Abnormal entity identification method, device, equipment, storage medium and program product

Abstract

The present application provides an abnormal entity identification method, device, equipment, storage medium and program product, which relates to the field of knowledge graph technology. The method includes: obtaining a pre-constructed knowledge graph; calculating the relationship strength corresponding to the entity to be identified based on the relationship data of the entity to be identified; calculating the abnormal suspicion transfer coefficient of the entity to be identified based on the relationship strength corresponding to the entity to be identified; determining the abnormal suspicion based on the abnormal suspicion transfer coefficient of the entity to be identified; and identifying whether it is an abnormal entity based on the abnormal suspicion of the entity to be identified. The scheme of the present application can determine whether the entity to be identified is an abnormal entity, and can also determine the degree of abnormality of the entity to be identified.

Description

Technical Field

[0001] The present application relates to knowledge graph technology, and in particular to an abnormal entity recognition method, device, equipment, storage medium and program product. Background Art

[0002] With the increase in new types of telecom network crimes, banks and other financial institutions need to identify entities such as customers and their accounts in the course of handling business to determine whether they are abnormal entities, thereby reducing transaction risks.

[0003] Currently, the main method is to compare the information of the entity to be identified with the existing list of abnormal entities. The staff will identify the abnormal entity based on whether the entity to be identified appears in the existing list of abnormal entities and whether it is related to the abnormal entity.

[0004] Due to the low efficiency and strong subjectivity of manual identification, and the long period of obtaining abnormal entity information, the current identification of abnormal entities is not timely and accurate enough. Moreover, it can only determine whether the entity to be identified is an abnormal entity, but cannot determine the possibility of the entity to be identified becoming an abnormal entity in the future. Summary of the invention

[0005] The present application provides an abnormal entity identification method, device, equipment, storage medium and program product to solve the technical problem that the identification of abnormal entities in the prior art is not timely and accurate enough, and can only determine whether the entity to be identified is an abnormal entity, but cannot determine the possibility of the entity to be identified becoming an abnormal entity in the future.

[0006] According to a first aspect of the present application, a method for identifying an abnormal entity is provided, comprising:

[0007] Obtaining a pre-built knowledge graph including abnormal entities and entities to be identified, wherein the knowledge graph includes associations between entities and relationship data corresponding to each entity;

[0008] Calculate the relationship strength corresponding to the entity to be identified according to the relationship data of the entity to be identified;

[0009] Calculate the abnormal suspicion degree transfer coefficient of the entity to be identified according to the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities;

[0010] Determining the abnormal suspicion degree of the entity to be identified according to the abnormal suspicion degree transfer coefficient of the entity to be identified;

[0011] It is determined whether the entity to be identified is an abnormal entity according to the abnormal suspicion degree of the entity to be identified.

[0012] According to a second aspect of the present application, there is provided an abnormal entity identification device, comprising:

[0013] An acquisition module is used to acquire a pre-built knowledge graph including abnormal entities and entities to be identified, wherein the knowledge graph includes associations between entities and relationship data corresponding to each entity;

[0014] A first calculation module, used to calculate the relationship strength corresponding to the entity to be identified according to the relationship data of the entity to be identified;

[0015] A second calculation module is used to calculate the abnormal suspicion degree transfer coefficient of the entity to be identified according to the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities;

[0016] A determination module, configured to determine the abnormal suspicion degree of the entity to be identified according to the abnormal suspicion degree transfer coefficient of the entity to be identified;

[0017] The identification module is used to identify whether the entity to be identified is an abnormal entity according to the abnormal suspicion degree of the entity to be identified.

[0018] According to a third aspect of the present application, there is provided an electronic device, comprising: a memory, a processor and a transceiver;

[0019] The memory, the processor and the transceiver circuit are interconnected;

[0020] The memory stores computer-executable instructions;

[0021] The transceiver is used to send and receive data;

[0022] When the processor executes the computer-executable instructions stored in the memory, the method according to the first aspect is implemented.

[0023] According to a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0024] According to a fifth aspect of the present application, a computer program product is provided, comprising a computer program, which implements the method described in the first aspect when executed by a processor.

[0025] The abnormal entity identification method device, equipment, storage medium and program product of the present application obtain a pre-constructed knowledge graph including abnormal entities and entities to be identified, wherein the knowledge graph includes the association relationship between each entity and the relationship data corresponding to each entity, calculates the relationship strength corresponding to the entity to be identified according to the relationship data of the entity to be identified, and can quantify the closeness of the relationship between the entities as the relationship strength, calculates the abnormal suspicion degree transfer coefficient of the entity to be identified according to the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities, quantifies the degree to which the entity to be identified is affected by other entities as the abnormal suspicion degree transfer coefficient, determines the abnormal suspicion degree of the entity to be identified according to the abnormal suspicion degree transfer coefficient of the entity to be identified, quantifies the abnormal degree of other entities and the degree to which the entity to be identified is affected by other entities as the abnormal suspicion degree, determines the degree of abnormality of the entity to be identified, identifies whether the entity to be identified is an abnormal entity according to the abnormal suspicion degree of the entity to be identified, and can identify the entity to be identified with a high degree of abnormality as an abnormal entity. Therefore, it is possible to determine whether the entity to be identified is an abnormal entity and the degree of abnormality of the entity to be identified. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0027] Figure 1 is a network architecture diagram of the abnormal entity identification method provided in the embodiment of the present application;

[0028] Figure 2 It is a flowchart of the abnormal entity identification method provided according to the first embodiment of the present application;

[0029] Figure 3 It is a flowchart of an abnormal entity identification method provided according to the second embodiment of the present application;

[0030] Figure 4 is a flowchart of an abnormal entity identification method provided according to the third embodiment of the present application;

[0031] Figure 5 is a flowchart of an abnormal entity identification method provided according to the fourth embodiment of the present application;

[0032] Figure 6 is a flowchart of an abnormal entity identification method provided according to the fifth embodiment of the present application;

[0033] Figure 7 is a flowchart of an abnormal entity identification method provided according to the sixth embodiment of the present application;

[0034] Figure 8is a schematic diagram of the structure of an abnormal entity identification device provided according to the seventh embodiment of the present application;

[0035] Fig. 9 A block diagram of an electronic device provided for the eighth embodiment of the present application.

[0036] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0037] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0038] First, the terms involved in this application are explained:

[0039] Knowledge graph: It is composed of mutually related entities, entity attributes and the relationships between entities. It is a technical method that uses a graphical model to describe knowledge and model the relationships between all things in the world.

[0040] Entity: refers to an object that is an abstraction of something that exists objectively and is distinguishable. In this application, entities may include customers and their accounts.

