Fraud data deep analysis method and system

Abstract

The application relates to the technical field of information processing, and discloses a fraud data deep analysis method and system, the method comprising the following steps: carrying out data conversion on obtained fraud case source data to obtain structured data; constructing a fraud analysis knowledge graph according to the structured data, and embedding the fraud analysis knowledge graph into a corresponding fraud analysis model; obtaining corresponding fraud feature data according to the fraud analysis knowledge graph, and inputting the fraud feature data into the fraud analysis model to obtain a fraud analysis result. Unlike the prior art, which only provides case retrieval and case export functions for cases or simply analyzes clues, the application constructs a fraud analysis knowledge graph based on fraud case source data, embeds the fraud analysis knowledge graph into a corresponding fraud analysis model, and realizes deep analysis of fraud case source data based on the fraud analysis model, thereby improving case analysis efficiency and the visibility of case data.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to a method and system for in-depth analysis of fraud data. Background Technology

[0002] Knowledge graphs are a modern theory that combines theories and methods from applied mathematics, computer graphics, information visualization, and information science with bibliometric methods such as citation analysis and co-occurrence analysis. They utilize visualized graphs to vividly display the core structure, development history, cutting-edge fields, and overall knowledge architecture of a discipline, achieving multidisciplinary integration. Through data mining, information processing, knowledge measurement, and graphical representation, knowledge graphs reveal the dynamic development patterns of knowledge domains and provide practical and valuable references for disciplinary research.

[0003] However, in existing technologies, most systems storing source data for fraud cases are case management systems, providing only case retrieval and export functions. A few case management systems can perform clue correlation analysis based on relational databases, but they still suffer from poor visibility and slow analysis efficiency. Knowledge graphs, as a semantic network knowledge base, can use visualization technology to describe knowledge resources and their carriers, and to mine, analyze, construct, draw, and display knowledge and their interrelationships. Therefore, how to conduct in-depth analysis of source data for fraud cases based on knowledge graphs to improve case analysis efficiency and data visibility has become an urgent problem to be solved.

[0004] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main objective of this invention is to provide a method and system for in-depth analysis of fraud data, aiming to solve the technical problem of how to conduct in-depth analysis of source data of fraud cases based on knowledge graphs, so as to improve the efficiency of case analysis and the visibility of case data.

[0006] To achieve the above objectives, the present invention provides a method for in-depth analysis of fraud data, the method comprising:

[0007] The obtained source data of fraud cases is transformed to obtain structured data;

[0008] A fraud analysis knowledge graph is constructed based on the structured data, and the fraud analysis knowledge graph is embedded into the corresponding fraud analysis model;

[0009] The fraud feature data is obtained based on the fraud analysis knowledge graph, and then input into the fraud analysis model to obtain the fraud analysis results.

[0010] Preferably, the step of converting the acquired source data of fraud cases to obtain structured data specifically includes:

[0011] The obtained source data of fraud cases is cleaned to obtain cleaned source data of fraud cases;

[0012] The cleaned source data of fraud cases is processed by word segmentation to obtain word segmentation data;

[0013] The word segmentation data is processed by knowledge extraction according to preset structured rules to obtain structured data.

[0014] Preferably, the step of performing knowledge extraction processing on the segmented data according to preset structured rules to obtain structured data specifically includes:

[0015] Entity data is obtained by extracting entities from the segmented data according to preset structured rules;

[0016] Relationship data is obtained by extracting relationships from the segmented word data according to preset structured rules;

[0017] Structured data is generated based on the entity data and the relationship data.

[0018] Preferably, the step of constructing a fraud analysis knowledge graph based on the structured data and embedding the fraud analysis knowledge graph into the corresponding fraud analysis model specifically includes:

[0019] The structured data is integrated to obtain triples, and the triples are then input into the graph database.

[0020] Based on the triples in the graph database and the preset knowledge graph framework, a corresponding fraud analysis knowledge graph is generated.

[0021] The fraud analysis knowledge graph is embedded into the corresponding fraud analysis model.

[0022] Preferably, the fraud analysis knowledge graph includes a case knowledge graph, a fund flow knowledge graph, and a call detail record (CDR) knowledge graph;

[0023] Accordingly, the step of generating a corresponding fraud analysis knowledge graph based on the triples in the graph database and the preset knowledge graph framework specifically includes:

[0024] Based on the case knowledge graph framework in the graph database, the corresponding case structure data is extracted from the triples to supplement the data and generate the corresponding case knowledge graph.

[0025] Based on the knowledge graph framework of the capital flow in the graph database, the corresponding capital flow structure data is extracted from the triple to supplement the data and generate the corresponding capital flow knowledge graph.

[0026] Based on the call detail record (CDR) knowledge graph framework in the graph database, the corresponding CDR structure data is extracted from the triples to supplement the data and generate the corresponding CDR knowledge graph.

[0027] Accordingly, the step of embedding the fraud analysis knowledge graph into the corresponding fraud analysis model specifically includes:

[0028] The case knowledge graph is embedded into the corresponding fraud analysis model;

[0029] The aforementioned knowledge graph of fund flows is embedded into the corresponding fraud analysis model;

[0030] The call detail record (CDR) knowledge graph is embedded into the corresponding fraud analysis model.

[0031] Preferably, the step of obtaining corresponding fraud feature data based on the fraud analysis knowledge graph and inputting the fraud feature data into the fraud analysis model to obtain fraud analysis results specifically includes:

[0032] Based on the case knowledge graph, search for strongly related case data and / or weakly related case data in the graph database;

[0033] The found strongly correlated case data and / or weakly correlated case data are input into the fraud analysis model to obtain fraud analysis results.

[0034] Preferably, before the step of searching for strongly related case data and weakly related case data in the graph database based on the case knowledge graph, the method further includes:

[0035] Extract the target question-and-answer mapping relationship from the case knowledge graph, and establish the corresponding question-and-answer template based on the target question-and-answer mapping relationship;

[0036] A case-handling plugin is generated based on the question-and-answer template and the target question-and-answer mapping relationship, and the case-handling plugin is integrated into the fraud analysis model.

