Transaction relationship graph processing method, device, computer equipment and storage medium

Abstract

The present application relates to a transaction relationship graph processing method, device, computer equipment, storage medium and computer program product, the method comprising: matching the target transaction relationship graph with multiple reference abnormal graphs to determine multiple sub-graphs that match the multiple reference abnormal graphs; determining the first similarity and the second similarity between each sub-graph and the reference abnormal graph; determining the third similarity between each sub-graph and the original abnormal graph; and performing abnormal user mining processing on the target transaction relationship image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph. The transaction relationship graph obtained by the transaction relationship graph processing method provided in the present application can provide more reliable mining information for financial practitioners, so that financial practitioners can quickly and accurately mine abnormal users according to the processed transaction relationship graph, thereby improving the auxiliary effect on financial practitioners.

Description

Technical Field

[0001] The present application relates to the field of big data processing technology, and in particular to a transaction relationship graph processing method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the rapid development of digital technology in financial business, financial products are updated and financial services are becoming more diverse. The traditional financial industry is also constantly moving online, and with it comes the continuous update of financial violations, and the pursuit of interests by abnormal objects is also pervasive. In order to combat anomalies, financial practitioners need to analyze massive amounts of data to identify abnormal users and target them to ensure the security of the financial transaction environment and the economic interests of the majority of users.

[0003] At present, when financial practitioners analyze massive data to identify abnormal users, they usually identify abnormal users based on the transaction relationship map of financial transactions. However, since the transaction relationship map of financial transactions comes from the transaction relationships of multiple users, the transaction relationships in the transaction relationship map are complex and it is difficult to quickly and accurately identify abnormal users through the transaction relationship map. Summary of the invention

[0004] The present application provides a transaction relationship graph processing method, apparatus, computer equipment, storage medium and computer program product, which can reduce the complexity of the transaction relationship graph, provide financial practitioners with more reliable abnormal user identification data, and assist financial practitioners in quickly and accurately identifying abnormal users.

[0005] The first aspect of the present application provides a transaction relationship graph processing method, the method comprising:

[0006] Match the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects;

[0007] Determine a first similarity and a second similarity between each sub-graph and the reference anomaly graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph;

[0008] Determine the third similarity between each sub-graph and the original abnormal graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

[0009] According to the first similarity, the second similarity and the third similarity corresponding to each sub-graph, abnormal user mining is performed on the target transaction relationship image.

[0010] A second aspect of the present application provides a trust payment device, the device comprising:

[0011] A matching determination module is used to match the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects;

[0012] A first determination module is used to determine a first similarity and a second similarity between each sub-graph and a reference anomaly graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph;

[0013] The second determination module is used to determine the third similarity between each sub-graph and the original abnormal graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

[0014] The processing module is used to perform abnormal user mining processing on the target transaction relationship image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph.

[0015] A third aspect of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the above methods are implemented:

[0016] A fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of any of the above methods when the computer program is executed by a processor.

[0017] A fifth aspect of the present application provides a computer program product, including a computer program, which implements the steps of any of the above methods when the computer program is executed by a processor.

[0018] The present application provides a transaction relationship graph processing method, device, computer equipment, storage medium and computer program product, the method comprising: matching the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects; determining a first similarity and a second similarity between each sub-graph and the reference anomaly graph; the first similarity is used to characterize the degree of similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the degree of similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph; determining a third similarity between each sub-graph and the original anomaly graph; the third similarity is used to characterize the degree of similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original anomaly graph; and performing abnormal user mining processing on the target transaction relationship image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph. The transaction relationship graph processing method provided in the present application compares the transaction relationship graph with the abnormal graph from the graph structure similarity dimension, the graph semantic information similarity dimension and the knowledge graph information dimension. The multi-dimensional similarity comparison is more accurate than the prior art which only uses a single-dimensional similarity comparison. In addition, the present application adds a similarity comparison in the knowledge graph dimension. Since the knowledge graph can more comprehensively reflect the information of the graph and the comparison information provided is more in-depth, the accuracy of the comparison result is further increased. Therefore, the transaction relationship graph obtained by processing the transaction relationship graph using the method provided in the present application can provide more reliable mining information for financial practitioners, so that financial practitioners can quickly and accurately mine abnormal users based on the processed transaction relationship graph, thereby improving the auxiliary effect on financial practitioners. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is an application environment diagram of a transaction relationship graph processing method in one embodiment;

[0020] Figure 2 A schematic diagram of a flow chart of a transaction relationship graph processing method in another embodiment;

[0021] FIG3( a ) is a diagram showing the effect of a spectrum matching;

[0022] Figure 3(b) is another effect diagram of spectrum matching;

[0023] Figure 3(c) is another effect diagram of graph matching;

[0024] Figure 4 A schematic diagram of a flow chart of a transaction relationship graph processing method in another embodiment;

[0025] Figure 5 A rendering for forming a reconstructed atlas;

[0026] Figure 6 A schematic diagram of a flow chart of a transaction relationship graph processing method in another embodiment;

[0027] Figure 7 A schematic diagram of a flow chart of a transaction relationship graph processing method in another embodiment;

[0028] Figure 8 The effect diagram of rearranging the historical abnormal transaction relationship graph to obtain multiple original abnormal graphs;

[0029] Fig. 9 A schematic diagram of a flow chart of a transaction relationship graph processing method in another embodiment;

[0030] Fig.10 To obtain the effect diagram of the sub-graph;

[0031] Fig.11 It is a structural block diagram of a transaction relationship graph processing device in one embodiment;

[0032] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0034] The transaction relationship graph processing method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Financial practitioners input the target transaction relationship graph to the server 104 through the terminal 102, and the server 104 matches the target transaction graph with multiple reference anomaly graphs, and selects multiple sub-graphs that match the graph structure of the reference anomaly graph from the target transaction graph, and then calculates the graph structure similarity, semantic information similarity, and knowledge graph information similarity between the sub-graph and the reference anomaly graph, and the sub-graph and the original anomaly graph. Finally, according to the multiple similarities of each sub-graph, the target transaction relationship graph is processed for abnormal user mining. The transaction relationship graph processing method provided in the present application will be matched from the dimensions of graph structure similarity, graph semantic information similarity, and knowledge graph information. The easy relationship map is compared with the abnormal map, and the comparison of multi-dimensional similarity is more accurate than the comparison of single-dimensional similarity in the prior art; and the present application adds the similarity comparison of the knowledge map dimension. Since the knowledge map can more comprehensively reflect the information of the map and the comparison information provided is more in-depth, the accuracy of the comparison result is further increased. Therefore, the transaction relationship map obtained by processing the transaction relationship map by the method provided by the present application can provide more reliable mining information for financial practitioners, so that financial practitioners can quickly and accurately mine abnormal users according to the processed transaction relationship map, thereby improving the auxiliary effect for financial practitioners. Among them, the terminal 102 can be, but not limited to, various personal computers, laptops, smart phones, tablet computers, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0035] In one embodiment, Figure 2 As shown, a transaction relationship graph processing method is provided, and the method is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0036] Step S202, matching the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects.

