Fraud risk assessment method, device, equipment and storage medium

Abstract

The present application discloses a fraud risk assessment method, apparatus, device and storage medium, which includes: obtaining a user to be evaluated; determining at least one user to be verified based on the user to be evaluated, and the association probability between the user to be verified and the user to be evaluated; determining fraudulent users based on each user to be verified in combination with a user blacklist, and determining the similarity between the user to be evaluated and each fraudulent user; for each fraudulent user, performing a weighted operation on the similarity and its corresponding association probability based on the user path length to obtain a user risk value; determining a risk assessment value based on the risk value of each user; solving the problem of only evaluating individual users during risk assessment, calculating the association probability and similarity between the user to be evaluated and the fraudulent user, assigning different weights based on the user path length, and then determining the risk assessment value of the user to be evaluated; when performing fraud risk assessment on the user to be evaluated, considering other users in the relationship network, thereby improving the accuracy of risk identification.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a fraud risk assessment method, apparatus, device, and storage medium. Background Art

[0002] With banks' digital transformation, the growth of credit scale, and profound changes in customer structure, credit fraud has become more dynamic, frequent, and industrialized, making anti-fraud efforts increasingly difficult. Furthermore, credit risk control systems within banks' traditional business models are struggling to meet operational needs.

[0003] When credit anti-fraud uses a single customer as the assessment object to identify individual fraud risks, it pays less attention to the credit risks of customer relationship networks and customers extended by the customer relationship networks, and ignores the correlation of risk factors, resulting in low efficiency in identifying gang fraud and inability to accurately identify fraudulent users. Summary of the Invention

[0004] The present invention provides a fraud risk assessment method, apparatus, device and storage medium to solve the problem of inaccurate prediction of risky users.

[0005] According to one aspect of the present invention, a fraud risk assessment method is provided, comprising:

[0006] Get the user to be evaluated;

[0007] Determining at least one user to be verified based on the user to be evaluated, and an association probability between the user to be verified and the user to be evaluated;

[0008] Determine fraudulent users based on each of the users to be verified and a user blacklist, and determine the similarity between the user to be evaluated and each of the fraudulent users;

[0009] For each fraudulent user, a weighted calculation is performed on the similarity and its corresponding association probability according to the user path length to obtain a user risk value;

[0010] A risk assessment value is determined according to each of the user risk values.

[0011] According to another aspect of the present invention, there is provided a fraud risk assessment device, comprising:

[0012] User acquisition module, used to obtain users to be evaluated;

[0013] a to-be-verified user determination module, configured to determine at least one to-be-verified user based on the to-be-evaluated user, and an association probability between the to-be-verified user and the to-be-evaluated user;

[0014] A similarity determination module, configured to determine fraudulent users based on each of the users to be verified in combination with a user blacklist, and determine the similarity between the user to be evaluated and each of the fraudulent users;

[0015] A user risk determination module is used to perform a weighted operation on the similarity and its corresponding association probability according to the user path length for each fraudulent user to obtain a user risk value;

[0016] The risk assessment module is used to determine a risk assessment value according to each user risk value.

[0017] According to another aspect of the present invention, an electronic device is provided, comprising:

[0018] at least one processor; and

[0019] a memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the fraud risk assessment method according to any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the fraud risk assessment method according to any embodiment of the present invention when executed.

[0022] The technical solution of the embodiment of the present invention obtains a user to be evaluated; determines at least one user to be verified based on the user to be evaluated, and the association probability between the user to be verified and the user to be evaluated; determines fraudulent users based on each user to be verified and a user blacklist, and determines the similarity between the user to be evaluated and each fraudulent user; for each fraudulent user, performs a weighted operation on the similarity and its corresponding association probability based on the user path length to obtain a user risk value; and determines a risk assessment value based on each user risk value. This solves the problem of only evaluating individual users during risk assessment, determines the users to be verified associated with the user to be evaluated, verifies the user to be verified to determine the fraudulent user, calculates the similarity between the user to be evaluated and the fraudulent user, assigns different weights to the similarity and association probability based on the user path length, calculates the user risk value of each fraudulent user, and then determines the risk assessment value of the user to be evaluated. When performing fraud risk assessment on the user to be evaluated, other users in the relationship network are considered to accurately identify the fraudulent user, thereby improving the accuracy of risk identification. Furthermore, different weights are assigned to risk identification based on the user path length, further improving the accuracy of risk identification.