[0037] Preferably, the step of extracting corresponding fraud feature data from the fraud analysis knowledge graph and inputting the fraud feature data into the fraud analysis model to obtain fraud analysis results specifically includes:

[0038] Find target accounts whose historical cash flows are lower than a preset minimum cash flow from the cash flow knowledge graph;

[0039] When the incoming funds to the target account exceed the preset target funds flow, the transaction record corresponding to the target funds is sent to the fraud analysis model to obtain fraud analysis results.

[0040] Preferably, the step of extracting corresponding fraud feature data from the fraud analysis knowledge graph and inputting the fraud feature data into the fraud analysis model to obtain fraud analysis results specifically includes:

[0041] The origin of the call detail record (CDR) data is obtained from the CDR knowledge graph, and the number of CDRs at each origin is counted.

[0042] When a target originating location with a call detail record (CDR) count greater than the preset CDR count is detected, the target originating location is input into the fraud analysis model to obtain fraud analysis results.

[0043] Preferably, the step of embedding the fraud analysis knowledge graph into the corresponding fraud analysis model specifically includes:

[0044] An embedding representation template is constructed based on the fraud analysis knowledge graph, and a corresponding model search library is established based on the embedding representation template;

[0045] Search the model search library for the initial model corresponding to the fraud analysis knowledge graph;

[0046] The initial model is trained based on the fraud analysis knowledge graph to obtain the corresponding fraud analysis model.

[0047] Preferably, the step of training the initial model based on the fraud analysis knowledge graph to obtain the corresponding fraud analysis model specifically includes:

[0048] Each fraud indicator item is extracted from the fraud analysis knowledge graph, and the score result of each fraud indicator item is calculated according to the preset scoring rules.

[0049] The fraud feature data is used as the input to the initial model, and the scoring result is used as the output of the initial model.

[0050] The initial model is trained based on the input and output results to obtain the corresponding fraud analysis model.

[0051] Preferably, the step of obtaining corresponding fraud feature data based on the fraud analysis knowledge graph and inputting the fraud feature data into the fraud analysis model to obtain fraud analysis results specifically includes:

[0052] The fraud feature data is obtained based on the fraud analysis knowledge graph, and the fraud feature data is input into the fraud analysis model to obtain the scoring result corresponding to the fraud feature data.

[0053] The rating results are sorted from highest to lowest to obtain the rating ranking results;

[0054] Fraud analysis results are generated based on the ranking of the top-ranked scores.

[0055] Furthermore, to achieve the above objectives, the present invention also proposes a deep fraud data analysis system, which includes:

[0056] The data structuring module is used to transform the acquired source data of fraud cases into structured data.

[0057] The model embedding module is used to construct a fraud analysis knowledge graph based on the structured data and embed the fraud analysis knowledge graph into the corresponding fraud analysis model.

[0058] The fraud analysis module is used to obtain corresponding fraud feature data based on the fraud analysis knowledge graph, and input the fraud feature data into the fraud analysis model to obtain fraud analysis results.

[0059] The data structuring module is also used to clean the acquired source data of fraud cases to obtain cleaned source data of fraud cases.

[0060] The data structuring module is also used to perform word segmentation processing on the cleaned source data of fraud cases to obtain word segmentation data;

[0061] The data structuring module is also used to perform knowledge extraction processing on the word segmentation data according to preset structuring rules to obtain structured data.

[0062] Preferably, the model embedding module is further configured to integrate the structured data to obtain triples, and input the triples into the graph database;

[0063] The model embedding module is also used to generate a corresponding fraud analysis knowledge graph based on the triples in the graph database and the preset knowledge graph framework.

[0064] Preferably, the model embedding module is further configured to extract corresponding case structure data from the triples according to the case knowledge graph framework in the graph database to supplement the data and generate the corresponding case knowledge graph;

[0065] The model embedding module is also used to extract corresponding capital flow structure data from the triples according to the capital flow knowledge graph framework in the graph database to supplement the data and generate the corresponding capital flow knowledge graph.

[0066] The model embedding module is also used to extract corresponding call detail record (CDR) structure data from the triples according to the call detail record (CDR) knowledge graph framework in the graph database to supplement the data and generate the corresponding CDR knowledge graph.

[0067] Preferably, the fraud analysis module is further configured to search for strongly related case data and / or weakly related case data in the graph database based on the case knowledge graph;

[0068] The fraud analysis module is also used to input the found strongly correlated case data and / or weakly correlated case data into the fraud analysis model to obtain fraud analysis results.

[0069] Preferably, the fraud analysis module is further configured to extract target question-and-answer mapping relationships based on the case knowledge graph, and establish corresponding question-and-answer templates based on the target question-and-answer mapping relationships;

[0070] The fraud analysis module is also used to generate a case-handling plugin based on the question-and-answer template and the target question-and-answer mapping relationship, and to integrate the case-handling plugin into the fraud analysis model.

[0071] Preferably, the fraud analysis module is further configured to search for target accounts whose historical fund flows are lower than a preset minimum fund flow from the fund flow knowledge graph;

[0072] The fraud analysis module is also used to send the transaction record corresponding to the target funds to the fraud analysis model when it detects that the target account has received more funds than the preset target funds flow, so as to obtain fraud analysis results.

[0073] Preferably, the fraud analysis module is further configured to obtain the initiation location of the call detail record (CDR) data from the call detail record knowledge graph and count the number of CDRs at each initiation location;

[0074] The fraud analysis module is also used to input the target initiation location into the fraud analysis model when it detects that there is a target initiation location with a number of call records greater than the preset number of call records, so as to obtain fraud analysis results.