[0037] The target transaction relationship graph can be obtained by financial practitioners from a historical transaction database, or received from other servers or terminals. The processing server provided in this application can be a server set up by a financial institution to process the transaction relationship graph, or it can be a public server that can be used by all financial institutions and connected to all financial institutions to receive processing requests sent by different financial institutions. This application does not limit this.

[0038] The target transaction relationship map is what the financial institution needs to process so that financial practitioners can conduct a transaction relationship map of abnormal users. The transaction relationship map is established based on the transaction objects as nodes and the transaction relationships between the transaction objects as the node connection basis, so the target transaction relationship map includes multiple transaction objects and the transaction relationships between multiple transaction objects. The target transaction relationship map can be a transaction relationship map of all transaction objects within a preset time period of the financial institution, a transaction relationship map of all transaction objects in a certain area within a period of time when the financial institution is divided by region, or a transaction relationship map of multiple transaction objects from a certain transaction terminal within a period of time when the financial institution is divided by transaction terminals. This application does not limit this.

[0039] The target transaction relationship map can be obtained through the following steps: first, the server of the financial institution extracts the information of all transaction objects within a certain time period from the corresponding memory address according to the demand (it can be the name, code, transaction account number and other information of the transaction object), and then the transaction objects can be sorted in chronological order (it can be sorted from far to near according to the time of the first transaction of the transaction object, which is not limited in this application), and further, based on the sorting of all transaction objects, all transaction information of the corresponding transaction objects are obtained from the memory address in order (the transaction information includes: the object that transacts with the transaction object, the number of transactions, the specific information of the transaction, the time of the transaction, etc.); finally, each object of the transaction pair is arranged according to the transaction relationship according to the map arrangement method (generally arranged in a tree shape), until the maps corresponding to all transaction objects are arranged, and then a large map is generated based on the maps of all transaction objects (it can be a hash connection method to connect multiple small transaction relationship maps to obtain a large transaction relationship map, which is not limited in this application), and the large map here is the target transaction relationship map. Alternatively, a model for establishing a transaction relationship map may be set up on the server of a financial institution, and all transaction objects for which a transaction relationship map needs to be established and the relationships between transaction objects need to be input into the model to obtain the target transaction relationship map. This application does not limit this, and the above is only an example.

[0040] The reference abnormal map is a transaction relationship map obtained by the server of a financial institution based on abnormal users and transaction relationships of abnormal users identified historically. The transaction objects in the reference abnormal map are all abnormal users marked by the server of the financial institution (abnormal users may be users who have conducted financial transactions prohibited by the financial institution). Therefore, by matching the target transaction relationship map with the reference abnormal map, it is possible to identify whether the target transaction relationship map contains abnormal users. The method of obtaining the reference abnormal map is similar to the method of obtaining the target transaction relationship map. The difference is that when the server of the financial institution obtains the reference abnormal map, the data obtained are all abnormal users and transaction relationship data of abnormal users identified historically. Then, the reference abnormal map can be obtained based on the above method, and this application does not limit this.

[0041] It should be noted that the reference anomaly map is obtained based on a large number of historical abnormal users and corresponding transaction relationships, so this application can provide a rich comparison object for the target transaction relationship map. And the reference anomaly map will add the abnormal users and corresponding transaction relationships that are continuously identified into the database of the reference anomaly map, further enriching the anomaly map database used for comparison.

[0042] The graph structure matching characterization matches the target transaction relationship graph with the graph structures of multiple reference abnormal graphs to determine whether there is a transaction object in the target transaction relationship graph whose graph structure is similar or identical to the graph structure of the reference abnormal graph. If so, the server of the financial institution can preliminarily determine that the transaction object may be an abnormal user. If not, the server of the financial institution can determine that there is no abnormal user in the target transaction relationship graph, and no similarity calculation step is required, which can improve the efficiency of the comparison. Further, if the server of the financial institution determines that there is a graph structure in the target transaction relationship graph that is similar or identical to the graph structure of the reference abnormal graph, the part of the graph that is similar or identical to the reference abnormal graph structure is segmented out as a sub-graph, so that the sub-graph can be used to participate in the similarity calculation process with the reference abnormal graph in the subsequent process. It should be noted that the target transaction relationship graph may not be obtained by restoring multiple sub-graphs, because there are graphs in the target transaction relationship graph that do not match the graph structure of the reference abnormal graph.

[0043] The results of the graph structure matching include: the same graph structure, similar graph structure and different graph structure. For example, as shown in FIG3(a), it means that the graph structures of the two graphs are the same; for example, as shown in FIG3(b), it means that the graph structures of the two graphs are similar; and as shown in FIG3(c), it means that the graph structures of the two graphs are different.

[0044] Step S204, determining a first similarity and a second similarity between each sub-graph and the reference anomaly graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph.

[0045] Among them, after matching the target transaction relationship graph with multiple reference abnormal graphs based on the above graph structure, the preliminary screening of the target transaction relationship graph is achieved. That is, a huge target transaction relationship graph is divided into multiple sub-graphs whose transaction relationships are simpler than the target transaction relationship graph, so as to calculate the similarity between the sub-graphs and the reference abnormal graphs. Since the transaction relationship of the sub-graph is simple, the similarity calculation with the reference abnormal graph can be more accurate, the calculation process is also simpler, and the similarity calculation results can be obtained quickly. It should be noted that when performing the similarity calculation, only the similarity between the sub-graphs with similar or identical graph structures and the reference graph is calculated.