[0023] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 This is a flowchart of a fraud risk assessment method provided according to the first embodiment of the present invention;

[0026] Figure 2 This is a flowchart of a fraud risk assessment method provided according to the second embodiment of the present invention;

[0027] Figure 3 This is an example diagram showing a subgraph to be evaluated according to the second embodiment of the present invention;

[0028] Figure 4 This is a schematic diagram of the structure of a fraud risk assessment device provided according to the third embodiment of the present invention;

[0029] Figure 5 The figure is a schematic diagram of the structure of an electronic device for implementing the fraud risk assessment method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] Example 1

[0033] Figure 1 A flowchart of a fraud risk assessment method is provided for the first embodiment of the present invention. This embodiment is applicable to the case of fraud risk assessment of users. The method can be performed by a fraud risk assessment device, which can be implemented in the form of hardware and / or software. The fraud risk assessment device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0034] S101: Obtain the user to be evaluated.

[0035] In this embodiment, the user to be assessed can be specifically understood as a user with an assessment requirement. The fraud risk assessment performed on a user in this application can be performed when the user applies for credit to determine whether to approve the credit, or it can be performed at any time to identify risks in advance. Users can apply for credit by registering an account, logging into the bank's system using the account, and applying for credit on the bank's system; or they can apply for credit through a bank representative at the bank's service hall.

[0036] S102: Determine at least one user to be verified based on the user to be evaluated, and an association probability between the user to be verified and the user to be evaluated.

[0037] In this embodiment, the user to be checked can be specifically understood as a user who is associated with the user to be evaluated within a certain range. The association probability can be specifically understood as the probability of an association relationship between the user to be checked and the user to be evaluated.

[0038] Specifically, the system predetermines the possible relationships between users in the banking system. After identifying the user to be evaluated, it then identifies users who have existing relationships with the user to be evaluated, as well as users who are associated with the user to be evaluated through one or more users. The relationships between the user to be evaluated and each user are analyzed to determine the probability of association. By screening the association probabilities, users with higher association probabilities are identified as users to be verified, and the probability of association between each user to be verified and the user to be evaluated is determined.

[0039] S103: Determine fraudulent users based on each user to be verified and a user blacklist, and determine the similarity between the user to be evaluated and each fraudulent user.

[0040] In this embodiment, the user blacklist stores identifiers of users with poor credit. This user blacklist includes administrative and judicial blacklists, bank credit blacklists, and other financial institution blacklists. The bank credit blacklist can be dynamically updated in real time based on fraud incidents. Fraudulent users can be understood as users who pose a fraud risk or have committed fraudulent acts.

[0041] Obtain a user blacklist, which includes one or more users, each identified by their user ID. Match each user to be verified against a user in the blacklist. If a match is successful, the user to be verified is considered a fraudulent user. Calculate the similarity between the user to be evaluated and the fraudulent user based on their association.

[0042] S104: For each fraudulent user, perform a weighted operation on the similarity and the corresponding association probability according to the user path length to obtain a user risk value.

[0043] In this embodiment, the user path length may be specifically understood as the path length between two users, for example, the number of users that user A passes through to reach user B.

[0044] Determine the similarity, association probability and user path length between each fraudulent user and the user to be evaluated, calculate the risk value of the similarity based on the similarity, calculate the risk value of the association probability based on the association probability, determine the weight of the risk value of the similarity based on the user path length, and the weight of the risk value of the association probability, and then perform a weighted operation on the two risk values ​​according to the weights to obtain the user risk value.

[0045] S105: Determine a risk assessment value based on each user's risk value.

[0046] In this embodiment, the risk assessment value can be specifically understood as a numerical value used to represent risk, and a larger risk assessment value indicates a greater risk. The risk assessment value of each user is obtained by performing an operation, for example, taking the maximum value, summing the values, etc.