[0041] Entity attributes: refers to the characteristics of an entity, such as whether the entity is an abnormal entity, the entity's name, location, contact information, and other information.

[0042] Relationships between entities: refers to the connection between an entity and other entities, the behaviors between an entity and other entities, and the connection between behaviors. For example, relationships between entities include: customers holding accounts, transfers between accounts, and transfers from accounts to the same account. Relationships between entities can be one-to-one, one-to-many, many-to-one, or many-to-many.

[0043] Relationship attributes: refers to the characteristics of the relationship between entities or the components that make up the relationship. An association relationship can have one or more relationship attributes.

[0044] Abnormal entity: refers to an entity with abnormalities. In this application, abnormal entities include abnormal customers and abnormal accounts.

[0045] Relationship strength: refers to the closeness of the association between entities. For example, the closer the association, the greater the relationship strength.

[0046] Abnormal suspicion: It is a quantitative evaluation value of the abnormality degree of the entity, which is generally a real number greater than 0.

[0047] Abnormal suspicion transfer coefficient: the ratio of abnormal suspicion that can be transferred between entities through association relationships.

[0048] The prior art involved in this application is described and analyzed in detail below.

[0049] At present, with the increase of new types of telecommunications network crimes, banks and other financial institutions need to identify entities such as customers and their accounts in the process of handling business, so as to determine whether there are any abnormalities in the customers and their accounts, and whether they are abnormal entities, so as to handle business selectively and reduce transaction risks.

[0050] At present, the main method is to compare the information of the entity to be identified with the existing list of abnormal entities, and the staff will check whether the entity to be identified is an abnormal entity in the list of abnormal entities, or the staff will conduct a background investigation on the entity to be identified and check whether the entity with a close relationship with the entity to be identified is an abnormal entity in the list of abnormal entities to identify the entity to be identified. Due to the low efficiency and strong subjectivity of manual identification, it is impossible to accurately judge the degree of influence between each relationship when faced with complex relationships between entities, and thus it is impossible to update the list of abnormal entities in real time. At the same time, obtaining the list of abnormal entities from a third party cannot ensure the real-time nature of the list of abnormal entities. All of these have led to the fact that the identification of abnormal entities in the prior art is not timely and accurate enough, and it can only determine whether the entity to be identified is an abnormal entity, but cannot determine the abnormal suspicion of the entity to be identified to quantify the degree of abnormality of the entity to be identified, and cannot determine the possibility of the entity to be identified becoming an abnormal entity in the future.

[0051] Therefore, in the face of technical problems in the prior art, the inventors, through the findings of creative research, proposed the technical solution of the present application, aiming to solve the above technical problems of the prior art. In order to improve the timeliness and accuracy of abnormal entity identification and determine the abnormal suspicion of the entity to be identified, it is necessary to obtain a knowledge graph including abnormal entities and entities to be identified, and quantify the abnormal degree of the entity to obtain the abnormal suspicion. Therefore, the inventor quantified the strength of the association between entities to obtain the relationship strength, determined the abnormal suspicion transfer coefficient between the two entities through the relationship strength, and determined the abnormal suspicion of all entities to be identified through the abnormal suspicion transfer coefficient and the abnormal entities already in the knowledge graph. Determining whether the entity to be identified is an abnormal entity based on the determined abnormal suspicion of the entity to be identified can not only determine whether the entity to be identified is an abnormal entity, but also determine the abnormal suspicion of the entity to be identified. When the entity to be identified is not an abnormal entity, determine its degree of abnormality.

[0052] The following is an introduction to the network architecture of the abnormal entity identification method provided in the embodiment of the present application.

[0053] Figure 1 is a network architecture diagram corresponding to an application scenario provided in an embodiment of the present application, such as Figure 1 As shown, a network architecture corresponding to an application scenario provided by an embodiment of the present application includes: an electronic device 11 and a server 12. The electronic device 11 is in communication connection with the server 12. The server 12 stores a knowledge graph of abnormal entities and entities to be identified, and the knowledge graph includes associations between entities and relationship data corresponding to each entity.

[0054] Among them, in one application scenario, the electronic device 11 can send a knowledge graph acquisition request to the server 12, and the server 12 can send a knowledge graph including abnormal entities and entities to be identified to the electronic device 11. After receiving the knowledge graph, the electronic device can calculate the relationship strength corresponding to the entity to be identified based on the relationship data of the entity to be identified, calculate the abnormal suspicion degree transfer coefficient of the entity to be identified based on the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities, determine the abnormal suspicion degree of the entity to be identified based on the abnormal suspicion degree transfer coefficient of the entity to be identified, and identify whether the entity to be identified is an abnormal entity based on the abnormal suspicion degree of the entity to be identified.

[0055] In another application scenario, the client of the abnormal entity recognition application software in the electronic device 11 or the electronic device 11 accesses the website of the abnormal entity recognition method. The user triggers the abnormal entity recognition request in the operation interface of the client by opening the client segment of the abnormal entity recognition application software. Alternatively, the user accesses the corresponding web page by entering the website corresponding to the abnormal entity recognition method in the search engine carried by the electronic device, and triggers the abnormal entity recognition request on the web page. The abnormal entity recognition request may include determining whether one or more entities are abnormal entities or obtaining the abnormal suspicion of one or more entities. After the user triggers the abnormal entity recognition request, the electronic device 11 receives the abnormal entity recognition request triggered by the user. The electronic device may send a knowledge graph acquisition request to the server 12 before or after receiving the abnormal entity recognition request triggered by the user and receive the knowledge graph sent by the server. The user may be a salesperson of a financial institution that needs to perform abnormal entity recognition, a salesperson of a unit or agency that needs to obtain the abnormal suspicion of abnormal entities and entities to be recognized, etc.

[0056] After the electronic device determines the abnormal suspicion degree of the entity to be identified, and identifies whether the entity to be identified is an abnormal entity based on the abnormal suspicion degree of the entity to be identified, one or more entities in the abnormal entity identification request can be matched with the entity to be identified or the abnormal entity in turn to determine whether one or more entities are abnormal entities, or determine the abnormal suspicion degree of one or more entities, and display it in real time in the client operation interface or web page of the abnormal entity identification application software, so that the user can view in real time whether one or more entities are abnormal entities, and can also display the abnormal suspicion degree of one or more entities, so that the user can view the abnormal suspicion degree corresponding to one or more entities in real time.