[0046] After the target transaction relationship graph is segmented to obtain multiple sub-graphs, the multiple sub-graphs and the multiple reference graphs may be converted into a matrix form, and the first similarity of the two matrices may be calculated according to the similarity calculation formula based on the graph structure. Before calculating the similarity based on the two matrices, the two matrices may be iteratively operated respectively, and then the similarity may be calculated. Exemplarily, the calculation may be performed using the following formula:

[0047] SSimX={x1(k),x2(k),...x i (k)}

[0048] SSimY={y1(k), y2(k), ...y i (k)}

[0049] Among them, SSimX represents the node similarity score matrix between the sub-graph and the reference graph; SSimY represents the edge similarity score matrix between the sub-graph and the reference graph; x i (k) represents the similarity between each node in the sub-graph and the reference graph after K iterations; y i (k) represents the similarity between the sub-graph and the edges in the reference graph after K iterations. Each transaction object in the sub-graph is a node, each abnormal user in the reference graph is a node, and the edge represents the transaction relationship between two nodes.

[0050] The similarity between the sub-graph and the reference graph matrix is ​​estimated by taking the average value, and the formula is as follows:

[0051]

[0052] ni Indicates the number of nodes in the graph (sub-graph n1 and reference graph n2); m i Represents the number of edges in the graph (sub-graph m1 and reference graph m2).

[0053] After the target transaction relationship graph is segmented to obtain multiple sub-graphs, the second similarity of the two matrices can be calculated according to a similarity calculation formula based on statistical semantic information. Exemplarily, the calculation can be performed using the following formula:

[0054]

[0055] Where p(e i |G2) indicates that the statistical language model of graph G2 (graph to be matched) can generate word e i The probability of e i In multiple triple models, the probability p(e i |f j ), n and m are the numbers of subgraphs in the reference graph G1 and the graph to be matched G2, respectively.

[0056] Step S206, determining the third similarity between each sub-graph and the original abnormal graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph.

[0057] The third similarity can be obtained by inputting the multiple sub-graphs determined after segmenting the target transaction relationship graph into a preset classifier. The classifier is, for example, an SVDD classifier. The SVDD classifier can obtain a spherical boundary around the data in the vector space extracted from the knowledge graph, so that the volume of the hypersphere is minimized, thereby minimizing the impact of outliers. The calculation formula is as follows:

[0058]

[0059] Among them, a is the center of the hypersphere, R is the radius of the hypersphere, C is the penalty coefficient, δ i is a slack variable, and n is the number of points to be matched.

[0060] Here, it should be noted that the above-mentioned multiple reference abnormal graphs are screened out from multiple original abnormal graphs, and have abnormal graphs with similar or identical graph structures to the sub-graphs in the target transaction relationship graph.

[0061] Step S208, performing abnormal user mining on the target transaction relationship graph according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph.

[0062] Among them, according to the above calculation steps, the first similarity, the second similarity, and the third similarity of each sub-graph with a reference abnormal graph that is similar or identical to its structure are obtained, and the similarity with the original abnormal graph can be the smallest of the three similarities as the final similarity between the sub-graph and the abnormal graph, or the largest of the three similarities as the final similarity between the sub-graph and the abnormal graph, or the sum of the three similarities as the final similarity between the sub-graph and the abnormal graph, etc., which is not limited in this application. Different financial institutions can have different determination methods. After determining the similarity between each sub-graph and the abnormal graph, based on the similarity threshold set by the financial institution, it can be determined whether the corresponding sub-graph is the target sub-graph. Finally, the multiple target sub-graphs obtained can be determined, which can be the result of using the multiple target sub-graphs as the result of abnormal user mining processing on the target transaction relationship graph; or multiple sub-graphs can be combined into one graph, and this one graph can be used as the result of abnormal user mining processing on the target transaction relationship graph, etc., which is not limited in this application. Financial practitioners can identify abnormal users based on the mining results of abnormal users in the target transaction relationship graph through the above method. Since the transaction objects in the graph obtained after processing have a high similarity with the transaction relationship of abnormal users, it can assist financial practitioners in quickly and accurately identifying abnormal users, thereby improving the efficiency of financial practitioners in identifying abnormal users.

[0063] The present application provides a transaction relationship graph processing method, which includes: matching the target transaction relationship graph with multiple reference abnormal graphs to determine multiple sub-graphs that match the multiple reference abnormal graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference abnormal graph is used to characterize the transaction relationship between multiple abnormal objects; determining a first similarity and a second similarity between each sub-graph and the reference abnormal graph; the first similarity is used to characterize the degree of similarity between the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used to characterize the degree of similarity between the semantic information of the sub-graph and the semantic information of the reference abnormal graph; determining a third similarity between each sub-graph and the original abnormal graph; the third similarity is used to characterize the degree of similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph; and performing abnormal user mining processing on the target transaction relationship image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph. The transaction relationship graph processing method provided in the present application compares the transaction relationship graph with the abnormal graph from the graph structure similarity dimension, the graph semantic information similarity dimension and the knowledge graph information dimension. The multi-dimensional similarity comparison is more accurate than the prior art which only uses a single-dimensional similarity comparison. In addition, the present application adds a similarity comparison in the knowledge graph dimension. Since the knowledge graph can more comprehensively reflect the information of the graph and the comparison information provided is more in-depth, the accuracy of the comparison result is further increased. Therefore, the transaction relationship graph obtained by processing the transaction relationship graph using the method provided in the present application can provide more reliable mining information for financial practitioners, so that financial practitioners can quickly and accurately mine abnormal users based on the processed transaction relationship graph, thereby improving the auxiliary effect on financial practitioners.

[0064] In one embodiment, this embodiment is an optional method embodiment for obtaining the third similarity, and the method embodiment includes:

[0065] The sub-graph is input into a preset classifier to obtain the third similarity between each sub-graph and the original abnormal graph; the classifier is obtained by performing single classification learning on multiple original abnormal graphs based on the knowledge graph.