[0047] This embodiment provides a fraud risk assessment method, which includes obtaining a user to be assessed; determining at least one user to be verified based on the user to be assessed, and the association probability between the user to be verified and the user to be assessed; determining fraudulent users based on each of the users to be verified and a user blacklist, and determining the similarity between the user to be assessed and each of the fraudulent users; performing a weighted operation on the similarity and its corresponding association probability based on the user path length for each fraudulent user to obtain a user risk value; and determining a risk assessment value based on each of the user risk values. This method solves the problem of only assessing individual users during risk assessment. The method determines users to be verified associated with the user to be assessed, verifies the user to be verified, identifies fraudulent users, calculates the similarity between the user to be assessed and the fraudulent users, assigns different weights to the similarity and association probability based on the user path length, calculates the user risk value for each fraudulent user, and then determines the risk assessment value for the user to be assessed. When performing fraud risk assessment on the user to be assessed, other users in the relationship network are considered to accurately identify fraudulent users, thereby improving the accuracy of risk identification. Furthermore, different weights are assigned to risk identification based on the user path length, further improving the accuracy of risk identification.

[0048] Example 2

[0049] Figure 2 This is a flowchart of a fraud risk assessment method provided by Example 2 of the present invention. This example is refined based on the above example. Figure 2 As shown, the method includes:

[0050] S201: Obtain the user to be evaluated.

[0051] S202: Determine a subgraph to be evaluated according to the user to be evaluated, where the subgraph to be evaluated includes at least one associated user.

[0052] In this embodiment, the subgraph to be evaluated can be understood as a social subgraph that describes the users associated with the user to be evaluated. Associated users can be understood as users associated with the user to be rated. The subgraph to be evaluated includes the user to be evaluated and associated users associated with the user to be evaluated.

[0053] As an optional embodiment of this embodiment, this optional embodiment further optimizes the subgraph to be evaluated according to the user to be evaluated to:

[0054] A1. Obtain the pre-built user knowledge graph.

[0055] In this embodiment, the user knowledge graph can be specifically understood as a knowledge graph used to describe users and the relationships between users.

[0056] Obtain the user information in the row in advance, build a user knowledge graph based on the user information and save it, and directly obtain the user knowledge graph from the corresponding storage space when using it.

[0057] Obtain the personal application information and operational behavior data of the bank's credit users. The user's personal application information includes work information, education information, residential address, etc.; operational behavior data includes historical transaction behavior, IP and MAC addresses of commonly used Internet devices for online banking and mobile banking, historical GPS information, the length of time between the first registration time and the credit application time, and behavioral statistics within the week before the credit application. Construct a knowledge graph for the obtained user information in the form of triples, namely (entity 1-relationship-entity 2) and (entity-attribute-attribute value). Entity refers to a customer. Attribute value refers to the value of the attribute pointed to by the entity, such as the customer's education level, age, etc. Relationship refers to whether there is a community relationship between entities.

[0058] A2. With the user to be evaluated as the center, traverse the user knowledge graph and perform six-degree segmentation to determine the subgraph to be evaluated of the user to be evaluated.

[0059] With the user to be evaluated as the center, the user knowledge graph is traversed to determine the entities directly adjacent to the user to be evaluated and all entities and attributes associated within six degrees of association, and the topological structure is retained to generate the subgraph to be evaluated.

[0060] For example, Figure 3 This is an example diagram of a subgraph to be evaluated provided in an embodiment of the present application. The black circles in the figure are users 31 to be evaluated, and the white circles are associated users 32. Only a few associated users 32 are marked in the figure for example. Similar white circles are all associated users 32. They are not marked one by one in the figure, and those skilled in the art will know this.

[0061] S203 : Determine the association probability between the user to be evaluated and each associated user according to the subgraph to be evaluated and a predetermined target variational autoencoder.

[0062] In this embodiment, the target variational autoencoder can be specifically understood as a variational autoencoder that meets the requirements obtained through training. A variational autoencoder is pre-built and trained to obtain the target variational autoencoder. The subgraph to be evaluated is processed into data that the target variational autoencoder can recognize and then input into the target variational autoencoder. The target variational autoencoder makes predictions based on the input data and obtains the association probability between the user to be evaluated and each associated user.

[0063] As an optional embodiment of this embodiment, this optional embodiment further optimizes the determination step of the target variational autoencoder to:

[0064] B1. Obtain a pre-built user knowledge graph and a preset number of target users.