[0075] In this invention, the acquired source data of fraud cases is transformed to obtain structured data. A fraud analysis knowledge graph is constructed based on the structured data and embedded into the corresponding fraud analysis model. Corresponding fraud feature data is obtained from the fraud analysis knowledge graph and input into the fraud analysis model to obtain fraud analysis results. Unlike existing technologies that only provide case retrieval and export functions or simple clue association analysis, which still suffer from poor visibility and slow analysis efficiency, this invention constructs a fraud analysis knowledge graph based on the source data of fraud cases and embeds it into the corresponding fraud analysis model. This allows for in-depth analysis of the source data of fraud cases based on the fraud analysis model, improving case analysis efficiency and the visibility of case data. Attached Figure Description

[0076] Figure 1 This is a flowchart illustrating the first embodiment of the fraud data deep analysis method of the present invention;

[0077] Figure 2 This is a flowchart illustrating the second embodiment of the fraud data deep analysis method of the present invention;

[0078] Figure 3 This is a flowchart illustrating the third embodiment of the fraud data deep analysis method of the present invention;

[0079] Figure 4 This is a flowchart illustrating the fourth embodiment of the fraud data deep analysis method of the present invention;

[0080] Figure 5 This is a structural block diagram of the first embodiment of the fraud data deep analysis system of the present invention.

[0081] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0082] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0083] This invention provides a method for in-depth analysis of fraud data, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the fraud data deep analysis method of the present invention.

[0084] In this embodiment, the method for in-depth analysis of fraud data includes the following steps:

[0085] Step S10: Transform the obtained source data of fraud cases to obtain structured data;

[0086] It should be noted that, in order to obtain structured fraud case source data to facilitate the construction of corresponding knowledge graphs, after obtaining the fraud case source data (including but not limited to data stored in case databases, fund flow databases, call detail record databases, case-related data Excel tables, case files, TXT text files, case-related disks, memory devices, and other storage media), the fraud case source data can be cleaned to obtain cleaned fraud case source data. Data cleaning can be understood as the final procedure to discover and correct identifiable errors in the data files, including checking data consistency and handling invalid and missing values. Then, the cleaned fraud case source data is segmented to obtain segmented data. Segmentation can be understood as segmenting the keyword string based on the keyword string submitted by the user after performing corresponding query processing. Next, knowledge extraction processing is performed on the segmented data according to preset structured rules to obtain structured data. The preset structured rules include, but are not limited to, the Business Principle, Efficiency Principle, Analytics Principle, and Redundancy Principle. The knowledge extraction process can be understood as follows: First, entity extraction (also known as named entity recognition, where entities are the basic units of a knowledge graph and important linguistic units carrying information in the text, including concepts, people, organizations, place names, time, etc.) is performed on the segmented data according to preset structured rules to obtain entity data. Second, relation extraction (identifying semantic relationships between entities to obtain key knowledge in the text) is performed on the segmented data according to preset structured rules to obtain relation data. Third, structured data is generated based on the entity data and relation data. Furthermore, after obtaining entity data and relation data, attribute extraction (extracting the weights of relationships between entities, i.e., the attribute information of entities, similar to relations, which reflect the external connections of entities, while attributes reflect the internal characteristics of entities) can be performed to obtain attribute data. Finally, entity data, relation data, and attribute data are used as structured data.

[0087] Step S20: Construct a fraud analysis knowledge graph based on the structured data, and embed the fraud analysis knowledge graph into the corresponding fraud analysis model;

[0088] In practical implementation, to obtain a fraud analysis knowledge graph and enable in-depth analysis of fraud case source data based on the knowledge graph, thereby improving case analysis efficiency and data visibility, the structured data can be integrated to obtain triples. The basic forms of triples include, but are not limited to, entity 1-relationship-entity 2 and entity-attribute-attribute value. Then, the triples are input into a graph database. A graph database includes nodes, edges, and attributes. Nodes can be used to represent objects such as entities and events, analogous to records in a relational database, such as people, places, and movies. Edges can be understood as directed lines connecting nodes in the graph and can be used to represent relationships between different nodes, such as marital relationships or colleague relationships. Attributes can be used to describe the characteristics of nodes or edges, such as names or the start and end times of marital relationships. Then, based on the triples and preset knowledge graph frameworks in the graph database, a corresponding fraud analysis knowledge graph is generated. The preset knowledge graph framework can be understood as a framework used in the schema layer of the knowledge graph to describe the relationship between concepts (such as entities), which can be used to populate data, such as a case knowledge graph framework, a fund flow knowledge graph framework, and a call detail record (CDR) knowledge graph framework. Case structure data required for the case knowledge graph framework can be extracted from the triples to supplement the data and generate the corresponding case knowledge graph; fund flow structure data required for the fund flow knowledge graph framework can be extracted from the triples to supplement the data and generate the corresponding fund flow knowledge graph; and call detail record (CDR) structure data corresponding to the CDR knowledge graph framework can be extracted from the triples to supplement the data and generate the corresponding call detail record (CDR) knowledge graph.

[0089] Furthermore, in order to obtain a fraud analysis model and conduct in-depth analysis of fraud case source data based on the fraud analysis model, thereby improving the efficiency of case analysis, after obtaining the fraud analysis knowledge graph, an embedded representation template can be constructed based on the fraud analysis knowledge graph. The embedded representation template can be understood as a unified representation form of the graph. Then, a corresponding model search library is established based on the embedded representation template. The model search library can be understood as a database storing multiple models with a fit greater than a preset fit to the model embedded template. The preset fit can be set according to actual needs; this embodiment does not impose any restrictions on this. The system can search for the initial model corresponding to the fraud analysis knowledge graph in the model search library, and then train the initial model according to the fraud analysis knowledge graph to obtain the corresponding fraud analysis model. During the training process, each fraud indicator can be extracted from the fraud analysis knowledge graph, and the score result of each fraud indicator can be calculated according to the preset scoring rules. Then, the fraud feature data is used as the input result of the initial model, and the score result is used as the output result of the initial model. The initial model is trained according to the input result and the output result to obtain the corresponding fraud analysis model.