[0066] Among them, when calculating the third similarity between the sub-graph and the original abnormal graph, the sub-graph can be input into a preset classifier, and the third similarity between the sub-graph and the original abnormal graph can be determined after identification by the classifier. The classifier is obtained by single-classification learning of the original abnormal graph based on the knowledge graph, so the third similarity is determined from the dimension of the knowledge graph information. Since the knowledge graph can more comprehensively reflect the information of the graph and the comparison information provided is more in-depth, it can increase the accuracy of the comparison results between the sub-graph and the original abnormal graph. Multiple original abnormal graphs can be generated by the server of a financial institution based on the historical abnormal users and corresponding transaction relationships stored in the memory. The generation method is described above and will not be repeated here.

[0067] In one embodiment, Figure 4 As shown, this embodiment is an optional method embodiment for performing abnormal user mining processing on the target transaction relationship image according to similarity, and the method embodiment includes the following steps:

[0068] Step S402, performing weighted calculation according to the first similarity, the second similarity, the third similarity and the preset similarity weight corresponding to each sub-graph, to obtain the reference similarity corresponding to each sub-graph; if the reference similarity corresponding to the sub-graph is greater than the first threshold, executing step S404; if the reference similarity corresponding to the sub-graph is less than or equal to the first threshold, executing step S406;

[0069] Step S404, determining the sub-graph to be a target sub-graph;

[0070] Step S406, discard the sub-graph.

[0071] Among them, the first similarity, second similarity and third similarity corresponding to multiple sub-graphs of the target transaction relationship graph are obtained through the above steps. The server of the financial institution can be pre-set with weights for the first similarity, the second similarity and the third similarity, and then, the reference similarity of each sub-graph is obtained by weighted summation of the corresponding weights through the first similarity, the second similarity and the third similarity. The reference similarity represents the similarity between the sub-graph and the abnormal graph. The larger the reference similarity, the more similar the sub-graph is to the abnormal graph, which further indicates that the probability of an abnormal user existing in the sub-graph is greater. The weights of the exemplary first similarity, the second similarity, and the third similarity can be 0.1:0.3:0.6; then, after calculating the reference similarity of the sub-graph, the server of the financial institution can be compared with the reference similarity according to the preset first threshold value. Based on the principle that the larger the reference similarity described above, the more similar the sub-graph is to the abnormal graph, and further indicates that the probability of the existence of abnormal users in the sub-graph is greater, then the more the reference similarity is greater than the first threshold value, the greater the probability of the existence of abnormal users in the sub-graph, and the sub-graph is determined to be the target sub-graph, indicating that it can be used as a basis for subsequent financial practitioners to mine abnormal users. Further, if the reference similarity of the sub-graph is less than or equal to the first threshold value preset by the server of the financial institution, it means that the probability of the existence of abnormal users in the sub-graph is very small, then the transaction object in the sub-graph can be removed from the list of suspected abnormal users, and it is not used as a basis for subsequent financial practitioners to mine abnormal users. It should be noted that the preset similarity weight can be determined by the financial institution based on historical similarity data. The first threshold value can also be determined by the financial institution based on historical similarity data.

[0072] Step S408, generating a reconstructed atlas based on all target sub-atlases obtained in step S404, if the information entropy of the reconstructed atlas is greater than the second threshold, executing step S410; if the information entropy of the reconstructed atlas is less than or equal to the second threshold, executing step S412;

[0073] Step S410, performing abnormal user mining on the target transaction relationship image according to the reconstructed graph;

[0074] Step S412, adjusting the preset similarity weight according to the preset adjustment rule; updating the reference similarity corresponding to the sub-graph according to the first similarity score, the second similarity score and the third similarity score of each sub-graph and the adjusted preset similarity weight.

[0075] Among them, based on the above steps, multiple sub-graphs are screened to obtain multiple target sub-graphs. Multiple target sub-graphs can be connected, and hash connections can be used to connect multiple target sub-graphs to obtain a complete reconstructed graph as much as possible, which is convenient for financial practitioners to mine abnormal users. After the reconstructed graph is generated, it is necessary to verify the reconstructed graph. The verification method is to verify it by calculating the information entropy of the reconstructed graph. The calculation of information entropy can be determined by an evaluation model, etc., and this application does not limit this. For example, Figure 5 As shown, it means that multiple target sub-graphs are connected to form a reconstructed graph.

[0076] Then, when verifying the reconstructed graph, two results can be obtained: the information entropy of the reconstructed graph is greater than the second threshold and the information entropy of the reconstructed graph is less than or equal to the second threshold, wherein the information entropy of the reconstructed graph is greater than the second threshold, indicating that the accuracy of the reconstructed graph obtained by the above steps for mining abnormal users is high, and the reconstructed graph can be output to assist financial practitioners in mining abnormal users quickly and accurately. The information entropy of the reconstructed graph is less than or equal to the second threshold, indicating that the accuracy of the reconstructed graph obtained by the above steps for mining abnormal users is low, and it cannot well assist financial practitioners in mining abnormal users quickly and accurately. Then the server of the financial institution can adjust the preset similarity weights used initially according to the greedy algorithm, etc., so as to re-determine multiple target sub-graphs, generate a new reconstructed graph according to the new target sub-graphs, and further verify the information entropy of the new reconstructed graph until a reconstructed graph with an information entropy greater than the second threshold is obtained, and the server of the financial institution can output the reconstructed graph.

[0077] The transaction relationship graph processing method provided in the present application determines the target sub-graph from multiple sub-graphs by setting corresponding thresholds, screens the multiple sub-graphs to obtain multiple target sub-graphs, and connects the multiple target sub-graphs to obtain a reconstructed graph, which is convenient for financial practitioners to mine abnormal users based on the reconstructed graph. At the same time, before outputting the reconstructed graph, a process for verifying the reconstructed graph is added, which further ensures that the output graph can provide reliable data support for financial practitioners to mine abnormal users.

[0078] In one embodiment, Figure 6 As shown, Figure 6 An optional method embodiment for determining the original abnormality spectrum in this embodiment includes the following steps:

[0079] Step S602, obtaining a plurality of historical abnormal transaction relationship maps, wherein the historical abnormal transaction relationship maps represent the multi-dimensional transaction relationship between a plurality of abnormal objects.

