A method and device for abnormal identification

Abstract

One aspect of the present disclosure relates to a method for abnormality identification, including collecting user information; organizing the user information into knowledge, the knowledge including the relationship between the user and the information, or between the information and the information; constructing a knowledge graph based on the organized knowledge, the knowledge graph including information nodes corresponding to the user and each piece of information, and including edges corresponding to the corresponding relationships; modeling the knowledge graph using a spatial domain-based graph convolution network to obtain a model; and training the model to determine whether the user is abnormal based on graph convolution calculations on the knowledge graph. The present disclosure also relates to other related aspects.

Description

Technical Field

[0001] The present application generally relates to anomaly identification, and more particularly to anomaly identification based on knowledge graphs. Background Art

[0002] In the confrontation between anomaly identification and governance, passively collected information is often used to judge the user's right or wrong (i.e., whether the user is abnormal).

[0003] For example, during enhanced due diligence (EDD), or enhanced due diligence, more in-depth due diligence can be conducted on high-risk customers to collect more information and gain a deeper understanding of customer activities, thereby reducing risks.

[0004] There are usually two main ways to identify anomalies in similar scenarios. One is to use some rules to identify whether there are inconsistencies between the collected user information and the existing user information, and the other is to use some mathematical models to model these data. However, such solutions either have too high labor costs or are difficult to control quality.

[0005] Therefore, there is a need in the art for improved technical solutions for abnormality identification. Summary of the invention

[0006] One aspect of the present disclosure relates to a method for anomaly identification, comprising collecting user information; organizing the user information into knowledge, wherein the knowledge includes the relationship between the user and the information, or between the information and the information; constructing a knowledge graph based on the organized knowledge, wherein the knowledge graph includes a user node corresponding to the user and an information node corresponding to each item of information, and includes edges corresponding to corresponding relationships; modeling the knowledge graph using a spatial domain-based graph convolutional network to obtain a model; and training the model to identify whether the user is abnormal based on graph convolution calculations on the knowledge graph.

[0007] According to some exemplary embodiments, the knowledge includes subject, predicate and object SPO triples.

[0008] According to some exemplary embodiments, the knowledge graph includes knowledge with the user as the subject and information as the object, or knowledge with information as the subject and further information related to the information as the object.

[0009] According to some exemplary embodiments, the knowledge with the user as the subject and the information as the object corresponds to the neighbor nodes in the model that have a one-hop distance from the user node, and the knowledge with the information as the subject and further information related to the information as the object corresponds to the nodes in the model that have a distance greater than one-hop from the user node.

[0010] According to some exemplary embodiments, training the model includes training the model using annotated users as ground truth of the model so that the weights of the edges in the knowledge graph after training reflect the importance of the corresponding relationship in the anomaly identification.

[0011] According to some exemplary embodiments, the information includes domain information of a group to which the user belongs and known individual information of the user.

[0012] According to some exemplary embodiments, the domain information of the group to which the user belongs includes transaction characteristics of categories such as the industry or occupation to which the user belongs; and the known individual information of the user includes the personal transaction behavior characteristics of the user.

[0013] According to some exemplary embodiments, the information further includes newly obtained supplementary information of the user.

[0014] According to some exemplary embodiments, each node in the knowledge graph carries its own eigenvalue or eigenvector.

[0015] According to some exemplary embodiments, the graph convolution calculation of the knowledge graph is based on the feature values ​​or feature vectors of the user node and the information node subset, wherein the information node subset is determined based on a hop count threshold.

[0016] Other aspects of the present disclosure also include corresponding devices, equipment, computer-readable media, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram showing a portion of an exemplary user knowledge graph according to an aspect of the present disclosure is shown.

[0018] Figure 2 A schematic diagram of a portion of an exemplary user knowledge graph model according to one aspect of the present disclosure is shown.

[0019] Figure 3 A schematic diagram of a neural network model of a generalized exemplary user knowledge graph model according to one aspect of the present disclosure is shown.