[0090] Step S30: Obtain the corresponding fraud feature data based on the fraud analysis knowledge graph, and input the fraud feature data into the fraud analysis model to obtain the fraud analysis results.

[0091] It is easy to understand that, in order to further improve the visibility of case data, corresponding fraud feature data can be obtained based on the fraud analysis knowledge graph, and the fraud feature data can be input into the fraud analysis model to obtain the scoring results corresponding to the fraud feature data. The fraud feature data can be understood as the fraud indicator items corresponding to each knowledge graph. Then, the scoring results are sorted in descending order to obtain the scoring ranking results. Then, a fraud analysis result is generated based on the scoring results of the first-ranked item. For example, when locking down a suspect in a case, the indices corresponding to various fraud indicator items of each suspect can be added together to obtain the suspicion index score of each suspect. The suspicion index scores are then sorted to obtain the scoring ranking results. The suspect ranked first in the scoring ranking results is the suspect with the highest degree of suspicion. The fraud analysis results are then displayed. For example, the suspect ranked first can be highlighted, and the relationship between other suspects and this suspect can be shown. The specific display method can be set according to actual needs, such as text and image format, voice prompt method, etc. This embodiment does not limit this.

[0092] In this embodiment, the acquired source data of fraud cases is transformed to obtain structured data. A fraud analysis knowledge graph is constructed based on the structured data and embedded into the corresponding fraud analysis model. Corresponding fraud feature data is obtained based on the fraud analysis knowledge graph and input into the fraud analysis model to obtain fraud analysis results. Unlike existing technologies that only provide case retrieval and case export functions or simple clue association analysis, which still suffer from poor visibility and slow analysis efficiency, this embodiment constructs a fraud analysis knowledge graph based on the source data of fraud cases and embeds the fraud analysis knowledge graph into the corresponding fraud analysis model. This enables in-depth analysis of the source data of fraud cases based on the fraud analysis model, improving case analysis efficiency and the visibility of case data.

[0093] refer to Figure 2 , Figure 2 This is a flowchart illustrating the second embodiment of the fraud data deep analysis method of the present invention.

[0094] Based on the first embodiment described above, in this embodiment, step S20 includes:

[0095] Step S201: Integrate the structured data to obtain triples, and input the triples into the graph database;

[0096] Step S202: Extract the corresponding case structure data from the triples according to the case knowledge graph framework in the graph database to supplement the data and generate the corresponding case knowledge graph;

[0097] Step S203: Embed the case knowledge graph into the corresponding fraud analysis model.

[0098] It should be noted that after obtaining structured data, the structured data can be integrated to obtain triples. The basic forms of the triples include, but are not limited to, entity 1-relation-entity 2 and entity-attribute-attribute value. Then, the triples are input into a graph database. A graph database includes nodes, edges, and attributes. Nodes can be used to represent objects such as entities and events, analogous to records in a relational database, such as people, places, and movies. Edges can be understood as directed lines connecting nodes in a graph, used to represent relationships between different nodes, such as marital relationships or colleague relationships. Attributes can be used to describe the characteristics of nodes or edges, such as names or the start and end times of marital relationships. Then, based on the triples in the graph database and the case knowledge graph framework, a corresponding case knowledge graph is generated. The case knowledge graph framework can be understood as a framework in the schema layer of a knowledge graph used to describe the relationships between concepts (such as entities), which can be used to populate data. That is, the case structure data required for the case knowledge graph framework can be extracted from the triples to supplement the data and generate the corresponding case knowledge graph.

[0099] It is easy to understand that after obtaining the case knowledge graph, it can be embedded into the corresponding fraud analysis model to perform in-depth analysis of the source data of fraud cases based on the fraud analysis model, thereby further improving the efficiency of case analysis. Specifically, an embedding representation template can be constructed based on the case knowledge graph. This embedding representation template can be understood as a unified representation form of the graph. Then, a corresponding model search library is established based on the embedding representation template. This model search library can be understood as a database storing various models with a fit greater than a preset fit to the model embedding template. The preset fit can be set according to actual needs. This embodiment does not specify this. Without any restrictions, the initial model corresponding to the case knowledge graph can be searched in the model search library. Then, the initial model is trained according to the fraud analysis knowledge graph to obtain the corresponding fraud analysis model. During the training process, each fraud indicator can be extracted from the case knowledge graph, and the score result of each fraud indicator can be calculated according to the preset scoring rules. Then, the fraud feature data is used as the input result of the initial model, and the score result is used as the output result of the initial model. The initial model is trained according to the input result and the output result to obtain the corresponding fraud analysis model.

[0100] Accordingly, step S30 includes:

[0101] Step S301: Search for strongly related case data and / or weakly related case data in the graph database according to the case knowledge graph;

[0102] Step S302: Input the found strongly correlated case data and / or weakly correlated case data into the fraud analysis model to obtain fraud analysis results.

[0103] It should be noted that, in order to achieve in-depth analysis of source data for fraud cases based on the case knowledge graph, and to improve the efficiency and visibility of case analysis, after obtaining the case knowledge graph, strongly related and / or weakly related case data can be searched in the graph database based on the case knowledge graph. The searched strongly related and / or weakly related case data is then input into the fraud analysis model to obtain fraud analysis results. Strongly related case data can be understood as two or more case data with strong correlations found in the graph database of the case knowledge graph, such as the same suspect, the same primary account, the same phone number, the same MAC address, etc. Weakly related case data can be understood as two or more case data with weak correlations found in the graph database of the case knowledge graph, such as the same time period, the same location of the incident, the same IP address, the same base station number, the same cell phone number, the same victim (name, ID type, ID number, etc.), the same suspect's social media accounts, similarity of brief case details, the same cellular number, the same account opening institution (the suspect's workplace, address, email, etc. when opening the account), etc. In the process of obtaining fraud analysis results, the obtained strongly correlated case data and / or weakly correlated case data can be input into the fraud analysis model to obtain the scoring results corresponding to each fraud indicator item in the strongly correlated case data and / or weakly correlated case data. The scoring results are then sorted from high to low to obtain the scoring ranking results. Based on the scoring results of the first-ranked results, the fraud analysis results are generated. Finally, the fraud analysis results are displayed. The specific display method can be set according to actual needs, such as text and images, voice reminders, etc. This embodiment does not limit this.

