will be appreciated by those skilled in the art that Figure 5 The structure of the risk node detection device shown does not constitute a limitation on the risk node-based detection device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0131] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the risk node detection method.

[0132] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device, or unit can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0133] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0134] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting risk nodes, characterized in that: Includes steps: Obtain a user information node set, and divide the user information node set into N community node sets, where N is a positive integer; According to a preset assignment algorithm, the community nodes in the N community node sets are assigned values ​​to obtain N node assignment sets; Based on the N node value sets and a preset community screening algorithm, the N community node sets are subjected to community screening processing to obtain M screened community node sets, where M is a positive integer not greater than N; For each of the screening community node sets, receiving an abnormal instruction of the screening community node set, the abnormal instruction comprising: abnormal nodes, based on the abnormal nodes, performing node association processing on nodes in the screening community node set to obtain a risk node set; The method of performing value assignment processing on the community nodes in the N community node sets according to the preset value assignment algorithm to obtain the N node value assignment sets includes: For each community node in the community node set, analyzing i information dimensions corresponding to the community node, where i is a positive integer; According to the preset dimension assignment table, the i information dimensions are assigned a value query and calculated to obtain a total assigned score of the i information dimensions; The total value assignment score is determined as the node value assignment of the community node to obtain N node value assignment sets.

2. The method for detecting risk nodes according to claim 1, characterized in that: The obtaining of the user information node set and dividing the user information node set into N community node sets includes: Obtaining a user information node set, and writing the user information node set into a preset undirected and unweighted graph to obtain a user undirected and unweighted graph; According to a preset clustering algorithm, the number of triangle nodes constituting the undirected and unweighted graph of the user is analyzed to obtain N community node sets corresponding to the user information node set.

3. The method for detecting risk nodes according to claim 1, characterized in that: Based on the N node value sets and the preset community screening algorithm, the N community node sets are subjected to community screening processing to obtain M screened community node sets including: Determine whether the number of nodes in the community node set exceeds a preset scale threshold; If it exceeds the preset scale threshold, then based on the node assignment set corresponding to the community node set, the assignment average corresponding to the community node set is calculated to determine whether the assignment average is greater than the preset average threshold; If it is greater than a preset average sharing threshold, the community node set is determined as a screening community node set; If the preset scale threshold is not exceeded, the community node set is subjected to a value assignment calculation process of a specified dimension according to the dimension assignment table to obtain a total score assignment set; Determine whether there is an element in the total score assignment set that is not less than a preset total score threshold; If there is an element whose total score is not less than the preset total score threshold, the community node set is determined as the screening community node set.

4. The method for detecting risk nodes according to claim 3, characterized in that: The step of performing the assignment calculation processing of the specified dimension on the community node set according to the dimension assignment table to obtain the total score assignment set includes: Extracting j information dimensions among i information dimensions corresponding to each node assignment from the node assignment set corresponding to the community node set, where j is a positive integer not greater than i; According to the dimension assignment table, the total score assignments corresponding to the j information dimensions are queried and calculated.

5. The method for detecting risk nodes according to claim 1, characterized in that: The performing node association processing on the nodes in the screening community node set to obtain a risk node set includes: According to the preset PPR algorithm, the nodes in the screening community node set are matched with the abnormal nodes to obtain a risk node set.

6. The method for detecting risk nodes according to claim 1, characterized in that: In the step of receiving an abnormal instruction for the screening community node set for each of the screening community node sets, the abnormal instruction comprising an abnormal node, and performing node association processing on nodes in the screening community node set based on the abnormal node to obtain a risk node set, further comprising: Based on the xgboost model, the risk nodes in the risk node set are classified to obtain a true risk node set.

7. A risk node detection device, characterized in that: The risk node detection device includes: An acquisition and division module is used to acquire a user information node set and divide the user information node set into N community node sets, where N is a positive integer; An assignment module, used for performing assignment processing on the community nodes in the N community node sets according to a preset assignment algorithm to obtain N node assignment sets; A community screening module, configured to perform community screening on the N community node sets based on the N node value sets and a preset community screening algorithm to obtain M screened community node sets, where M is a positive integer not greater than N; A risk association module, for receiving, for each of the screening community node sets, an abnormal instruction of the screening community node set, the abnormal instruction comprising: an abnormal node, and based on the abnormal node, performing node association processing on the nodes in the screening community node set to obtain a risk node set; Wherein, the assignment module is also specifically used for: For each community node in the community node set, analyzing i information dimensions corresponding to the community node, where i is a positive integer; According to the preset dimension assignment table, the i information dimensions are assigned a value query and calculated to obtain a total assigned score of the i information dimensions; The total value assignment score is determined as the node value assignment of the community node to obtain N node value assignment sets.

8. A risk node detection device, characterized in that: The risk node detection device comprises: a memory and at least one processor, the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor calls the instruction in the memory to enable the risk node detection device to execute the risk node detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the risk node detection method according to any one of claims 1 to 6 is implemented.

Images