[0065] In this embodiment, target users can be specifically understood as users whose relationships with other users are predicted during model training. After obtaining the user knowledge graph, target users are selected based on the users in the user knowledge graph for model training. Target users can be selected randomly, or a certain number of creditworthy users and a certain number of fraudulent users can be selected to ensure training accuracy.

[0066] B2. Taking each target user as the center, traverse the user knowledge graph and perform six-degree segmentation to determine the target subgraph for each target user.

[0067] With the target user as the center, the user knowledge graph is traversed to determine the entities directly adjacent to the target user and all entities and attributes associated within six degrees. The topological structure is retained to generate the target subgraph, which includes the target user and users who may have an associated relationship with the target user.

[0068] B3. Remove the association probability in each target subgraph according to the preset rules to form a subgraph to be trained.

[0069] In this embodiment, the preset rule can be to randomly remove association probabilities according to a certain ratio, or to determine the number of users directly associated with each user in the target subgraph and then remove association probabilities according to a certain ratio, etc. A rule is pre-set, and for each target subgraph, the association probabilities in the target subgraph are randomly removed according to the preset rule. The association probabilities in the target subgraph can be the association probabilities between any two associated users in the target subgraph, forming a subgraph to be trained. In this case, if there are two users in the subgraph to be trained with unknown association probabilities, they are annotated according to the removed association probabilities to facilitate subsequent model training.

[0070] B4. Train the initial variational autoencoder according to each subgraph to be trained to obtain the target variational autoencoder.

[0071] In this embodiment, the initial variational autoencoder can be specifically understood as an untrained variational autoencoder. Each subgraph to be trained and its corresponding annotation are used as a training set to train the initial variational autoencoder to obtain a target variational autoencoder.

[0072] The variational autoencoder consists of a two-layer neural network encoder and a two-layer neural network decoder. The number of neurons in the hidden layer is N-256-128-256-N, where N is the input dimension. The variational autoencoder inputs the subgraph adjacency matrix A and the node feature matrix X. The output is the reconstructed adjacency matrix A*. The output of the final decoder layer is transformed using a softmax function to obtain the association probability matrix of the reconstructed result.

[0073] Training the initial variational autoencoder is to maximize the loss function

[0074]

[0075] in, represents the cross entropy function, Z represents the latent variable vector of the initial variational autoencoder, p(A|Z) represents the posterior distribution fitted by the decoder, q(Z|X,A) represents the parameterized distribution of the encoder for the input subgraph, p(Z) represents the Gaussian distribution, and KL[q(·)||p(·)] represents the KL divergence between q(·) and p(·).

[0076] As an optional embodiment of this embodiment, this optional embodiment further optimizes the association probability between the user to be evaluated and each associated user according to the subgraph to be evaluated and the predetermined target variational autoencoder to be determined as follows:

[0077] C1. Determine the adjacency matrix and node feature matrix based on the subgraph to be evaluated.

[0078] In this embodiment, the adjacency matrix can be specifically understood as a two-dimensional array that stores data about the associated users in the subgraph to be evaluated and the relationships between the subgraphs to be evaluated. The node feature matrix stores feature data about the associated users and the users to be evaluated. The subgraph to be evaluated is processed to obtain an adjacency matrix and a node feature matrix that represent the subgraph to be evaluated.

[0079] C2. Input the adjacency matrix and node feature matrix into the predetermined target variational autoencoder to obtain the output association probability matrix.

[0080] The adjacency matrix and node feature matrix are input into the target variational autoencoder, which outputs the association probability matrix after processing.

[0081] C3. Determine the association probability between the user to be evaluated and each associated user according to the association probability matrix.

[0082] The association probability matrix is ​​used to determine the association probability between each user, and the association probability between the user to be evaluated and each associated user is further determined.

[0083] S204: Determine at least one user to be checked according to each association probability.

[0084] Each association probability is screened. The larger the association probability, the stronger the association between the two users. Users with stronger association are selected as users to be tested. For example, a preset number of associated users with higher probabilities are selected as users to be tested based on each association probability; or associated users with association probabilities greater than a certain probability threshold are selected as users to be tested.