[0020] Figure 4 A flow chart of a method 400 for anomaly identification according to an aspect of the present disclosure is shown. DETAILED DESCRIPTION

[0021] A graph is a graphic consisting of several nodes and edges connecting two nodes, which is used to depict the relationship between different nodes. A graph is different from a general image. An image belongs to Euclidean space, and the number of neighbors of a node is fixed, while a graph belongs to non-Euclidean space, and the number of neighbors of a node is not fixed. A knowledge graph is a type of graph.

[0022] The knowledge graph is essentially a semantic network that reveals the relationship between entities. The knowledge graph consists of pieces of knowledge, each of which can be represented as a SPO triple (Subject-Predicate-Object), where the subject and object are nodes in the graph, and the predicate is the directed edge between the subject node and the object. A domain knowledge graph refers to a semantic network for a specific domain.

[0023] The construction of knowledge graph involves data collection, data combing and knowledge graph construction. For example, in the field of user anomaly identification, the user knowledge graph can include multiple parts of data.

[0024] According to an exemplary embodiment, part of the data of the user knowledge graph may include domain knowledge, which specifically means the domain knowledge of the user group to which the user belongs, such as transaction characteristics of categories such as the industry or profession to which the user belongs. For example, if the user is engaged in a mobile phone recharge business, the general transaction amount in the mobile phone recharge industry is generally an integer such as 50 or 100. For another example, general industries and professions will not have early morning transactions, and so on. These are the group characteristics in the field that form the domain knowledge about the user's transaction characteristics. Domain knowledge may not depend on individual users, but reflect the commonalities with the user group in the field. Domain knowledge can be collected, for example, through statistics or experience.

[0025] According to an exemplary embodiment, another part of the user knowledge graph may include knowledge of individual users, such as user behavior knowledge of individual users, which may include, for example, some personal characteristics of the user that are related to transaction behavior, such as age, income, preferences, etc.

[0026] According to an exemplary embodiment, another part of the user knowledge graph may further include supplementary knowledge, which includes information collected through active communication with users and can serve as a supplement to the above-mentioned user transaction behavior knowledge.

[0027] After one or more parts of data are collected, the collected data may be combed. According to an exemplary embodiment, combing may include, for example, classifying, arranging, associating, etc. the data to organize it into knowledge. For example, each piece of knowledge may be represented as a SPO triple (Subject-Predicate-Object), where the relationship between the subject (Subject) and the object (Object) is expressed by the predicate (Predicate).

[0028] After the data is sorted, a knowledge graph can be constructed based on the organized knowledge. According to an exemplary embodiment, the subject and object in each piece of knowledge can be used as nodes in the knowledge graph, and the predicate in each piece of knowledge can be used as a directed edge between the node representing the subject and the node as the object.

[0029] For a single user, the user knowledge graph may be expanded outward with the user node as the center. According to an exemplary embodiment, the knowledge graph may include one or more users, and nodes associated with different users may have relationships and be represented by directed edges.

[0030] Figure 1 FIG. 1 is a schematic diagram showing a portion of an exemplary user knowledge graph 100 according to an aspect of the present disclosure. As can be seen, Figure 1 This portion of the exemplary user knowledge graph 100 is centered on the user node and includes domain knowledge nodes, user transaction behavior knowledge nodes, and / or supplementary knowledge nodes, etc. Figure 1 Only one user node is shown in the exemplary user knowledge graph 100, but according to other exemplary embodiments, the exemplary user knowledge graph 100 may include one or more user nodes and their respective domain knowledge nodes, user transaction behavior knowledge nodes, and / or supplementary knowledge nodes, etc.

[0031] exist Figure 1 In the exemplary user knowledge graph 100, the user node may have associated domain knowledge nodes, including but not limited to, for example, industry, occupation..., and the knowledge of their relationship with the user node may be, for example, (user, belongs to, industry) and (user, has, occupation), etc.

[0032] According to an exemplary embodiment, an industry node may have one or more associated industry transaction characteristic nodes, and the knowledge of their relationship with the industry node may include, for example, (industry, has, industry transaction characteristic 1), (industry, has, industry transaction characteristic 2)...

[0033] According to an exemplary embodiment, a career node may have one or more associated career trading characteristics, and the knowledge of their relationship to the career node may, for example, include (career, has, career trading characteristic 1), (career, has, career trading characteristic 2)...