[0057] The following is a detailed description of the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. In the technical solution of the embodiment of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0058] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0059] Embodiment 1

[0060] Figure 2 is a flow chart of an abnormal entity identification method provided according to the first embodiment of the present application, such as Figure 2As shown, the execution subject of the present application is an abnormal entity recognition device. The abnormal entity recognition device is located in an electronic device. The abnormal entity recognition method provided in this embodiment includes the following steps.

[0061] Step 201, obtain a pre-built knowledge graph including abnormal entities and entities to be identified, the knowledge graph including the association relationship between entities and the relationship data corresponding to each entity.

[0062] In this embodiment, the electronic device can periodically send a request to the server to obtain a knowledge graph, and receive the knowledge graph sent by the server. The electronic device can also be directly set to periodically receive the knowledge graph sent by the server. The knowledge graph is a pre-built knowledge graph that includes abnormal entities and entities to be identified. The knowledge graph includes the association relationship between entities and the relationship data corresponding to each entity. In this embodiment, the entity can be a customer or an account. The association relationship between entities refers to a certain connection between entities and entities. This connection can be a connection between entity attributes, such as the same attributes, a connection between entity components, such as the same components, and a connection between entity behaviors, such as a certain behavior occurring at the same time.

[0063] For example, if the customers are employees of the same company, they have a colleague relationship; if the two customers are husband and wife, they have a husband and wife relationship; if the customer holds an account, the customer and the account have a holding relationship; if some accounts are used to handle the same financial business at the same time or within a period of time, these accounts have a simultaneous handling of the same business relationship; if two accounts have transactions, the two accounts have a transaction relationship. The association relationship may include family relationships, shared contact information, common contacts, email relationships, call relationships, superior-subordinate relationships, transactions, loans, shared physical addresses (MAC addresses), shared Internet Protocol addresses (IP addresses), and common phone calls at the same time or similar times.

[0064] The relationship data corresponding to an entity includes other entities that have an association relationship with the entity and the association relationships they have.

[0065] In this embodiment, the knowledge graph can be pre-constructed through the following steps: obtaining customer data, account data, and transaction data accumulated by banks and other financial institutions for many years; performing entity extraction on customer data and account data, and determining customers and accounts as entities; performing attribute extraction on customer data, account data, and transaction data to obtain entity attributes, which may include customer information and account information. Customer information may include customer location, customer contact information, customer name, accounts held by customers, etc. Account information may include account start time, account opening institution, and account transaction information, etc. Account transaction information may include transaction time, transaction amount, transaction IP address, etc. By comparing the entity attributes between different entities, the association relationship between entities is obtained. For example, the attributes of the account opening institution being the same institution have an association relationship; based on the association relationship between entities, the association relationship between entities is matched, and the knowledge graph is constructed to form the relationship data corresponding to each entity.

[0066] Step 202: Calculate the relationship strength corresponding to the entity to be identified based on the relationship data of the entity to be identified.

[0067] In this embodiment, for the convenience of description, other entities that have an association relationship with the entity to be identified are referred to as associated entities.

[0068] The relationship data of the entity to be identified includes: the associated entity and the association relationship between the entity to be identified and the associated entity.

[0069] Relationship strength refers to the degree of connection between an entity and other entities. It can be a quantified value of the closeness of a relationship or a collection of quantified values ​​of the closeness of all relationships.

[0070] The relationship strength corresponding to the entity to be identified refers to the relationship strength between the entity to be identified and the associated entity. In this embodiment, different attribute values ​​can be set in advance for all possible associated relationships, and the associated entity and the associated entity between the entity to be identified and the associated entity can be determined from the relationship data of the entity to be identified, and the attribute value of the associated relationship between the entity to be identified and the associated entity can be queried in the preset attribute values ​​of the associated relationship. If the number of associated relationships is determined to be 1, the attribute value of the associated relationship is used as the relationship strength corresponding to the entity to be identified. If the number of associated relationships is determined to be multiple, the set of all attribute values ​​of all associated relationships is used as the relationship strength corresponding to the entity to be identified.

[0071] In addition to the above implementations, other methods may be used to calculate the relationship strength of the entity to be identified, which is not limited in this embodiment.

[0072] Step 203 , calculating the abnormality suspicion transfer coefficient of the entity to be identified according to the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities.

[0073] The abnormal suspicion degree transfer coefficient of the entity to be identified refers to the abnormal suspicion degree transfer coefficient between the entity to be identified and the associated entities. In this embodiment, after step 202, the relationship strength between the entity to be identified and all associated entities can be obtained. If the obtained relationship strength is 1 value, the abnormal suspicion degree transfer coefficient of the entity to be identified can be: this value; if the obtained relationship strength is a set of multiple values, the abnormal suspicion degree transfer coefficient of the entity to be identified can be: the average value of all values ​​in the set.

[0074] In addition to the above implementations, other methods may be used to calculate the abnormal suspicion transfer coefficient of the entity to be identified, which is not limited in this embodiment.

[0075] Step 204: determining the abnormality suspicion degree of the entity to be identified according to the abnormality suspicion degree transfer coefficient of the entity to be identified.

[0076] In this embodiment, when the abnormal entity recognition method is performed for the first time, the abnormal suspicion of all abnormal entities can be set to SRmax, and the abnormal suspicion of all entities to be recognized can be set to 0. When the abnormal entity recognition method is not performed for the first time, the abnormal suspicion of the abnormal entity can be set to SRmax, and the abnormal suspicion of the entity to be recognized can be the abnormal suspicion determined by the last abnormal entity recognition method, or it can be reset to 0.

[0077] Specifically, the abnormal suspicion degree transfer coefficient of the entity to be identified can be multiplied by the abnormal suspicion degree of the associated entity, and the result of the operation is recorded as the abnormal suspicion degree of the entity to be identified. When the entity to be identified has multiple associated entities, the abnormal suspicion degree transfer coefficient between the entity to be identified and the multiple associated entities can be used to perform multiplication operations with the multiple associated entities respectively, and the multiple operation results are summed and recorded as the abnormal suspicion degree of the entity to be identified.

[0078] Step 205: Identify whether the entity to be identified is an abnormal entity based on the abnormal suspicion degree of the entity to be identified.

[0079] In this embodiment, a suspicion threshold may be preset to determine whether the abnormal suspicion of the entity to be identified is greater than the preset suspicion threshold. If it is determined to be greater than the preset suspicion threshold, the entity to be identified is determined to be an abnormal entity; if it is determined not to be greater than the preset suspicion threshold, the entity to be identified is determined not to be an abnormal entity. Optionally, the preset suspicion threshold may be a predetermined proportion of the abnormal suspicion of the abnormal entity. Exemplarily, the preset suspicion threshold is 90% of the abnormal suspicion of the abnormal entity.