[0104] In practical implementation, to further improve the visibility of case data, target question-and-answer mapping relationships can be extracted based on the case knowledge graph. These target question-and-answer mapping relationships can be understood as the mapping relationship between question templates and answers. Corresponding question-and-answer templates (such as general question templates and their answer templates, comparison sentence templates and their reply templates) are established based on these target question-and-answer mapping relationships. Then, a case-handling plugin is generated based on the question-and-answer templates and the target question-and-answer mapping relationships. This case-handling plugin is then integrated into the fraud analysis model to achieve diversified display of fraud analysis results.

[0105] In this embodiment, the structured data is integrated to obtain triples, which are then input into a graph database. Based on the case knowledge graph framework in the graph database, corresponding case structure data is extracted from the triples to supplement the data, generating a corresponding case knowledge graph. This case knowledge graph is embedded into a corresponding fraud analysis model. Strongly correlated and / or weakly correlated case data are searched for in the graph database based on the case knowledge graph, and the found strongly correlated and / or weakly correlated case data are input into the fraud analysis model to obtain fraud analysis results. By searching for strongly correlated and / or weakly correlated case data in the graph database based on the generated case knowledge graph and inputting the found strongly correlated and / or weakly correlated case data into the fraud analysis model, fraud analysis results are obtained. This allows for in-depth analysis of fraud case source data based on the case knowledge graph, further improving case analysis efficiency and the visibility of case data. Furthermore, by establishing a question-and-answer template and integrating a case-handling assistant based on the question-and-answer template into the fraud analysis model, a diversified display of fraud analysis results is achieved.

[0106] refer to Figure 3 , Figure 3 This is a flowchart illustrating the third embodiment of the fraud data deep analysis method of the present invention.

[0107] Based on the first embodiment described above, in this embodiment, step S20 includes:

[0108] Step S211: Integrate the structured data to obtain triples, and input the triples into the graph database;

[0109] Step S212: Extract the corresponding capital flow structure data from the triples according to the capital flow knowledge graph framework in the graph database to supplement the data and generate the corresponding capital flow knowledge graph;

[0110] Step S213: Embed the fund flow knowledge graph into the corresponding fraud analysis model.

[0111] It should be noted that after obtaining structured data, the structured data can be integrated to obtain triples. The basic forms of the triples include, but are not limited to, entity 1-relationship-entity 2 and entity-attribute-attribute value. Then, the triples are input into a graph database. A graph database includes nodes, edges, and attributes. Nodes can be used to represent objects such as entities and events, analogous to records in a relational database, such as people, places, and movies. Edges can be understood as directed lines connecting nodes in a graph, used to represent relationships between different nodes, such as marital relationships or colleague relationships. Attributes can be used to describe the characteristics of nodes or edges, such as names or the start and end times of marital relationships. Then, based on the triples in the graph database and the fund flow knowledge graph framework, a corresponding fund flow knowledge graph is generated. The fund flow knowledge graph framework can be understood as a framework in the schema layer of a knowledge graph used to describe the relationships between concepts (such as entities) and can be used to populate data. That is, the case structure data required by the fund flow knowledge graph framework can be extracted from the triples to supplement the data and generate the corresponding fund flow knowledge graph.

[0112] It is easy to understand that after obtaining the fund flow knowledge graph, it can be embedded into the corresponding fraud analysis model to perform in-depth analysis of the source data of fraud cases based on the fraud analysis model, thereby further improving the efficiency of case analysis. This can be achieved by constructing an embedding representation template based on the fund flow knowledge graph, which can be understood as a unified representation form of the graph. Then, a corresponding model search library is established based on the embedding representation template. This model search library can be understood as a database storing various models with a fit greater than a preset fit to the model embedding template. The preset fit can be set according to actual needs. This embodiment... Without limitation, the initial model corresponding to the fund flow knowledge graph can be searched in the model search library. Then, the initial model is trained based on the fund flow knowledge graph to obtain the corresponding fraud analysis model. During the training process, each fraud indicator can be extracted from the fund flow knowledge graph, and the score result of each fraud indicator can be calculated according to the preset scoring rules. Then, the fraud feature data is used as the input result of the initial model, and the score result is used as the output result of the initial model. The initial model is trained based on the input result and the output result to obtain the corresponding fraud analysis model.

[0113] Accordingly, step S30 includes:

[0114] Step S311: Locate the target account whose historical cash flow is lower than the preset minimum cash flow from the cash flow knowledge graph;

[0115] Step S312: When it is detected that the incoming funds to the target account are greater than the target funds of the preset transaction flow, the transaction record corresponding to the target funds is sent to the fraud analysis model to obtain the fraud analysis result.

[0116] It should be noted that, in order to achieve in-depth analysis of source data for fraud cases based on the fund flow knowledge graph, and to improve the efficiency and visibility of case analysis, after obtaining the fund flow knowledge graph, target accounts with historical fund flows lower than a preset minimum fund flow can be found from the fund flow knowledge graph. The preset minimum fund flow can be set according to actual needs, such as 1 million yuan, and this embodiment does not impose any restrictions on it. When it is detected that the target account receives funds exceeding the preset transaction fund flow, the transaction record corresponding to the target funds is sent to the fraud analysis model to obtain fraud analysis results. The preset transaction fund flow can be set according to actual needs, such as 1 million yuan, and this embodiment does not impose any restrictions on it. In specific implementations, to further improve retrieval accuracy, information such as time can also be added as retrieval indicators, such as detecting whether the target account receives funds exceeding the preset transaction fund flow within a preset time period. The retrieval indicators can be set according to actual needs, and this embodiment does not impose any restrictions on it. In the process of obtaining fraud analysis results, the obtained transaction records can be input into the fraud analysis model to obtain the scoring results corresponding to each fraud indicator item of the transaction records. The scoring results are then sorted from high to low to obtain the scoring ranking results. Based on the scoring results of the first-ranked item, the fraud analysis results are generated. Finally, the fraud analysis results are displayed. The specific display method can be set according to actual needs, such as text and images, voice reminders, etc. This embodiment does not limit this.