[0034] exist Figure 1 In the exemplary user knowledge graph 100, the user node may also have associated user transaction behavior knowledge nodes, including but not limited to income, age, etc., and the knowledge of their relationship with the user node may include, for example, (user, has, income) and (user, is, age), etc.

[0035] exist Figure 1 In the exemplary user knowledge graph 100, the user node may also have associated supplementary knowledge nodes, including but not limited to collection information nodes, etc., and their relationship with the user node may include, for example, (user, has, collects information).

[0036] According to an exemplary embodiment, a collection information node may have one or more associated specific supplementary information knowledge nodes, including but not limited to, for example, job title, source of income, etc., and their relationships with the collection information node may respectively include, for example, (collection information, yes, job title), (collection information, yes, source of income).

[0037] According to an exemplary embodiment, each node may have its own eigenvalue or eigenvector. For example, the eigenvalue of an income node may include an income value or an income bin value, etc., and the eigenvalue of an occupation node may include encoding values ​​or embedding vectors of different occupations, etc.

[0038] Figure 1 The exemplary user knowledge graph 100 can be obtained, for example, by collecting data as described above, combing the collected data (including, for example, categorizing, sorting, associating, etc. the data to organize it into knowledge), and constructing a user knowledge graph based on the combing of the data.

[0039] In obtaining such Figure 1 After the user knowledge graphs such as , the solution of the present disclosure may include modeling the user knowledge graph. The goal of modeling the user knowledge graph may include classifying and predicting the entire constructed user knowledge graph.

[0040] According to an exemplary embodiment, since each user's knowledge graph is not sure to consist of several nodes, a spatial domain-based graph convolutional network such as GAT or GraphSAGE can be used to make full use of all nodes around the user.

[0041] According to an exemplary embodiment, modeling may include combining Figure 1The user knowledge graph constructed by combing and constructing is used to model the user. For example, the user node in the user knowledge graph together with the nodes directly or indirectly associated with it can be used as the nodes in the model of the user's knowledge graph. The established model can calculate the graph convolution of the user node based on the graph convolution algorithm to determine whether the corresponding user node is abnormal.

[0042] There are various ways to calculate the graph convolution of a user node. A more commonly used way to calculate the graph convolution of a user node may include constructing a feature matrix based on the eigenvalues ​​or eigenvectors of the user node and neighbor nodes, and constructing an adjacency matrix and a degree matrix based on the connection relationship between the nodes and the number of hops between the node and the user node, thereby calculating the graph convolution of the user node based on these matrices.

[0043] According to an exemplary embodiment, the user who has been annotated can be used as the ground truth of the model, and the model of the user's knowledge graph can be trained on this basis to train the weights of the edges between nodes (also known as "attention"). To some extent, the weight of each edge after training reflects the corresponding relationship (that is, the importance of the neighbor node to the user node).

[0044] Figure 2 FIG. 2 is a schematic diagram showing a portion of an exemplary user knowledge graph model 200 according to an aspect of the present disclosure. Figure 2 As shown in the exemplary user knowledge graph model 200 of FIG. 1 , the h1 node may correspond to a user node, and it is connected to the associated neighbor nodes h2, h3, h4, h5, etc. via directed edges. According to some exemplary embodiments, the h1 node may also be connected to the user node via directed edges a 11 Connect with itself to form a ring. Figure 2 The exemplary user knowledge graph model 200 shown can be obtained by mapping from the user knowledge graph.

[0045] According to an exemplary embodiment, neighbor nodes h2, h3, h4, h5, etc. associated with user node h1 may correspond to the above-mentioned neighbor nodes h2, h3, h4, h5, etc., respectively, for example, in combination with Figure 1 The domain knowledge nodes, user transaction behavior knowledge nodes, and / or supplementary knowledge nodes described in the examples, etc. For example, the neighbor nodes h2, h3, h4, h5, etc. associated with the user node h1 may include the aforementioned industry nodes, occupation nodes, income nodes, age nodes, collection information nodes, etc., respectively.