[0080] The abnormal entity identification method provided in this embodiment obtains a pre-constructed knowledge graph including abnormal entities and entities to be identified, wherein the knowledge graph includes the association relationship between each entity and the relationship data corresponding to each entity, calculates the relationship strength corresponding to the entity to be identified according to the relationship data of the entity to be identified, calculates the abnormal suspicion degree transfer coefficient of the entity to be identified according to the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities, determines the abnormal suspicion degree of the entity to be identified according to the abnormal suspicion degree transfer coefficient of the entity to be identified, and identifies whether the entity to be identified is an abnormal entity according to the abnormal suspicion degree of the entity to be identified. The abnormal entity identification method provided in this application can calculate the relationship strength between the entity to be identified and other entities, and the relationship strength can quantify the strength of the association relationship between the entities, calculate the abnormal suspicion degree of the entity to be identified by using the relationship strength as the abnormal suspicion degree transfer coefficient, and determine whether the entity to be identified is an abnormal entity by the abnormal suspicion degree, which can not only determine whether the entity to be identified is an abnormal entity, but also quantify the degree of entity abnormality to determine the possibility of the entity to be identified becoming an abnormal entity in the future. It can be known from practical experience that abnormal entities usually have a relatively close association relationship, for example, they have a kinship relationship, a friend relationship, a shared physical address, etc. Therefore, by quantifying the association relationship and determining the abnormal suspicion of the entity to be identified based on the abnormal suspicion of all associated entities of the entity to be identified, the degree of abnormality of the entity to be identified can be obtained, and then the possibility of the entity to be identified becoming an abnormal entity in the future can be determined.

[0081] Embodiment 2

[0082] Figure 3 is a flow chart of an abnormal entity identification method provided in accordance with the second embodiment of the present application. Figure 3 As shown, the abnormal entity recognition method provided in this embodiment is based on the abnormal entity recognition method provided in the first embodiment. In step 201, the relationship data includes fixed class relationship data and behavior class relationship data.

[0083] Step 202 is to calculate the relationship strength corresponding to the entity to be identified according to the relationship data of the entity to be identified, which is refined into steps 301 to 302.

[0084] Step 301, respectively calculating the relationship strengths corresponding to the fixed-type relationship data and the behavior-type relationship data.

[0085] Fixed relationship data includes all fixed relationships between the entity to be identified and the associated entities. Behavioral relationship data includes all behavioral relationships between the entity to be identified and the associated entities. Specifically, all relationships between the entity to be identified and the associated entities are obtained from the relationship data of the entity to be identified, and each relationship is determined to be a fixed relationship or a behavioral relationship. Fixed relationships refer to relationships between entities, and behavioral relationships refer to relationships between entity behaviors. Exemplarily, superiors and subordinates, husband and wife, etc. are relationships between entities, which are fixed relationships; phone calls, loans, shared physical addresses, etc. are relationships between entity behaviors, which are behavioral relationships.

[0086] The average value of the attribute values ​​preset for each fixed association relationship may be used as the relationship strength of the fixed class relationship data.

[0087] The weighted average of the attribute value of each behavior association relationship and the weight of the behavior can be used as the relationship strength of the behavior relationship data. The attribute value of the behavior association relationship can be obtained by dimensionalizing the value of the attribute that best represents the association relationship in the relationship attribute of the association relationship. Exemplarily, the amount of the loan in the loan relationship is selected as the attribute value of the loan. The weight of the behavior can be pre-set according to different application scenarios of the abnormal entity recognition method. Exemplarily, the behavior relationship data of the entity to be identified and the associated entity include loan and call, the weight of the loan relationship is pre-set as the first weight, the weight of the call relationship is pre-set as the second weight, the amount of the loan is dimensionalized as the attribute value of the loan relationship, and the number of calls is dimensionalized as the attribute value of the call relationship, then the relationship strength of the behavior relationship data is: (attribute value of the loan relationship × first weight + attribute value of the call relationship × second weight) / 2.

[0088] Step 302: sum the relationship strengths corresponding to the fixed-type relationship data and the relationship strengths corresponding to the behavior-type relationship data to obtain the relationship strengths corresponding to the entity to be identified.

[0089] Specifically, the relationship strength corresponding to the fixed-type relationship data and the relationship strength corresponding to the behavior-type relationship data between the entity to be identified and the associated entity are summed, and the summed value is used as the relationship strength corresponding to the entity to be identified and the associated entity.

[0090] In this embodiment, by respectively calculating the relationship strengths corresponding to the fixed-type relationship data and the behavior-type relationship data and then summing them up, a more accurate relationship strength that reflects the strength of the relationship between entities can be obtained, and then a more accurate abnormal suspicion transfer coefficient between entities can be obtained, so as to obtain a more accurate abnormal suspicion of the entity.

[0091] Embodiment 3

[0092] Figure 4is a flow chart of an abnormal entity identification method provided according to the third embodiment of the present application, such as Figure 4 As shown, the abnormal entity recognition method provided in this embodiment is based on the abnormal entity recognition method provided in the second embodiment, and step 301 is refined to include steps 401 to 402.

[0093] Step 401: Obtain the relationship strength of each fixed association relationship of fixed class relationship data.

[0094] Specifically, the relationship strengths of all possible fixed association relationships may be preset, and the relationship strength of each association relationship in the fixed class relationship data may be searched.

[0095] Step 402: Calculate the relationship strength corresponding to the fixed class relationship data according to the relationship strength corresponding to each fixed association relationship.

[0096] Specifically, fixed associations with relationship strength greater than a predetermined value may be selected, and a set of relationship strengths of the selected fixed associations may be used as the relationship strength corresponding to the fixed class relationship data. Alternatively, the values ​​of the relationship strengths of all fixed associations may be formed into a set, and the set may be used as the relationship strength corresponding to the fixed class relationship data.

[0097] As an optional implementation, step 402 is further refined to include steps 4021 to 4023.

[0098] Step 4021, determining the number of attributes of each fixed association relationship.

[0099] Specifically, the attributes of each fixed association relationship may be directly queried in the relationship data, and the number of queried attributes may be counted.

[0100] Step 4022: If it is determined that the number of attributes is one, the quantitative score of the attribute is used as the relationship strength of the fixed association relationship.

[0101] If the number of attributes of the fixed association relationship is determined to be one, that is, the fixed association relationship has only one attribute, then the quantitative score of the attribute is directly used as the relationship strength of the fixed association relationship. The quantitative score of the attribute can be quantified by the preset quantification method attribute. For different fixed association relationships, different quantification methods can be preset to quantify their attributes.