[0117] In this embodiment, the structured data is integrated to obtain triples, which are then input into a graph database. Based on the fund flow knowledge graph framework in the graph database, corresponding fund flow structure data is extracted from the triples to supplement the data, generating a corresponding fund flow knowledge graph. This fund flow knowledge graph is embedded into a corresponding fraud analysis model. Target accounts with historical fund flows below a preset minimum fund flow are searched from the fund flow knowledge graph. When a target account is found to have received funds exceeding a preset minimum transaction fund flow, the transaction record corresponding to the target funds is sent to the fraud analysis model to obtain fraud analysis results. Real-time monitoring of abnormal fund flows is achieved based on the generated fund flow knowledge graph, and a corresponding fraud analysis model is established based on the fund flow knowledge graph to achieve in-depth analysis of fraud case source data, further improving case analysis efficiency and the visibility of case data.

[0118] refer to Figure 4 , Figure 4 This is a flowchart illustrating the fourth embodiment of the fraud data deep analysis method of the present invention.

[0119] Based on the first embodiment described above, in this embodiment, step S20 includes:

[0120] Step S221: Integrate the structured data to obtain triples, and input the triples into the graph database;

[0121] Step S222: Extract the corresponding call detail record (CDR) structure data from the triples according to the call detail record (CDR) knowledge graph framework in the graph database to supplement the data and generate the corresponding CDR knowledge graph;

[0122] Step S223: Embed the call detail record knowledge graph into the corresponding fraud analysis model.

[0123] It should be noted that after obtaining structured data, the structured data can be integrated to obtain triples. The basic forms of the triples include, but are not limited to, entity 1-relation-entity 2 and entity-attribute-attribute value. Then, the triples are input into a graph database. A graph database includes nodes, edges, and attributes. Nodes can be used to represent objects such as entities and events, analogous to records in a relational database, such as people, places, and movies. Edges can be understood as directed lines connecting nodes in a graph, used to represent relationships between different nodes, such as marital relationships or colleague relationships. Attributes can be used to describe the characteristics of nodes or edges, such as names or the start and end times of marital relationships. Then, based on the triples in the graph database and the call detail record (CDR) knowledge graph framework, a corresponding CDR knowledge graph is generated. The CDR knowledge graph framework can be understood as a framework in the schema layer of a knowledge graph used to describe the relationships between concepts (such as entities) and can be used to populate data. That is, the case structure data required for the CDR knowledge graph framework can be extracted from the triples to supplement the data and generate the corresponding CDR knowledge graph.

[0124] It is easy to understand that after obtaining the call detail record (CDR) knowledge graph, it can be embedded into the corresponding fraud analysis model to perform in-depth analysis of fraud case source data based on the fraud analysis model, further improving the efficiency of case analysis. This can be achieved by constructing an embedding representation template based on the CDR knowledge graph, which can be understood as a unified representation of the graph. Then, a corresponding model search library is established based on the embedding representation template. This model search library can be understood as a database storing various models with a fit greater than a preset fit to the model embedding template. The preset fit can be set according to actual needs. This embodiment... Without limitation, the initial model corresponding to the call detail record (CDR) knowledge graph can be searched in the model search library. The initial model is then trained based on the CDR knowledge graph to obtain the corresponding fraud analysis model. During the training process, each fraud indicator can be extracted from the CDR knowledge graph, and the score of each fraud indicator can be calculated according to the preset scoring rules. Then, the fraud feature data is used as the input result of the initial model, and the score result is used as the output result of the initial model. The initial model is trained based on the input result and the output result to obtain the corresponding fraud analysis model.

[0125] Accordingly, step S30 includes:

[0126] Step S321: Obtain the origination location of the call detail record (CDR) data from the CDR knowledge graph, and count the number of CDRs at each origination location;

[0127] Step S322: When a target initiation location with a call detail record (CDR) count greater than the preset CDR count is detected, the target initiation location is input into the fraud analysis model to obtain fraud analysis results.

[0128] It should be noted that, in order to achieve in-depth analysis of source data for fraud cases based on call detail record (CDR) knowledge graphs and improve the efficiency and visibility of case analysis, after obtaining the CDR knowledge graph, the originating location of the CDR data can be obtained from the CDR knowledge graph, and the number of CDRs at each originating location can be counted. When a target originating location with a CDR count greater than a preset CDR count is detected, the target originating location is input into the fraud analysis model to obtain fraud analysis results. The preset CDR count can be set according to actual needs, such as 100. This embodiment does not limit this. In specific implementations, to further improve retrieval accuracy, information such as time can also be added as retrieval indicators. For example, it can detect whether a certain location has made more calls than the preset CDR count within a preset time period. When the preset CDR count is 100, that is, when it is detected that a certain location has made more than 100 calls within a week, the location can be regarded as a suspicious location. The retrieval indicators can be set according to actual needs, and this embodiment does not limit this. In the process of obtaining fraud analysis results, the target initiation location can be input into the fraud analysis model to obtain the scoring results corresponding to each fraud indicator item of the target initiation location. The scoring results are then sorted from high to low to obtain the scoring ranking results. Based on the scoring results of the first-ranked item, the fraud analysis results are generated. Finally, the fraud analysis results are displayed. The specific display method can be set according to actual needs, such as text and images, voice reminders, etc. This embodiment does not limit this.