[0080] Among them, multiple historical abnormal transaction relationship maps can be obtained by the server of the financial institution from the corresponding storage address. For the method of obtaining the historical abnormal transaction relationship map, see the above description and will not be repeated here. It should be noted here that the multi-dimensional abnormal transaction relationship (that is, the node connection relationship of the multi-tree structure) displayed in the historical abnormal transaction relationship map, if the multi-dimensional abnormal transaction relationship is compared, the workload is very large and the comparison accuracy is low.

[0081] Step S604, rearrange the multiple historical abnormal transaction relationship graphs according to a preset topological sorting rule to obtain multiple original abnormal graphs.

[0082] Among them, based on the drawbacks of the above-mentioned multi-dimensional abnormal transaction relationship map in the comparison process, the server of the financial institution can rearrange the historical abnormal transaction relationship map before comparing the target transaction relationship map to obtain multiple original abnormal maps representing a single transaction relationship between multiple abnormal objects.

[0083] Alternatively, if Figure 7 As shown, the original abnormal map can be obtained by the following method:

[0084] Step S702, selecting any target abnormal object with an in-degree of zero from the historical abnormal relationship graph as a root node and selecting multiple other abnormal objects as subtrees, wherein the other abnormal objects are abnormal objects in the historical abnormal relationship graph that have a transaction relationship with the target abnormal object except the target abnormal object.

[0085] Step S704, constructing an original abnormal graph according to the root node and multiple subtrees.

[0086] Among them, the abnormal user relationship graph can be topologically sorted by using the Kahn algorithm: multiple abnormal objects with zero in-degree (indicates that the number of arcs with a certain abnormal object as the arc head and ending at the abnormal object as the node is zero, that is, the abnormal object has only external transactions, and no other abnormal objects have transactions with the abnormal object) are selected from the historical abnormal relationship graph as root nodes, and then a target abnormal object (node) with zero in-degree is randomly selected as the root node, and then all abnormal objects that have a transaction relationship with the target abnormal object are determined from the historical abnormal relationship graph as subtrees, and the connection of the transaction relationship is followed. The root node and the subtree are connected by a connection relationship to obtain an original anomaly graph; then for the previous root node as the only in-degree transaction object, the in-degree at this time is also zero, and then a target anomaly object with an in-degree of zero is randomly selected from the historical anomaly relationship graph as the root node, and then all anomaly objects that have a transaction relationship with the target anomaly object are determined from the historical anomaly relationship graph as subtrees, and the root node and the subtree are connected according to the connection relationship of the transaction relationship, and then an original anomaly graph is obtained, until there is no anomaly object with an in-degree of zero in the historical anomaly transaction relationship graph (that is, no node without a predecessor is found).

[0087] For example, Figure 8 As shown, Q is a historical abnormal transaction relationship graph. The nodes with zero in-degree in the graph are: a, i. Randomly select a as a root node, then the nodes with transaction relationship with a include: b, c, d. Connect a with b, c, d according to the transaction relationship to obtain an original abnormal graph G1; then the nodes with zero in-degree in Q are: c, i. Randomly select c as a root node, then the nodes with transaction relationship with c include: h, e, f. Connect c with h, e, f according to the transaction relationship to obtain an original abnormal graph G2; then the nodes with zero in-degree in Q are: f, i. Randomly select c as a root node, then the nodes with transaction relationship with c include: h, e, f. Connect c with h, e, f according to the transaction relationship to obtain an original abnormal graph G2; then the nodes with zero in-degree in Q are: f, i. Select i as a root node, then the nodes that have a transaction relationship with i include: h, e, connect i with h and e according to the transaction relationship to get an original abnormal graph G3; then at this time, the only node with zero in-degree in Q is: f, take f as a root node, then the nodes that have a transaction relationship with f include: j, connect f and j according to the transaction relationship to get an original abnormal graph G4, so far, there are no predecessor nodes in the Q graph, then the division of the historical abnormal transaction relationship graph is completed, it can be seen that the transaction relationship in Q is a multi-dimensional transaction relationship, and the transaction relationship in G1-G4 is a single transaction relationship.

[0088] The transaction relationship graph processing method provided in the present application simplifies the transaction relationship of each abnormal object in the historical abnormal transaction relationship graph by rearranging the historical abnormal transaction relationship graph according to a preset topological sorting rule, thereby facilitating a more refined comparison in the subsequent process and improving the accuracy of the comparison.

[0089] In one embodiment, Fig. 9 As shown, Fig. 9 An optional method embodiment of obtaining multiple reference anomaly maps provided in this embodiment includes the following steps:

[0090] Step S902, matching the transaction data of the abnormal objects in the multiple original abnormal graphs with the transaction data of the transaction objects in the target transaction relationship graph;

[0091] Step S904, screening the multiple original abnormal graphs according to the matching results to obtain multiple reference abnormal graphs.

[0092] Among them, after processing multiple historical abnormal transaction relationship maps by the above method, multiple original abnormal maps are obtained. Since the target transaction relationship map does not have similarity with multiple original abnormal maps, if the target transaction relationship map is calculated with multiple original abnormal maps one by one, the complexity of the calculation is increased, and at the same time, the processing efficiency of the target transaction relationship map is reduced. Therefore, after obtaining multiple original abnormal maps, the target transaction relationship map is matched with multiple original abnormal maps for map structure, and partial maps of the target transaction relationship map with similar or identical structures are selected as sub-maps, and the original abnormal maps with similar or identical structures as the sub-maps are used as reference abnormal maps, and the sub-maps are correspondingly calculated with the reference maps for similarity, so as to improve the processing efficiency of the target transaction relationship map.

[0093] For example, Fig.10 As shown, Fig.10 G1-G10 in the figure are the original abnormal graphs. After comparison with the target relationship graph, reference abnormal graphs G2, G4, G6, G7, and G8 with similar or identical structures to some of the target relationship graphs are obtained. Then, the structures identical to G2, G4, G6, G7, and G8 in the target transaction relationship graph are extracted as sub-graphs.

[0094] The transaction relationship graph processing method provided in the present application achieves multiple goals at one stroke by filtering reference abnormal graphs from the original abnormal graph through comparison structure, and filtering sub-graphs from the target transaction relationship graph. Further, the similarity between the sub-graphs with the same or similar structures and the reference abnormal graph is calculated, which can reduce the calculation process and improve the processing efficiency of the target transaction relationship graph.