[0102] Step 4023, if it is determined that there are multiple attributes, the quantitative scores of the key attributes are used as the relationship strength of the fixed association relationship;

[0103] If it is determined that there are multiple attributes of a fixed association relationship, the quantitative score of its key attribute can be selected as the relationship strength of the fixed association relationship. For a fixed association relationship with multiple attributes, its key attribute can be pre-set according to the scenario of abnormal entity recognition. For example, a husband-wife relationship has multiple attributes such as intimacy and duration of marriage, and intimacy is pre-set as its key attribute, then its relationship strength is the quantitative score of intimacy.

[0104] In addition to the above implementations, other methods may be used to calculate the relationship strength corresponding to the fixed-type relationship data, which is not limited in this embodiment.

[0105] In this embodiment, by pre-setting the quantitative score of the fixed association relationship, the relationship strength of the fixed class association relationship is determined, so that the relationship strength can more accurately reflect the closeness of the connection between entities, and thus make the subsequently determined abnormal suspicion transfer coefficient and abnormal suspicion more accurate, thereby improving the accuracy of determining whether the entity to be identified is an abnormal entity.

[0106] Embodiment 4

[0107] Figure 5 is a flow chart of an abnormal entity identification method provided according to the fourth embodiment of the present application, such as Figure 5 As shown, the abnormal entity recognition method provided in this embodiment is based on the abnormal entity recognition method provided in the second embodiment, and step 301 is refined to include steps 501 to 502.

[0108] Step 501: determine the attribute, time decay coefficient, attribute quantization score and attribute weight corresponding to each behavior association relationship of the behavior relationship data.

[0109] The attributes of each behavior association relationship are queried in the relationship data corresponding to each entity to determine the attributes corresponding to each behavior association relationship. The attributes corresponding to each behavior association relationship may be one or more.

[0110] The time when each behavior association occurs is queried in the relationship data corresponding to each entity, and the time decay coefficient is determined according to the time of occurrence. The time decay coefficient can be calculated by a preset time decay function, which can be a linear function, an exponential function, a Gaussian function, etc. By querying the time when each level of behavior relationship data occurs, with the current time as a reference, the longer the time interval with the current time, the greater the time decay coefficient of the association, and the shorter the time interval with the current time, the smaller the time decay coefficient of the association. The time decay coefficient can be a number between 0 and 1. Exemplarily, the time decay function is obtained as e -α×T, where e is a natural constant and α is the time decay rate. α can be a pre-set number used to adjust the rate at which the time decay coefficient changes over time. T is the interval between the time when the behavior occurs and the current time. T can be the number of days after the current time minus the time when the behavior occurs. If the calculated result is less than 0, 0 is taken. Furthermore, T can also be the number of days after the current time minus the time when the behavior occurs minus the offset correction time. The offset correction time is used to set a time range in which the time decay coefficient of a behavior-type relationship data does not decay. For example, the time decay coefficient of the association relationship that occurred in the last 3 days is set not to decay, and the value of the offset correction time is 3 days.

[0111] The attributes of each behavioral association relationship are dimensioned to obtain the quantitative scores of the attributes. Since the units of the attributes in the behavioral association relationship are different, the calculated values ​​of the same attribute may also vary greatly, which is not conducive to subsequent calculations. For example, for the amount attribute in the loan relationship, the amount of each loan may vary greatly. Therefore, it is necessary to dimension the attributes of the behavioral association relationship, for example, normalize them, so that the numbers are not relative, which is convenient for subsequent calculations. For example, compress all the amount values ​​in the loan relationship within the range of 0 to 1.

[0112] For different behavioral associations, attribute weights can be pre-set according to different scenarios where abnormal entity recognition is required or trained during the abnormal entity recognition method.

[0113] Step 502 : determining the relationship strength corresponding to each behavior association relationship according to the attribute corresponding to each behavior association relationship, the time decay coefficient, the quantitative score of the attribute, and the attribute weight.

[0114] The attribute, time decay coefficient, quantitative score of the attribute and weight of the attribute corresponding to each behavior association relationship may be multiplied, and the product is used as the relationship strength of the behavior association relationship.

[0115] In this embodiment, for a behavior association relationship with only one attribute, the product of the quantized score of the attribute and the time decay coefficient can be used as the relationship strength of the behavior association relationship. For a behavior association relationship with multiple attributes, the average value of the quantized score of each attribute, the weight of the attribute and the product of the time decay coefficient can be used as the relationship strength of the behavior association relationship.

[0116] Step 503: Calculate the relationship strengths corresponding to all behavior association relationships to obtain the relationship strengths corresponding to the behavior-type relationship data.

[0117] In this embodiment, when the behavior relationship data has only one behavior association relationship, the relationship strength of the behavior association relationship is the relationship strength corresponding to the behavior relationship data. When the behavior relationship data has multiple behavior association relationships, the set of relationship strengths of all behavior association relationships is used as the relationship strength corresponding to the behavior relationship data.

[0118] As an optional implementation, step 502 is further refined to include step 5021.

[0119] Step 5021, multiply the attribute, time decay coefficient, quantitative score of the attribute, and attribute weight corresponding to each behavior association relationship to obtain the relationship strength corresponding to each behavior association relationship.

[0120] In this embodiment, the relationship strength corresponding to each behavior association relationship may be the sum of the relationship strengths corresponding to each attribute of the behavior association relationship. The relationship strength corresponding to each attribute may be: the quantitative score of the attribute×the weight of the attribute×the time decay coefficient.

[0121] In this embodiment, by calculating the relationship strength corresponding to each behavior association relationship in the behavior relationship data, the relationship strength corresponding to the behavior relationship data and the relationship strength corresponding to the fixed relationship data are calculated separately, so that the relationship strength can more accurately reflect the closeness of the connection between entities, and then make the subsequent abnormal suspicion transfer coefficient and abnormal suspicion more accurate, and improve the accuracy of determining whether the entity to be identified is an abnormal entity. At the same time, for each behavior association relationship, the relationship strength corresponding to each attribute is calculated separately, so that the relationship strength corresponding to the behavior relationship data is more accurate.

[0122] Embodiment 5

[0123] Figure 6 is a flow chart of an abnormal entity identification method provided according to the fifth embodiment of the present application, such as Figure 6 As shown, the abnormal entity identification method provided in this embodiment is based on any of the above embodiments, and step 203 is refined into steps 601 to 603.

[0124] Step 601: determine the relationship weight according to the association relationship between the entity to be identified and other entities.

[0125] In this embodiment, specifically, it is determined whether there is an association relationship between the entity to be identified and other entities. If it is determined that there is an association relationship, the relationship weights of all the association relationships are determined. The relationship weight of any association relationship can be pre-set according to different association relationships. Specifically, the weight of each possible association relationship can be pre-set according to different scenarios of application of the abnormal entity identification method.