[0085] As an optional embodiment of this embodiment, this optional embodiment further optimizes determining at least one user to be verified based on each association probability as follows: judging whether there is an association probability greater than a probability threshold; if so, determining the associated user corresponding to the association probability greater than the probability threshold as the user to be verified; otherwise, determining the associated user corresponding to the maximum value of the association probability as the user to be verified.

[0086] In this embodiment, the probability threshold pattern is pre-set based on requirements. When the association probability is greater than the probability threshold, there is a strong association between the two users. If there is an association probability greater than the probability threshold, the associated user corresponding to the association probability greater than the probability threshold is determined as the user to be verified. If there is no association probability greater than the probability threshold, the maximum probability among the association probabilities is determined, and the associated user corresponding to the maximum probability is determined as the user to be verified.

[0087] S205 : Determine fraudulent users based on each user to be verified and the user blacklist, and determine the similarity between the user to be evaluated and each fraudulent user.

[0088] This embodiment of the application provides a similarity calculation formula:

[0089]

[0090] Among them, Q(i,j) represents the similarity between the user j to be evaluated and the fraudulent user i, I(i) represents the set of incident adjacent nodes of the fraudulent user i, and I m (i) represents the mth neighboring node of fraudulent user i. I(j) represents the set of incident neighboring nodes of user j to be evaluated, I n (j) represents the nth neighboring node of the user j to be evaluated, |I(i)| is the number of incident neighboring nodes of the fraudulent user i, |I(j)| is the number of incident neighboring nodes of the user j to be evaluated; s(I m (i),I m (j)) is 1 m (i) and I n (j); β is the damping coefficient, and β∈(0,1). In other cases, Q(i,j)=0.

[0091] The similarity can be calculated by cosine distance, Euclidean distance, etc.

[0092] S206 : For each fraudulent user, calculate the product of the fraudulent user similarity and the corresponding user path length to determine a similarity risk value.

[0093] In this embodiment, the similarity risk value can be specifically understood as a numerical value used to represent the risk level of similarity between two users. For each fraudulent user, a corresponding user risk value is calculated. The shortest path between the fraudulent user and the user to be evaluated is determined and used as the user path length. The user path length is used as a weight, and the similarity risk value is calculated by multiplying the user path length by the similarity value to obtain the similarity risk value.

[0094] S207 : Determine an association probability risk value based on the association probability of the fraudulent user, the number of users to be verified, and the corresponding user path length.

[0095] In this embodiment, the association probability risk value can be specifically understood as a numerical value representing the risk level of the association between two users. The shortest path between the fraudulent user and the user to be assessed is determined as the user path length. The number of users to be assessed is determined, and a weight is calculated based on the number of users and the user path length. The product of the weight and the association probability is calculated to obtain the association probability risk value.

[0096] This embodiment of the application provides a method for calculating weights based on the number of users and the length of user paths:

[0097]

[0098] Among them, w is the weight, d i is the user path length between the user to be evaluated and the fraudulent user,

[0099] |S| is the number of users to be tested.

[0100] S208: Determine the user risk value according to the similarity risk value and the association probability risk value.

[0101] The method of determining the user risk value through the similarity risk value and the associated probability risk value can be summing, taking the maximum value, weighted summing, etc.

[0102] S209: Determine a risk assessment value based on each user's risk value.

[0103] The risk assessment value can be calculated using any calculation method. Due to the existence of group fraud, in order to improve the accuracy of risk detection of group fraud, it is preferred to accumulate the risk values ​​of each user to obtain the risk assessment value. In this case, the fraud risk is derived from the accumulation of the probability and similarity of association between the customer and the fraud node.

[0104] For example, the present invention provides a formula for calculating the risk assessment value:

[0105]

[0106] Where R is the risk assessment value, i is the fraudulent user, S is the set of users to be verified, |S| is the number of users in the set of users to be verified, that is, the number of users to be verified, d i is the user path length between fraudulent user i and user j to be evaluated, Q(i,j) is the similarity between fraudulent user i and user j to be evaluated, P i is the association probability between fraudulent user i and user j to be evaluated.