[0095] In one embodiment, this embodiment is an optional method embodiment for calculating information entropy, and the embodiment includes the following steps:

[0096] The reconstructed graph is input into the preset evaluation model to obtain the information entropy of the target transaction relationship graph. The information entropy calculated by the evaluation model can be calculated by the following formula:

[0097] I(A, B) = H(A) + H(B) - H(A, B)

[0098] in,

[0099]

[0100]

[0101]

[0102] Among them, P A (a) is the probability of occurrence of vector elements in the reconstructed atlas, P B (a) is the probability of occurrence of vector elements in the original anomaly map, P A，B (a, b) is the probability of occurrence of the corresponding vector elements.

[0103] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0104] Based on the same inventive concept, the embodiment of the present application also provides a transaction relationship graph processing device for implementing the transaction relationship graph processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more transaction relationship graph processing device embodiments provided below can refer to the limitations of the transaction relationship graph processing method above, and will not be repeated here.

[0105] In one embodiment, Fig.11 As shown, a transaction relationship graph processing device 1000 is provided, comprising: a matching determination module 1002, a first determination module 1004, a second determination module 1006 and a processing module 1008, wherein:

[0106] The matching determination module 1002 is used to match the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to represent the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to represent the transaction relationship between multiple anomaly objects;

[0107] The first determination module 1004 is used to determine a first similarity and a second similarity between each sub-graph and the reference abnormal graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference abnormal graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference abnormal graph;

[0108] The second determination module 1006 is used to determine the third similarity between each sub-graph and the original abnormal graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

[0109] The processing module 1008 is used to perform abnormal user mining processing on the target transaction relationship image according to the first similarity, the second similarity and the third similarity corresponding to each sub-graph.

[0110] In one embodiment, the second determination module 1006 is specifically used to input the sub-graph into a preset classifier to obtain a third similarity between each sub-graph and the original abnormal graph; the classifier is obtained by performing single-classification learning on multiple original abnormal graphs based on the knowledge graph.

[0111] In one embodiment, the processing module 1008 is specifically used to perform weighted calculation according to the first similarity, the second similarity, the third similarity and the preset similarity weight corresponding to each sub-graph to obtain the reference similarity corresponding to each sub-graph; when the reference similarity corresponding to the sub-graph is greater than a first threshold, the sub-graph is determined to be a target sub-graph; a reconstructed graph is generated based on all target sub-graphs, and when the information entropy of the reconstructed graph is greater than a second threshold, abnormal user mining processing is performed on the target transaction relationship image according to the reconstructed graph.

[0112] In one embodiment, the above-mentioned device also includes: an acquisition arrangement module, which is used to obtain multiple historical abnormal transaction relationship maps, the historical abnormal transaction relationship maps represent the multidimensional transaction relationship between multiple abnormal objects; and rearrange the multiple historical abnormal transaction relationship maps according to a preset topological sorting rule to obtain multiple original abnormal maps.

[0113] In one embodiment, the above-mentioned device also includes: a screening module, which is used to match the transaction data of the abnormal objects in multiple original abnormal maps with the transaction data of the transaction objects in the target transaction relationship map; and screen the multiple original abnormal maps according to the matching results to obtain multiple reference abnormal maps.

[0114] In one embodiment, the above-mentioned acquisition arrangement module is specifically used to select any target abnormal object with an in-degree of zero as a root node from the historical abnormal relationship graph and select multiple other abnormal objects as subtrees. The other abnormal objects are abnormal objects in the historical abnormal relationship graph that have a transaction relationship with the target abnormal object except the target abnormal object; the original abnormal graph is constructed according to the root node and the multiple subtrees.

[0115] In one embodiment, the above-mentioned device also includes: an input module, which is used to input the reconstructed graph into a preset evaluation model to obtain the information entropy of the target transaction relationship graph.

[0116] In one embodiment, the above-mentioned device also includes: an adjustment and update module, which is used to adjust the preset similarity weight according to a preset adjustment rule when the information entropy of the reconstructed graph is less than or equal to a second threshold; and update the reference similarity corresponding to the sub-graph according to the first similarity score, the second similarity score and the third similarity score of each sub-graph and the adjusted preset similarity weight.

[0117] Each module in the above-mentioned transaction relationship graph processing device can be implemented in whole or in part by software, hardware or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0118] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.12 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store transaction relationship map processing data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a transaction relationship map processing method is implemented.

[0119] Those skilled in the art will understand that Fig.12The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0120] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0121] Match the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects;

[0122] Determine a first similarity and a second similarity between each sub-graph and the reference anomaly graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph;

[0123] Determine the third similarity between each sub-graph and the original abnormal graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

[0124] According to the first similarity, the second similarity and the third similarity corresponding to each sub-graph, abnormal user mining is performed on the target transaction relationship image.

[0125] In one embodiment, when the processor executes the computer program, the following steps are also implemented: the sub-graph is input into a preset classifier to obtain a third similarity between each sub-graph and the original abnormal graph; the classifier is obtained by performing single classification learning on multiple original abnormal graphs based on the knowledge graph.

[0126] In one embodiment, the processor further implements the following steps when executing the computer program: performing weighted calculation according to the first similarity, the second similarity, the third similarity and the preset similarity weight corresponding to each sub-graph to obtain the reference similarity corresponding to each sub-graph; when the reference similarity corresponding to the sub-graph is greater than a first threshold, determining the sub-graph to be a target sub-graph; generating a reconstructed graph based on all target sub-graphs, and when the information entropy of the reconstructed graph is greater than a second threshold, performing abnormal user mining processing on the target transaction relationship image according to the reconstructed graph.

[0127] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining multiple historical abnormal transaction relationship maps, the historical abnormal transaction relationship maps representing the multidimensional transaction relationship between multiple abnormal objects; rearranging the multiple historical abnormal transaction relationship maps according to a preset topological sorting rule to obtain multiple original abnormal maps.

[0128] In one embodiment, when the processor executes the computer program, the following steps are also implemented: matching the transaction data of the abnormal objects in the multiple original abnormal maps with the transaction data of the transaction objects in the target transaction relationship map; screening the multiple original abnormal maps according to the matching results to obtain multiple reference abnormal maps.