[0126] Step 602: If it is determined that the entity to be identified has an association relationship with another entity, the average value of the product of the relationship strength and the relationship weight corresponding to the entity to be identified is calculated to obtain the abnormality suspicion transfer coefficient of the entity to be identified.

[0127] The abnormal suspicion degree transfer coefficient of the entity to be identified is the abnormal suspicion degree transfer coefficient between the entity to be identified and the associated entity. Specifically, if it is determined that there is an association relationship between the entity to be identified and another entity, the abnormal suspicion degree transfer coefficient of the entity to be identified is: the average value of the product of the relationship strength corresponding to all relationship data and the weight corresponding to each association relationship. Specifically, since the relationship strength corresponding to the relationship data includes the relationship strength corresponding to multiple association relationships, the relationship strength corresponding to each association relationship can be multiplied by the weight corresponding to the association relationship to obtain the product, and the average value of all products is used as the abnormal suspicion degree transfer coefficient of the entity to be identified.

[0128] Step 603: If it is determined that the entity to be identified has multiple association relationships with other entities, the average value of the product of the relationship strength corresponding to the entity to be identified and all relationship weights is calculated to obtain the abnormality suspicion transfer coefficient of the entity to be identified.

[0129] If it is determined that there are multiple associations between the entity to be identified and other entities, the abnormal suspicion transfer coefficient of the entity to be identified is: the set of abnormal suspicion transfer coefficients between the entity to be identified and all associated entities, and the abnormal suspicion transfer coefficient between the entity to be identified and each associated entity can be obtained using the method in step 602. In this embodiment, different weights are pre-set for different associations to obtain the abnormal suspicion transfer coefficient of the entity to be identified in different situations, so that the abnormal entity identification method can be applied to different application scenarios.

[0130] Embodiment 6

[0131] Figure 7 is a flow chart of an abnormal entity identification method provided according to the sixth embodiment of the present application, such as Figure 7 As shown, the abnormal entity identification method provided in this embodiment is based on any of the above embodiments, and step 204 is refined into steps 701 to 702.

[0132] Step 701, determining the number of upstream entities to be identified that have an association relationship with the entity to be identified.

[0133] In this embodiment, the upstream entity to be identified that is associated with the entity to be identified can be determined from the relationship data of the entity to be identified, and all other entities that are associated with the entity to be identified are regarded as the upstream entities to be identified.

[0134] Step 702: If it is determined that there is only one upstream entity to be identified, determine the abnormality suspicion of the upstream entity to be identified.

[0135] If it is determined that there is one upstream entity to be identified, the abnormal suspicion degree of the upstream entity to be identified is determined. When the upstream entity is an abnormal entity, the abnormal suspicion degree of the upstream entity is determined to be SRmax. When the upstream entity is an entity to be identified, the abnormal suspicion degree of the upstream entity is determined to be 0 or the abnormal suspicion degree determined last time.

[0136] Step 703: determine the abnormality suspicion degree of the entity to be identified according to the abnormality suspicion degree corresponding to the upstream entity to be identified and the abnormality suspicion degree transfer coefficient of the entity to be identified.

[0137] Specifically, the product of the abnormality suspicion degree corresponding to the upstream entity to be identified and the abnormality suspicion degree transfer coefficient of the entity to be identified is determined as the abnormality suspicion degree of the entity to be identified.

[0138] As an optional implementation, based on any of the above embodiments, step 204 also includes steps 711 to 713.

[0139] Step 711: If it is determined that there are multiple upstream entities to be identified, determine the abnormal suspicion levels of the multiple upstream entities to be identified.

[0140] Specifically, the abnormal suspicion degree of each upstream entity to be identified can be determined using the method in step 702.

[0141] Step 712: Calculate the product of the abnormality suspicion degree corresponding to the multiple upstream entities to be identified and the abnormality suspicion degree transfer coefficient of the entity to be identified.

[0142] Specifically, the product of the abnormality suspicion degree corresponding to each upstream entity to be identified and the abnormality suspicion degree transfer coefficient of the upstream entity to be identified in the abnormality suspicion degree transfer coefficient of the entity to be identified is calculated.

[0143] Step 713: Determine the sum of multiple products as the abnormality suspicion of the entity to be identified.

[0144] According to step 702, the abnormal suspicion degree of the entity to be identified and the abnormal suspicion degree transmitted from each upstream entity are obtained, and the abnormal suspicion degree of the entity to be identified transmitted from all upstream entities is summed to obtain the abnormal suspicion degree of the entity to be identified. That is, the abnormal suspicion degree corresponding to each upstream entity to be identified and the product of the abnormal suspicion degree transmission coefficient of the upstream entity to be identified in the abnormal suspicion degree transmission coefficient of the entity to be identified are obtained as the abnormal suspicion degree of the entity to be identified.

[0145] As an optional implementation, based on any one of the above embodiments, step 205 is further refined into steps 2051 and 2052.

[0146] Step 2051, determining whether the abnormality suspicion degree of the entity to be identified is greater than or equal to the abnormality suspicion degree corresponding to the abnormal entity.

[0147] Step 2052: If it is determined that the abnormality suspicion degree of the entity to be identified is greater than or equal to the abnormality suspicion degree corresponding to the abnormal entity, then the entity to be identified is determined to be an abnormal entity.

[0148] In this embodiment, the abnormal suspicion degree corresponding to the abnormal entity can be set to SRmax. After step 204, the abnormal suspicion degree of the entity to be identified can be obtained, and it is determined whether the abnormal suspicion degree of the entity to be identified is greater than or equal to the abnormal suspicion degree corresponding to the abnormal entity. If it is determined that the abnormal suspicion degree of the entity to be identified is greater than or equal to the abnormal suspicion degree corresponding to the abnormal entity, the entity to be identified is determined to be an abnormal entity. At the same time, the abnormal suspicion degree of the entity determined to be an abnormal entity can be set to SRmax.

[0149] As an optional solution, for the entities to be identified as abnormal entities, an audit process can be added to further determine whether they are abnormal entities.

[0150] This embodiment determines the abnormal suspicion degree of the entity to be identified through the association relationship between the entity to be identified and the upstream entity to be identified, and can determine the abnormal suspicion degree of all entities to be identified in the knowledge graph. At the same time, it judges whether the entity to be identified is an abnormal entity based on the determined abnormal suspicion degree of the entity to be identified. It does not require staff to identify the entity to be identified, does not rely on the subjective identification of staff, and can improve the timeliness and accuracy of abnormal entity identification.