[0107] The above formula means that the fraud risk comes from the accumulation of the association probability and similarity between the user to be evaluated and the fraud user, and is positively correlated with the association probability and similarity; when the distance between the user to be evaluated and the fraud user is large, it means that the association between the user to be evaluated and the fraud user itself is weak, so the risk assessment increases the weight of the similarity between the user to be evaluated and the fraud user, and reduces the weight of the direct association probability.

[0108] S210: When the risk assessment value is greater than a preset risk threshold, the user to be checked is determined to be a risky user.

[0109] In this embodiment, the preset risk threshold can be specifically understood as a threshold for determining whether the risk assessment value is safe. The size of the preset risk threshold is related to the size of the user's knowledge graph. The larger the user's knowledge graph, the larger the preset risk threshold. When the risk assessment value is greater than the preset risk threshold, the user under assessment has a high fraud risk and is determined to be a risky user. Risky users may be subject to loan restrictions or loan denials.

[0110] The embodiment of the present application provides a fraud risk assessment method, which converts the fraud risk assessment problem into a link (association) prediction and node feature similarity assessment problem in the knowledge graph, evaluates the fraud risk from two dimensions, and obtains a more comprehensive and complete risk assessment result; the present invention proposes to use unsupervised learning to perform association prediction, mine the topological structure of the knowledge graph, that is, the hidden information between the user to be evaluated and the fraud user or the risk attribute, and further mine the user's potential gang fraud risk. Compared with other traditional anti-fraud technologies, the present application proposes to use variational autoencoders to perform knowledge reasoning on the knowledge graph, learn the data distribution of fraud gang customer data and behavior information, and can more accurately evaluate the association between the user to be evaluated and the fraud user, and deal with more advanced fraud methods; the present application uses unsupervised learning for association prediction. Compared with supervised learning, there is no need to prepare large-scale label data in the data preprocessing stage, which saves labor costs and improves the efficiency of anti-fraud technology.

[0111] Example 3

[0112] Figure 4 This is a schematic diagram of the structure of a fraud risk assessment device provided by the third embodiment of the present invention. Figure 4 As shown, the device includes: a user acquisition module 41 , a to-be-verified user determination module 42 , a similarity determination module 43 , a user risk determination module 44 and a risk assessment module 45 .

[0113] The user acquisition module 41 is used to acquire the user to be evaluated;

[0114] A to-be-verified user determination module 42 is configured to determine at least one to-be-verified user based on the to-be-evaluated user, and an association probability between the to-be-verified user and the to-be-evaluated user;

[0115] A similarity determination module 43 is configured to determine fraudulent users based on each of the users to be verified and a user blacklist, and determine similarities between the user to be evaluated and each of the fraudulent users;

[0116] A user risk determination module 44 is configured to perform a weighted operation on the similarity and its corresponding association probability according to the user path length for each fraudulent user to obtain a user risk value;

[0117] The risk assessment module 45 is configured to determine a risk assessment value according to each user risk value.

[0118] This embodiment provides a fraud risk assessment device that solves the problem of only assessing individual users during risk assessment. It identifies users to be verified that are associated with the user to be assessed, verifies the verified users to identify fraudulent users, calculates the similarity between the user to be assessed and the fraudulent users, assigns different weights to the similarity and association probability based on user path length, calculates a user risk value for each fraudulent user, and then determines the risk assessment value for the user to be assessed. When assessing the fraud risk of the user to be assessed, other users in the relationship network are considered to accurately identify fraudulent users and improve the accuracy of risk identification. Furthermore, different weights are assigned to risk identification based on user path length, further improving the accuracy of risk identification.

[0119] Optionally, the to-be-verified user determination module 42 includes:

[0120] a subgraph to be evaluated determining unit, configured to determine a subgraph to be evaluated according to the user to be evaluated, wherein the subgraph to be evaluated includes at least one associated user;

[0121] an association probability determining unit, configured to determine an association probability between the user to be evaluated and each of the associated users based on the subgraph to be evaluated and a predetermined target variational autoencoder;

[0122] The to-be-checked user determining unit is configured to determine at least one to-be-checked user according to each of the associated probabilities.

[0123] Optionally, the subgraph to be evaluated determining unit is specifically used to: obtain a pre-built user knowledge graph; traverse the user knowledge graph with the user to be evaluated as the center and perform six-degree segmentation to determine the subgraph to be evaluated of the user to be evaluated.