[0129] In one embodiment, when the processor executes the computer program, the following steps are also implemented: selecting any target abnormal object with an in-degree of zero as a root node from the historical abnormal relationship graph and selecting multiple other abnormal objects as subtrees, where the other abnormal objects are abnormal objects in the historical abnormal relationship graph that have a transaction relationship with the target abnormal object except the target abnormal object; and constructing an original abnormal graph based on the root node and the multiple subtrees.

[0130] In one embodiment, when the processor executes the computer program, the following steps are also implemented: inputting the reconstructed graph into a preset evaluation model to obtain the information entropy of the target transaction relationship graph.

[0131] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the information entropy of the reconstructed graph is less than or equal to a second threshold, the preset similarity weight is adjusted according to a preset adjustment rule; and the reference similarity corresponding to the sub-graph is updated according to the first similarity score, the second similarity score and the third similarity score of each sub-graph and the adjusted preset similarity weight.

[0132] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0133] Match the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects;

[0134] Determine a first similarity and a second similarity between each sub-graph and the reference anomaly graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph;

[0135] Determine the third similarity between each sub-graph and the original abnormal graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

[0136] According to the first similarity, the second similarity and the third similarity corresponding to each sub-graph, abnormal user mining is performed on the target transaction relationship image.

[0137] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the sub-graph is input into a preset classifier to obtain a third similarity between each sub-graph and the original anomaly graph; the classifier is obtained by performing single classification learning on multiple original anomaly graphs based on the knowledge graph.

[0138] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: weighted calculation is performed based on the first similarity, the second similarity, the third similarity and the preset similarity weight corresponding to each sub-graph to obtain the reference similarity corresponding to each sub-graph; when the reference similarity corresponding to the sub-graph is greater than a first threshold, the sub-graph is determined to be a target sub-graph; a reconstructed graph is generated based on all target sub-graphs, and when the information entropy of the reconstructed graph is greater than a second threshold, abnormal user mining processing is performed on the target transaction relationship image according to the reconstructed graph.

[0139] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining multiple historical abnormal transaction relationship maps, the historical abnormal transaction relationship maps representing the multidimensional transaction relationship between multiple abnormal objects; rearranging the multiple historical abnormal transaction relationship maps according to a preset topological sorting rule to obtain multiple original abnormal maps.

[0140] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the transaction data of the abnormal objects in the multiple original abnormal maps with the transaction data of the transaction objects in the target transaction relationship map; screening the multiple original abnormal maps according to the matching results to obtain multiple reference abnormal maps.

[0141] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: any target abnormal object with an in-degree of zero is selected in turn from the historical abnormal relationship graph as a root node and multiple other abnormal objects are selected as subtrees, where the other abnormal objects are abnormal objects in the historical abnormal relationship graph that have a transaction relationship with the target abnormal object except the target abnormal object; and an original abnormal graph is constructed based on the root node and the multiple subtrees.

[0142] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: inputting the reconstructed graph into a preset evaluation model to obtain the information entropy of the target transaction relationship graph.

[0143] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the information entropy of the reconstructed graph is less than or equal to a second threshold, the preset similarity weight is adjusted according to a preset adjustment rule; and the reference similarity corresponding to the sub-graph is updated according to the first similarity score, the second similarity score and the third similarity score of each sub-graph and the adjusted preset similarity weight.

[0144] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0145] Match the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects;

[0146] Determine a first similarity and a second similarity between each sub-graph and the reference anomaly graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph;

[0147] Determine the third similarity between each sub-graph and the original abnormal graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph;

[0148] According to the first similarity, the second similarity and the third similarity corresponding to each sub-graph, abnormal user mining is performed on the target transaction relationship image.

[0149] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: the sub-graph is input into a preset classifier to obtain a third similarity between each sub-graph and the original anomaly graph; the classifier is obtained by performing single classification learning on multiple original anomaly graphs based on the knowledge graph.

[0150] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: weighted calculation is performed based on the first similarity, the second similarity, the third similarity and the preset similarity weight corresponding to each sub-graph to obtain the reference similarity corresponding to each sub-graph; when the reference similarity corresponding to the sub-graph is greater than a first threshold, the sub-graph is determined to be a target sub-graph; a reconstructed graph is generated based on all target sub-graphs, and when the information entropy of the reconstructed graph is greater than a second threshold, abnormal user mining processing is performed on the target transaction relationship image according to the reconstructed graph.

[0151] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining multiple historical abnormal transaction relationship maps, the historical abnormal transaction relationship maps representing the multidimensional transaction relationship between multiple abnormal objects; rearranging the multiple historical abnormal transaction relationship maps according to a preset topological sorting rule to obtain multiple original abnormal maps.

[0152] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: matching the transaction data of the abnormal objects in the multiple original abnormal maps with the transaction data of the transaction objects in the target transaction relationship map; screening the multiple original abnormal maps according to the matching results to obtain multiple reference abnormal maps.

[0153] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: any target abnormal object with an in-degree of zero is selected in turn from the historical abnormal relationship graph as a root node and multiple other abnormal objects are selected as subtrees, where the other abnormal objects are abnormal objects in the historical abnormal relationship graph that have a transaction relationship with the target abnormal object except the target abnormal object; and an original abnormal graph is constructed based on the root node and the multiple subtrees.

[0154] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: inputting the reconstructed graph into a preset evaluation model to obtain the information entropy of the target transaction relationship graph.

[0155] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the information entropy of the reconstructed graph is less than or equal to a second threshold, the preset similarity weight is adjusted according to a preset adjustment rule; and the reference similarity corresponding to the sub-graph is updated according to the first similarity score, the second similarity score and the third similarity score of each sub-graph and the adjusted preset similarity weight.

[0156] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0157] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0158] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0159] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A transaction relationship graph processing method, characterized in that: The method comprises: Matching the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects; Determine a first similarity and a second similarity between each of the sub-graphs and the reference anomaly graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph; Determine a third similarity between each of the sub-graphs and the original anomaly graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original anomaly graph; According to the first similarity, the second similarity and the third similarity corresponding to each of the sub-graphs, abnormal user mining is performed on the target transaction relationship graph.