[0151] Embodiment 7

[0152] Figure 8 is a schematic diagram of the structure of an abnormal entity identification device provided according to the seventh embodiment of the present application, such as Figure 8 As shown, the abnormal entity identification device provided in this embodiment is located in an electronic device. The abnormal entity identification device 80 includes: an acquisition module 801, a first calculation module 802, a second calculation module 803, a determination module 804, and an identification module 805.

[0153] Among them, the acquisition module 801 is used to obtain a pre-constructed knowledge graph including abnormal entities and entities to be identified, and the knowledge graph includes the association relationship between each entity and the relationship data corresponding to each entity; the first calculation module 802 is used to calculate the relationship strength corresponding to the entity to be identified based on the relationship data of the entity to be identified; the second calculation module 803 is used to calculate the abnormal suspicion transfer coefficient of the entity to be identified based on the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities; the determination module 804 is used to determine the abnormal suspicion of the entity to be identified based on the abnormal suspicion transfer coefficient of the entity to be identified; the identification module 805 is used to identify whether the entity to be identified is an abnormal entity based on the abnormal suspicion of the entity to be identified.

[0154] The abnormal entity identification device provided in this embodiment can execute the abnormal entity identification method provided in the above-mentioned embodiment 1. The specific implementation method and principle are similar and will not be described one by one.

[0155] Optionally, in the abnormal entity identification device provided in this embodiment, the relationship data corresponding to each entity acquired by the acquisition module 801 includes fixed class relationship data and behavior class relationship data, and the first calculation module 802 is specifically used to calculate the relationship strength corresponding to the fixed class relationship data and the behavior class relationship data respectively; sum the relationship strengths corresponding to the fixed class relationship data and the behavior class relationship data to obtain the relationship strength corresponding to the entity to be identified.

[0156] Optionally, in the abnormal entity identification device provided in this embodiment, the first calculation module 802 is specifically used to obtain the relationship strength of each fixed association relationship of the fixed class relationship data; and calculate the relationship strength corresponding to the fixed class relationship data according to the relationship strength of each fixed association relationship.

[0157] Optionally, in the abnormal entity identification device provided by this embodiment, the first calculation module 802 is specifically used to determine the number of attributes of each fixed association relationship; if the number of attributes is determined to be one, the quantitative score of the attribute is used as the relationship strength of the fixed association relationship; if the number of attributes is determined to be multiple, the quantitative score of the key attribute is used as the relationship strength of the fixed association relationship.

[0158] Optionally, in the abnormal entity identification device provided by this embodiment, the first calculation module 802 is specifically used to determine the attributes, time decay coefficients, quantitative scores of the attributes, and attribute weights corresponding to each behavior association relationship of the behavior relationship data; determine the relationship strength corresponding to each behavior association relationship according to the attributes, time decay coefficients, quantitative scores of the attributes, and attribute weights corresponding to each behavior association relationship; and obtain the relationship strengths corresponding to all behavior association relationships to obtain the relationship strengths corresponding to the behavior relationship data.

[0159] Optionally, in the abnormal entity identification device provided in this embodiment, the first calculation module 802 is specifically used to multiply the attributes, time decay coefficient, quantitative score of the attributes and attribute weight corresponding to each behavior association relationship to obtain the relationship strength corresponding to each behavior association relationship.

[0160] Optionally, in the abnormal entity identification device provided by the present embodiment, the second calculation module 803 is specifically used to determine the association relationship between the entity to be identified and other entities and the relationship weight of the association relationship; if it is determined that there is an association relationship between the entity to be identified and the other entity, then the average value of the product of the relationship strength corresponding to the entity to be identified and the relationship weight is calculated to obtain the abnormal suspicion transfer coefficient of the entity to be identified; if it is determined that there are multiple association relationships between the entity to be identified and the other entity, then the average value of the product of the relationship strength corresponding to the entity to be identified and all relationship weights is calculated to obtain the abnormal suspicion transfer coefficient of the entity to be identified.

[0161] Optionally, in the abnormal entity identification device provided in this embodiment, the determination module 804 is specifically used to determine the number of upstream entities to be identified that have an associated relationship with the entity to be identified; if it is determined that there is one upstream entity to be identified, then determine the abnormal suspicion degree of the upstream entity to be identified; determine the abnormal suspicion degree of the entity to be identified based on the abnormal suspicion degree corresponding to the upstream entity to be identified and the abnormal suspicion degree transfer coefficient of the entity to be identified.

[0162] Optionally, in the abnormal entity identification device provided in this embodiment, if it is determined that there are multiple upstream entities to be identified, the determination module 804 is specifically used to determine the abnormal suspicion degrees of the multiple upstream entities to be identified; calculate the product of the abnormal suspicion degrees corresponding to the multiple upstream entities to be identified and the abnormal suspicion degree transfer coefficient of the entity to be identified; and determine the sum of the multiple products as the abnormal suspicion degree of the entity to be identified.

[0163] Optionally, in the abnormal entity identification device provided in this embodiment, the identification module 805 is specifically used to determine whether the abnormal suspicion degree of the entity to be identified is greater than or equal to the abnormal suspicion degree corresponding to the abnormal entity; if it is determined that the abnormal suspicion degree of the entity to be identified is greater than or equal to the abnormal suspicion degree corresponding to the abnormal entity, the entity to be identified is determined to be an abnormal entity.

[0164] The abnormal entity identification device provided in this embodiment can execute the abnormal entity identification method provided in any one of the above-mentioned embodiments 2 to 6. The specific implementation method is similar to the principle and will not be described one by one.

[0165] Embodiment 8

[0166] Fig. 9 A block diagram of an electronic device provided in the eighth embodiment of the present application, such as Figure 8As shown, the electronic device 90 provided in this embodiment includes a memory 91 , a processor 92 and a transceiver 93 .

[0167] Among them, the memory 91, the processor 92 and the transceiver 93 are interconnected.

[0168] The memory 91 stores computer-executable instructions.

[0169] The transceiver 93 is used for sending and receiving data.

[0170] When the processor 92 executes the computer execution instructions stored in the memory 91, the abnormal entity recognition method provided by any embodiment is implemented.

[0171] The relevant instructions can be understood by referring to the relevant descriptions and effects corresponding to the steps of the abnormal entity identification method provided in any embodiment, and no further details will be given here.

[0172] The electronic device 90 may further include other components, which are not limited in this embodiment.

[0173] An embodiment of the present invention further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the abnormal entity recognition method provided in any one of the embodiments.