[0124] Optionally, the association probability determination unit is specifically used to: determine the adjacency matrix and the node feature matrix based on the subgraph to be evaluated; input the adjacency matrix and the node feature matrix into a predetermined target variational autoencoder to obtain an output association probability matrix; and determine the association probability between the user to be evaluated and each of the associated users based on the association probability matrix.

[0125] Optionally, the unit for determining the user to be verified is specifically used to: determine whether there is an association probability greater than a probability threshold; if so, determine the associated user corresponding to the association probability greater than the probability threshold as the user to be verified; otherwise, determine the associated user corresponding to the maximum value of the association probability as the user to be verified.

[0126] Optionally, the device further includes:

[0127] The target user determination module is used to obtain a pre-built user knowledge graph and a preset number of target users;

[0128] A target subgraph determination module is configured to traverse the user knowledge graph and perform six-degree segmentation with each target user as the center to determine the target subgraph of each target user;

[0129] A module for determining a subgraph to be trained, configured to remove the association probability in each target subgraph according to a preset rule to form a subgraph to be trained;

[0130] A training module is used to train the initial variational autoencoder according to each of the subgraphs to be trained to obtain a target variational autoencoder.

[0131] Optionally, the user risk determination module 44 includes:

[0132] a similarity risk value determining unit, configured to calculate the product of the similarity of the fraudulent user and the corresponding user path length to determine a similarity risk value;

[0133] a probability risk value determining unit, configured to determine an association probability risk value based on the association probability of the fraudulent user, the number of users to be verified, and the corresponding user path length;

[0134] The user risk value determining unit is configured to determine the user risk value according to the similarity risk value and the associated probability risk value.

[0135] Optionally, the device further includes:

[0136] The risk user determination module is used to determine that the user to be checked is a risk user when the risk assessment value is greater than a preset risk threshold.

[0137] The fraud risk assessment device provided in the embodiment of the present invention can execute the fraud risk assessment method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0138] Example 4

[0139] Figure 5 A schematic diagram of the structure of an electronic device 50 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0140] like Figure 5 As shown, the electronic device 50 includes at least one processor 51 and a memory, such as a read-only memory (ROM) 52, a random access memory (RAM) 53, etc., which is communicatively connected to the at least one processor 51. The memory stores a computer program that can be executed by the at least one processor. The processor 51 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 52 or the computer program loaded from the storage unit 58 into the random access memory (RAM) 53. Various programs and data required for the operation of the electronic device 50 can also be stored in the RAM 53. The processor 51, ROM 52, and RAM 53 are connected to each other via a bus 54. An input / output (I / O) interface 55 is also connected to the bus 54.

[0141] Multiple components in the electronic device 50 are connected to the I / O interface 55, including an input unit 56, such as a keyboard, a mouse, etc.; an output unit 57, such as various types of displays, speakers, etc.; a storage unit 58, such as a magnetic disk, an optical disk, etc.; and a communication unit 59, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 59 allows the electronic device 50 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0142] Processor 51 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 51 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any other suitable processors, controllers, microcontrollers, etc. Processor 51 executes the various methods and processes described above, such as the fraud risk assessment method.

[0143] In some embodiments, the fraud risk assessment method can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 58. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 50 via ROM 52 and / or communication unit 59. When the computer program is loaded into RAM 53 and executed by processor 51, one or more steps of the fraud risk assessment method described above can be performed. Alternatively, in other embodiments, processor 51 can be configured to perform the fraud risk assessment method in any other suitable manner (e.g., via firmware).

[0144] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0145] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0146] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0147] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0148] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0149] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0150] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0151] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A fraud risk assessment method, characterized in that: include: Get the user to be evaluated; Determining at least one user to be verified based on the user to be evaluated, and an association probability between the user to be verified and the user to be evaluated, wherein the user to be verified is a user having a social association relationship with the user to be evaluated; Determine fraudulent users based on each of the users to be verified and a user blacklist, and determine the similarity between the user to be evaluated and each of the fraudulent users; For each fraudulent user, a weighted calculation is performed on the similarity and its corresponding association probability according to the user path length to obtain a user risk value; Determining a risk assessment value based on each of the user risk values; The calculation formula of the risk assessment value is: Where R is the risk assessment value, i is the fraudulent user, S is the set of users to be verified, |S| is the number of users in the set of users to be verified, and d i is the user path length between fraudulent user i and user j to be evaluated, Q(i,j) is the similarity between fraudulent user i and user j to be evaluated, P i is the association probability between fraudulent user i and user j to be evaluated.