[0129] In this embodiment, the structured data is integrated to obtain triples, which are then input into a graph database. Based on the call detail record (CDR) knowledge graph framework in the graph database, corresponding CDR structure data is extracted from the triples to supplement the data, generating a corresponding CDR knowledge graph. This CDR knowledge graph is embedded into a corresponding fraud analysis model. The origination location of the CDR data is obtained from the CDR knowledge graph, and the number of CDRs at each origination location is counted. When a target origination location with a CDR count greater than a preset number is detected, the target origination location is input into the fraud analysis model to obtain fraud analysis results. By leveraging the generated CDR knowledge graph, effective investigation of CDR fraud rings is achieved, and a corresponding fraud analysis model is established based on the CDR knowledge graph to achieve in-depth analysis of fraud case source data, further improving case analysis efficiency and the visibility of case data.

[0130] Reference Figure 5 , Figure 5 This is a structural block diagram of the first embodiment of the fraud data deep analysis system of the present invention.

[0131] like Figure 5 As shown, the fraud data deep analysis system proposed in this embodiment of the invention includes:

[0132] The data structuring module 10 is used to transform the acquired source data of fraud cases to obtain structured data;

[0133] The model embedding module 20 is used to construct a fraud analysis knowledge graph based on the structured data and embed the fraud analysis knowledge graph into the corresponding fraud analysis model;

[0134] The fraud analysis module 30 is used to obtain corresponding fraud feature data based on the fraud analysis knowledge graph, and input the fraud feature data into the fraud analysis model to obtain fraud analysis results.

[0135] In this embodiment, the acquired source data of fraud cases is transformed to obtain structured data. A fraud analysis knowledge graph is constructed based on the structured data and embedded into the corresponding fraud analysis model. Corresponding fraud feature data is obtained based on the fraud analysis knowledge graph and input into the fraud analysis model to obtain fraud analysis results. Unlike existing technologies that only provide case retrieval and case export functions or simple clue association analysis, which still suffer from poor visibility and slow analysis efficiency, this embodiment constructs a fraud analysis knowledge graph based on the source data of fraud cases and embeds the fraud analysis knowledge graph into the corresponding fraud analysis model. This enables in-depth analysis of the source data of fraud cases based on the fraud analysis model, improving case analysis efficiency and the visibility of case data.

[0136] Other embodiments or specific implementations of the fraud data deep analysis system of the present invention can be referred to the above-described method embodiments, and will not be repeated here.

[0137] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0138] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0139] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0140] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for in-depth analysis of fraud data, characterized in that, The method for in-depth analysis of fraud data includes: The obtained source data of fraud cases is transformed to obtain structured data; A fraud analysis knowledge graph is constructed based on the structured data, and the fraud analysis knowledge graph is embedded into the corresponding fraud analysis model; The fraud feature data is obtained based on the fraud analysis knowledge graph, and the fraud feature data is input into the fraud analysis model to obtain the fraud analysis results. The step of constructing a fraud analysis knowledge graph based on the structured data and embedding the fraud analysis knowledge graph into the corresponding fraud analysis model specifically includes: The structured data is integrated to obtain triples, and the triples are then input into the graph database. The fraud analysis knowledge graph includes a case knowledge graph, a fund flow knowledge graph, and a call detail record (CDR) knowledge graph. The entity nodes of the case knowledge graph include at least the persons involved in the case, the accounts involved in the case, and the communication tools. The entity nodes of the fund flow knowledge graph include at least the accounts, fund transfer records, and the counterparties. The entity nodes of the CDR knowledge graph include at least the caller, the called party, and the base station location. Based on the case knowledge graph framework in the graph database, the corresponding case structure data is extracted from the triples to supplement the data and generate the corresponding case knowledge graph. Based on the knowledge graph framework of the capital flow in the graph database, the corresponding capital flow structure data is extracted from the triple to supplement the data and generate the corresponding capital flow knowledge graph. Based on the call detail record (CDR) knowledge graph framework in the graph database, the corresponding CDR structure data is extracted from the triples to supplement the data and generate the corresponding CDR knowledge graph. The case knowledge graph is embedded into the corresponding fraud analysis model; The aforementioned knowledge graph of fund flows is embedded into the corresponding fraud analysis model; The call detail record (CDR) knowledge graph is embedded into the corresponding fraud analysis model; The step of obtaining corresponding fraud feature data based on the fraud analysis knowledge graph and inputting the fraud feature data into the fraud analysis model to obtain fraud analysis results specifically includes: Based on the case knowledge graph, search for strongly related case data and / or weakly related case data in the graph database; The found strongly correlated case data and / or weakly correlated case data are input into the fraud analysis model to obtain fraud analysis results.

2. The method for in-depth analysis of fraud data as described in claim 1, characterized in that, The step of transforming the acquired source data of fraud cases to obtain structured data specifically includes: The obtained source data of fraud cases is cleaned to obtain cleaned source data of fraud cases; The cleaned source data of fraud cases is processed by word segmentation to obtain word segmentation data; The word segmentation data is processed by knowledge extraction according to preset structured rules to obtain structured data.

3. The method for in-depth analysis of fraud data as described in claim 2, characterized in that, The step of performing knowledge extraction processing on the segmented data according to preset structured rules to obtain structured data specifically includes: Entity data is obtained by extracting entities from the segmented data according to preset structured rules; Relationship data is obtained by extracting relationships from the segmented word data according to preset structured rules; Structured data is generated based on the entity data and the relationship data.

4. The method for in-depth analysis of fraud data as described in claim 1, characterized in that, Before the step of searching for strongly related and weakly related case data in the graph database based on the case knowledge graph, the method further includes: Extract the target question-and-answer mapping relationship from the case knowledge graph, and establish the corresponding question-and-answer template based on the target question-and-answer mapping relationship; A case-handling plugin is generated based on the question-and-answer template and the target question-and-answer mapping relationship, and the case-handling plugin is integrated into the fraud analysis model.