[0174] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0175] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0176] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0177] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0178] If the integrated unit / module is implemented in the form of hardware, the hardware can be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. Unless otherwise specified, the artificial intelligence processor can be any appropriate hardware processor, such as CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any appropriate magnetic storage medium or magneto-optical storage medium, such as resistive random access memory RRAM (Resistive Random Access Memory), dynamic random access memory DRAM (Dynamic Random Access Memory), static random access memory SRAM (Static Random-Access Memory), enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), high-bandwidth memory HBM (High-Bandwidth Memory), hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0179] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0180] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0181] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for identifying abnormal entities, It is characterized in that include: Obtaining a pre-built knowledge graph including abnormal entities and entities to be identified, wherein the knowledge graph includes associations between entities and relationship data corresponding to each entity; the relationship data includes fixed-type relationship data and behavioral-type relationship data; Calculate the relationship strengths corresponding to the fixed relationship data and the behavior relationship data respectively; The relationship strengths corresponding to the fixed-class relationship data and the behavior-class relationship data are summed to obtain the relationship strength corresponding to the entity to be identified; Calculate the abnormal suspicion degree transfer coefficient of the entity to be identified according to the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities; Determining the abnormal suspicion degree of the entity to be identified according to the abnormal suspicion degree transfer coefficient of the entity to be identified; It is determined whether the entity to be identified is an abnormal entity according to the abnormal suspicion degree of the entity to be identified.

2. The method according to claim 1, It is characterized in that Calculate the relationship strength corresponding to fixed class relationship data, including: Obtain the relationship strength of each fixed association relationship of fixed class relationship data; The relationship strength corresponding to the fixed class relationship data is calculated according to the relationship strength of each fixed association relationship.

3. The method according to claim 2, It is characterized in that Get the relationship strength of each fixed association relationship of fixed class relationship data, including: Determine the number of attributes for each fixed association; If the number of attributes is determined to be one, the quantitative score of the attribute is used as the relationship strength of the fixed association relationship; If it is determined that there are multiple attributes, the quantitative scores of the key attributes are used as the relationship strength of the fixed association relationship.

4. The method according to claim 1, It is characterized in that The calculating the relationship strength corresponding to the behavior-type relationship data includes: Determine the attribute, time decay coefficient, attribute quantization score and attribute weight corresponding to each behavior association relationship of the behavior relationship data; Determine the relationship strength corresponding to each behavior association relationship according to the attribute corresponding to each behavior association relationship, the time decay coefficient, the quantitative score of the attribute, and the attribute weight; The relationship strengths corresponding to all behavior association relationships are calculated to obtain the relationship strengths corresponding to the behavior-related relationship data.

5. The method according to claim 4, It is characterized in that The relationship strength corresponding to each behavior association relationship is determined according to the attribute corresponding to each behavior association relationship, the time decay coefficient, the quantitative score of the attribute, and the attribute weight, including: The attribute, time decay coefficient, quantitative score of the attribute and attribute weight corresponding to each behavior association relationship are multiplied to obtain the relationship strength corresponding to each behavior association relationship.

6. The method according to claim 1, It is characterized in that Calculating the abnormal suspicion degree transfer coefficient of the entity to be identified according to the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities, including: Determine the association relationship between the entity to be identified and other entities and the relationship weight of the association relationship; If it is determined that there is an association relationship between the entity to be identified and other entities, then the average value of the product of the relationship strength corresponding to the entity to be identified and the relationship weight is calculated to obtain the abnormal suspicion degree transfer coefficient of the entity to be identified; If it is determined that the entity to be identified has multiple association relationships with other entities, the average value of the product of the relationship strength corresponding to the entity to be identified and all relationship weights is calculated to obtain the abnormal suspicion transfer coefficient of the entity to be identified.

7. The method according to claim 1, It is characterized in that The determining the abnormal suspicion degree of the entity to be identified according to the abnormal suspicion degree transfer coefficient of the entity to be identified includes: Determine the number of upstream entities to be identified that have an association relationship with the entity to be identified; If it is determined that there is one upstream entity to be identified, then the abnormal suspicion degree of the upstream entity to be identified is determined; The abnormality suspicion degree of the entity to be identified is determined according to the abnormality suspicion degree corresponding to the upstream entity to be identified and the abnormality suspicion degree transfer coefficient of the entity to be identified.

8. The method according to claim 7, It is characterized in that The determining the abnormal suspicion degree of the entity to be identified according to the abnormal suspicion degree transfer coefficient of the entity to be identified includes: If it is determined that there are multiple upstream entities to be identified, determining the abnormal suspicion levels of the multiple upstream entities to be identified; Calculating the product of the abnormal suspicion degree corresponding to the plurality of upstream entities to be identified and the abnormal suspicion degree transfer coefficient of the entity to be identified; The sum of the multiple products is determined as the abnormality suspicion degree of the entity to be identified.

9. The method according to claim 7, It is characterized in that The step of identifying whether the entity to be identified is an abnormal entity according to the abnormal suspicion degree of the entity to be identified includes: Determine whether the abnormality suspicion degree of the entity to be identified is greater than or equal to the abnormality suspicion degree corresponding to the abnormal entity; If it is determined that the abnormality suspicion degree of the entity to be identified is greater than or equal to the abnormality suspicion degree corresponding to the abnormal entity, the entity to be identified is determined to be an abnormal entity.

10. An abnormal entity identification device, It is characterized in that include: An acquisition module is used to acquire a pre-built knowledge graph including abnormal entities and entities to be identified, wherein the knowledge graph includes associations between entities and relationship data corresponding to each entity; the relationship data includes fixed-type relationship data and behavioral-type relationship data; A first calculation module is used to calculate the relationship strengths corresponding to the fixed relationship data and the behavior relationship data respectively; The relationship strengths corresponding to the fixed-class relationship data and the behavior-class relationship data are summed to obtain the relationship strength corresponding to the entity to be identified; A second calculation module is used to calculate the abnormal suspicion degree transfer coefficient of the entity to be identified according to the relationship strength corresponding to the entity to be identified and the association relationship between the entity to be identified and other entities; A determination module, configured to determine the abnormal suspicion degree of the entity to be identified according to the abnormal suspicion degree transfer coefficient of the entity to be identified; The identification module is used to identify whether the entity to be identified is an abnormal entity according to the abnormal suspicion degree of the entity to be identified.

11. An electronic device, include: Memory, processor and transceiver; The memory, the processor and the transceiver circuit are interconnected; The memory stores computer-executable instructions; The transceiver is used to send and receive data; When the processor executes the computer-executable instructions stored in the memory, the method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 9 when executed by a processor.

13. A computer program product comprising a computer program, It is characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images