2. The method according to claim 1, characterized in that The determining of at least one user to be verified based on the user to be evaluated, and the association probability between the user to be verified and the user to be evaluated, includes: Determine a subgraph to be evaluated according to the user to be evaluated, wherein the subgraph to be evaluated includes at least one associated user; Determine the association probability between the user to be evaluated and each of the associated users according to the subgraph to be evaluated and a predetermined target variational autoencoder; At least one user to be checked is determined according to each of the associated probabilities.

3. The method according to claim 2, characterized in that The determining the subgraph to be evaluated according to the user to be evaluated includes: Obtain pre-built user knowledge graph; Taking the user to be evaluated as the center, the user knowledge graph is traversed and six-degree segmentation is performed to determine the subgraph to be evaluated of the user to be evaluated.

4. The method according to claim 2, characterized in that The determining the association probability between the user to be evaluated and each of the associated users based on the subgraph to be evaluated and a predetermined target variational autoencoder includes: Determine an adjacency matrix and a node feature matrix according to the subgraph to be evaluated; Inputting the adjacency matrix and the node feature matrix into a predetermined target variational autoencoder to obtain an output association probability matrix; The association probability between the user to be evaluated and each of the associated users is determined according to the association probability matrix.

5. The method according to claim 2, characterized in that The determining of at least one user to be checked according to each of the association probabilities includes: Determine whether there is an association probability greater than a probability threshold, and if so, determine the associated user corresponding to the association probability greater than the probability threshold as the user to be verified; Otherwise, the associated user corresponding to the maximum value of the associated probability is determined as the user to be verified.

6. The method according to claim 2, characterized in that The step of determining the target variational autoencoder includes: Obtain a pre-built user knowledge graph and a preset number of target users; Taking each target user as the center, traverse the user knowledge graph and perform six-degree segmentation to determine the target subgraph of each target user; Removing the association probability in each target subgraph according to a preset rule to form a subgraph to be trained; The initial variational autoencoder is trained according to each of the subgraphs to be trained to obtain a target variational autoencoder.

7. The method according to claim 1, characterized in that The step of performing a weighted operation on the similarity and its corresponding association probability according to the user path length to obtain the user risk value includes: Calculate the product of the similarity of the fraudulent user and the corresponding user path length to determine the similarity risk value; Determine the association probability risk value based on the association probability of the fraudulent user, the number of users to be verified, and the corresponding user path length; A user risk value is determined according to the similarity risk value and the associated probability risk value.

8. The method according to any one of claims 1 to 7, characterized in that Also includes: When the risk assessment value is greater than a preset risk threshold, the user to be checked is determined to be a risky user.

9. A fraud risk assessment device, characterized in that: include: User acquisition module, used to obtain users to be evaluated; a to-be-verified user determination module, configured to determine at least one to-be-verified user based on the to-be-evaluated user, and an association probability between the to-be-verified user and the to-be-evaluated user, wherein the to-be-verified user is a user that has a social association relationship with the to-be-evaluated user; A similarity determination module, configured to determine fraudulent users based on each of the users to be verified in combination with a user blacklist, and determine the similarity between the user to be evaluated and each of the fraudulent users; A user risk determination module is used to perform a weighted operation on the similarity and its corresponding association probability according to the user path length for each fraudulent user to obtain a user risk value; A risk assessment module, configured to determine a risk assessment value based on each user risk value; The calculation formula of the risk assessment value is: Where R is the risk assessment value, i is the fraudulent user, S is the set of users to be verified, |S| is the number of users in the set of users to be verified, and d i is the user path length between fraudulent user i and user j to be evaluated, Q(i,j) is the similarity between fraudulent user i and user j to be evaluated, P i is the association probability between fraudulent user i and user j to be evaluated.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the fraud risk assessment method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the fraud risk assessment method according to any one of claims 1 to 8 when executed.

Images