2. The method according to claim 1, characterized in that The determining of the third similarity between each of the sub-graphs and the original abnormal graph comprises: The sub-graph is input into a preset classifier to obtain a third similarity between each of the sub-graphs and the original abnormal graph; the classifier is obtained by performing single-classification learning on multiple original abnormal graphs based on the knowledge graph.

3. The method according to claim 1, characterized in that The performing abnormal user mining processing on the target transaction relationship graph according to the first similarity, the second similarity and the third similarity corresponding to each of the sub-graphs includes: Performing weighted calculation according to the first similarity, the second similarity, the third similarity and a preset similarity weight corresponding to each of the sub-graphs to obtain a reference similarity corresponding to each of the sub-graphs; If the reference similarity corresponding to the sub-graph is greater than a first threshold, determining the sub-graph to be a target sub-graph; A reconstructed graph is generated based on all target sub-graphs. If the information entropy of the reconstructed graph is greater than a second threshold, abnormal user mining is performed on the target transaction relationship graph according to the reconstructed graph.

4. The method according to claim 2, characterized in that: The original anomaly graph is used to characterize a single transaction relationship between multiple anomaly objects. The method further includes: Acquire multiple historical abnormal transaction relationship maps, wherein the historical abnormal transaction relationship maps represent multi-dimensional transaction relationships between multiple abnormal objects; The multiple historical abnormal transaction relationship graphs are rearranged according to a preset topological sorting rule to obtain multiple original abnormal graphs.

5. The method according to claim 4, characterized in that The method further comprises: Matching the transaction data of the abnormal objects in the plurality of original abnormal graphs with the transaction data of the transaction objects in the target transaction relationship graph; The multiple original abnormal maps are screened according to the matching results to obtain the multiple reference abnormal maps.

6. The method according to claim 5, characterized in that The multiple historical abnormal transaction relationship graphs are rearranged according to a preset topological sorting rule to obtain multiple original abnormal graphs, including: Selecting any target abnormal object with an in-degree of zero from the historical abnormal relationship graph as a root node and selecting a plurality of other abnormal objects as subtrees, wherein the other abnormal objects are abnormal objects in the historical abnormal relationship graph that have a transaction relationship with the target abnormal object except the target abnormal object; The original anomaly graph is constructed according to the root node and multiple subtrees.

7. The method according to claim 3, characterized in that The method further comprises: The reconstructed graph is input into a preset evaluation model to obtain the information entropy of the target transaction relationship graph.

8. The method according to claim 7, characterized in that The method further comprises: If the information entropy of the reconstructed graph is less than or equal to the second threshold, adjusting the preset similarity weight according to a preset adjustment rule; The reference similarity corresponding to the sub-graph is updated according to the first similarity score, the second similarity score, the third similarity score of each sub-graph and the adjusted preset similarity weight.

9. A transaction relationship graph processing device, characterized in that: The device comprises: A matching determination module, used to match the target transaction relationship graph with multiple reference anomaly graphs to determine multiple sub-graphs that match the multiple reference anomaly graphs; the transaction relationship graph is used to characterize the transaction relationship between multiple transaction objects, and the reference anomaly graph is used to characterize the transaction relationship between multiple anomaly objects; A first determination module is used to determine a first similarity and a second similarity between each of the sub-graphs and the reference anomaly graph; the first similarity is used to characterize the similarity between the graph structure of the sub-graph and the graph structure of the reference anomaly graph, and the second similarity is used to characterize the similarity between the semantic information of the sub-graph and the semantic information of the reference anomaly graph; A second determination module is used to determine a third similarity between each of the sub-graphs and the original abnormal graph; the third similarity is used to characterize the similarity between the knowledge graph information of the sub-graph and the knowledge graph information of the original abnormal graph; A processing module is used to perform abnormal user mining on the target transaction relationship graph according to the first similarity, the second similarity and the third similarity corresponding to each of the sub-graphs.

10. The device according to claim 9, characterized in that The second determination module is specifically used to input the sub-graph into a preset classifier to obtain a third similarity between each of the sub-graphs and the original abnormal graph; the classifier is obtained by performing single classification learning on multiple original abnormal graphs based on the knowledge graph.

11. The device according to claim 9, characterized in that The processing module is specifically used to perform weighted calculation according to the first similarity, the second similarity, the third similarity and a preset similarity weight corresponding to each of the sub-graphs to obtain a reference similarity corresponding to each of the sub-graphs; when the reference similarity corresponding to the sub-graph is greater than a first threshold, determine that the sub-graph is a target sub-graph; generate a reconstructed graph based on all target sub-graphs, and when the information entropy of the reconstructed graph is greater than a second threshold, perform abnormal user mining processing on the target transaction relationship graph according to the reconstructed graph.

12. The device according to claim 9, characterized in that The device also includes: An acquisition arrangement module is used to acquire multiple historical abnormal transaction relationship maps, wherein the historical abnormal transaction relationship maps represent the multidimensional transaction relationship between multiple abnormal objects; and rearrange the multiple historical abnormal transaction relationship maps according to a preset topological sorting rule to obtain multiple original abnormal maps.

13. The device according to claim 12, characterized in that The device also includes: A screening module is used to match the transaction data of the abnormal objects in the multiple original abnormal maps with the transaction data of the transaction objects in the target transaction relationship map; and screen the multiple original abnormal maps according to the matching results to obtain the multiple reference abnormal maps.

14. The device according to claim 12, characterized in that The acquisition arrangement module is specifically used to select any target abnormal object with an in-degree of zero from the historical abnormal relationship graph as a root node and select multiple other abnormal objects as subtrees, wherein the other abnormal objects are abnormal objects in the historical abnormal relationship graph that have a transaction relationship with the target abnormal object except the target abnormal object; and construct the original abnormal graph according to the root node and the multiple subtrees.

15. The device according to claim 11, characterized in that The device also includes: An input module is used to input the reconstructed graph into a preset evaluation model to obtain the information entropy of the target transaction relationship graph.

16. The device according to claim 15, characterized in that The device also includes: An adjustment and update module is used to adjust the preset similarity weight according to a preset adjustment rule when the information entropy of the reconstructed map is less than or equal to the second threshold; and to update the reference similarity corresponding to the sub-map according to the first similarity score, the second similarity score and the third similarity score of each sub-map and the adjusted preset similarity weight.

17. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images