5. The method for in-depth analysis of fraud data as described in claim 1, characterized in that, The step of obtaining corresponding fraud feature data based on the fraud analysis knowledge graph and inputting the fraud feature data into the fraud analysis model to obtain fraud analysis results specifically includes: Find target accounts whose historical cash flows are lower than a preset minimum cash flow from the cash flow knowledge graph; When the incoming funds to the target account exceed the preset target funds flow, the transaction record corresponding to the target funds is sent to the fraud analysis model to obtain fraud analysis results.

6. The method for in-depth analysis of fraud data as described in claim 1, characterized in that, The step of obtaining corresponding fraud feature data based on the fraud analysis knowledge graph and inputting the fraud feature data into the fraud analysis model to obtain fraud analysis results specifically includes: The origin of the call detail record (CDR) data is obtained from the CDR knowledge graph, and the number of CDRs at each origin is counted. When a target originating location with a call detail record (CDR) count greater than the preset CDR count is detected, the target originating location is input into the fraud analysis model to obtain fraud analysis results.

7. The method for in-depth analysis of fraud data as described in any one of claims 1 to 6, wherein the step of embedding the fraud analysis knowledge graph into the corresponding fraud analysis model specifically includes: An embedding representation template is constructed based on the fraud analysis knowledge graph, and a corresponding model search library is established based on the embedding representation template; Search the model search library for the initial model corresponding to the fraud analysis knowledge graph; The initial model is trained based on the fraud analysis knowledge graph to obtain the corresponding fraud analysis model.

8. The method for deep analysis of fraud data as described in claim 7, wherein the step of training the initial model based on the fraud analysis knowledge graph to obtain the corresponding fraud analysis model specifically includes: Each fraud indicator item is extracted from the fraud analysis knowledge graph, and the score result of each fraud indicator item is calculated according to the preset scoring rules. The fraud feature data is used as the input to the initial model, and the scoring result is used as the output of the initial model. The initial model is trained based on the input and output results to obtain the corresponding fraud analysis model.

9. The method for deep analysis of fraud data as described in claim 8, wherein the step of obtaining corresponding fraud feature data based on the fraud analysis knowledge graph and inputting the fraud feature data into the fraud analysis model to obtain fraud analysis results specifically includes: The fraud feature data is obtained based on the fraud analysis knowledge graph, and the fraud feature data is input into the fraud analysis model to obtain the scoring result corresponding to the fraud feature data. The rating results are sorted from highest to lowest to obtain the rating ranking results; Fraud analysis results are generated based on the ranking of the top-ranked scores.

10. A deep analysis system for fraud data, characterized in that, The fraud data in-depth analysis system includes: The data structuring module is used to transform the acquired source data of fraud cases into structured data. The model embedding module is used to construct a fraud analysis knowledge graph based on the structured data and embed the fraud analysis knowledge graph into the corresponding fraud analysis model. The fraud analysis module is used to obtain corresponding fraud feature data based on the fraud analysis knowledge graph, and input the fraud feature data into the fraud analysis model to obtain fraud analysis results; The model embedding module is also used for: The structured data is integrated to obtain triples, and the triples are then input into the graph database. The fraud analysis knowledge graph includes a case knowledge graph, a fund flow knowledge graph, and a call detail record (CDR) knowledge graph. The entity nodes of the case knowledge graph include at least the persons involved in the case, the accounts involved in the case, and the communication tools. The entity nodes of the fund flow knowledge graph include at least the accounts, fund transfer records, and the counterparties. The entity nodes of the CDR knowledge graph include at least the caller, the called party, and the base station location. Based on the case knowledge graph framework in the graph database, the corresponding case structure data is extracted from the triples to supplement the data and generate the corresponding case knowledge graph. Based on the knowledge graph framework of the capital flow in the graph database, the corresponding capital flow structure data is extracted from the triple to supplement the data and generate the corresponding capital flow knowledge graph. Based on the call detail record (CDR) knowledge graph framework in the graph database, the corresponding CDR structure data is extracted from the triples to supplement the data and generate the corresponding CDR knowledge graph. The case knowledge graph is embedded into the corresponding fraud analysis model; The aforementioned knowledge graph of fund flows is embedded into the corresponding fraud analysis model; The call detail record (CDR) knowledge graph is embedded into the corresponding fraud analysis model; The fraud analysis module is also used for: Based on the case knowledge graph, search for strongly related case data and / or weakly related case data in the graph database; The found strongly correlated case data and / or weakly correlated case data are input into the fraud analysis model to obtain fraud analysis results.

11. The fraud data deep analysis system as described in claim 10, wherein the data structuring module is further used to perform data cleaning on the acquired fraud case source data to obtain cleaned fraud case source data; The data structuring module is also used to perform word segmentation processing on the cleaned source data of fraud cases to obtain word segmentation data; The data structuring module is also used to perform knowledge extraction processing on the word segmentation data according to preset structuring rules to obtain structured data.

12. The fraud data deep analysis system as described in claim 11, wherein the fraud analysis module is further configured to extract target question-and-answer mapping relationships based on the case knowledge graph, and establish corresponding question-and-answer templates based on the target question-and-answer mapping relationships; The fraud analysis module is also used to generate a case-handling plugin based on the question-and-answer template and the target question-and-answer mapping relationship, and to integrate the case-handling plugin into the fraud analysis model.

13. The fraud data deep analysis system as described in claim 10, wherein the fraud analysis module is further configured to search for target accounts whose historical fund flows are lower than a preset minimum fund flow from the fund flow knowledge graph; The fraud analysis module is also used to send the transaction record corresponding to the target funds to the fraud analysis model when it detects that the target account has received more funds than the preset target funds flow, so as to obtain fraud analysis results.

14. The fraud data deep analysis system as described in claim 10, wherein the fraud analysis module is further configured to obtain the initiation location of the call detail record (CDR) data from the call detail record knowledge graph and count the number of CDRs at each initiation location; The fraud analysis module is also used to input the target initiation location into the fraud analysis model when it detects that there is a target initiation location with a number of call records greater than the preset number of call records, so as to obtain fraud analysis results.

Images