[0046] although Figure 2 For simplicity, only one-hop network is shown in the exemplary user knowledge graph model 200, but the present disclosure is not limited thereto and may include a multi-hop network. For example, neighbor nodes h2, h3, h4, h5, etc. associated with user node h1 may further include respective neighbor nodes.

[0047] In the initial state, Figure 2 The attention coefficient a of the directed edge of the exemplary user knowledge graph model 200 11 、a 12 、a 13 、a 14 、a 15 etc. may be given initial values ​​(eg, random values) and may be trained by utilizing the groundtruth label of the user node h1 (eg, classified as abnormal or normal).

[0048] According to an exemplary embodiment, the attention coefficient a of the directed edge can be obtained by calculating the similarity coefficient between the neighbor node and the user node h1 (for example, based on the eigenvalues ​​or eigenvectors of the neighbor node and the user node itself) and then normalizing the result. 11 、a 12 、a 13 、a 14 、a 15 wait.

[0049] Specifically, a commonly used method for calculating the attention coefficient may include, for example, calculating the node h according to the following formula (1): i Neighbors With the node h i Similarity coefficient between themselves:

[0050]

[0051] Among them, W is a shared parameter used to i The feature of Wh is increased in dimension. “||” indicates that the feature Wh after dimensionality increase i and Wh j Concatenate, and finally a() maps the concatenated features to real numbers.

[0052] Then, the attention coefficient can be calculated using the following formula (2):

[0053]

[0054] Subsequently, the eigenvalue or eigenvector of each neighbor node can be weightedly summed according to the calculated directed edge attention coefficient to obtain the new feature h'1 output by the user node h1 (i.e., the input to the next layer of neurons in the model).

[0055]

[0056] Where σ() is the activation function.

[0057] Although the above formulas (1)-(3) show some specific ways to calculate the similarity coefficient, attention coefficient and new features, the present disclosure is not limited thereto, but other variants or similar functions may be used to achieve similar purposes and / or similar effects.

[0058] Generally speaking, since one layer of neurons can complete the calculation of node relationships within one hop, when the user node in the exemplary user knowledge graph model 200 includes more than one layer of neighbor nodes, the model needs to train corresponding multiple layers of neurons to complete the calculation of the relationship with all associated nodes. According to an exemplary embodiment, a suitable hop count threshold can be set.

[0059] Finally, the output of the last layer of neurons can be connected to the classifier, and trained to determine whether the user node is abnormal based on the ground truth. For example, when the hop count threshold is 1 (i.e., only the neighboring nodes within one hop from the user node are considered), the new feature h'1 can be directly connected to the classifier to determine whether the user node is abnormal.

[0060] Figure 3 A schematic diagram of a neural network model 300 of a generalized exemplary user knowledge graph model according to one aspect of the present disclosure is shown.

[0061] like Figure 3 As shown in , the neural network model 300 of the exemplary user knowledge graph model may include an input layer 302 , two or more intermediate layers 304 , and a classifier 306 .

[0062] According to an exemplary embodiment, the input layer 302 may include, for example, a combination of the above Figure 2 Described nodes h2, h3, h4, h5, etc.

[0063] According to an exemplary embodiment, two or more intermediate layers 304 may include, for example, a user node layer h1 and a user node layer h'1, etc., wherein the user node layer h1 can be directly connected to the output of the corresponding neighbor nodes (e.g., h2, h3, h4, h5), etc. in the input layer 302, and the user node layer h'1 can be directly connected to the output of the user node layer h1 of the previous layer.

[0064] According to an exemplary embodiment, the two or more intermediate layers 304 may further include more intermediate layers. The number of intermediate layers depends on the set hop count threshold.

[0065] According to an exemplary embodiment, the final output of the intermediate layer may be connected to the classifier 306. The classifier 306 performs classification based on the output of the intermediate layer 304 to determine whether the corresponding user node is abnormal.

[0066] According to an exemplary embodiment, the classifier 306 may be a hard classifier to directly output whether the corresponding user node is abnormal or not. According to other exemplary embodiments, the classifier 306 may also be a soft classifier to output, for example, the probability that the corresponding user node is abnormal.

[0067] Figure 4 A flow chart of a method 400 for anomaly identification according to an aspect of the present disclosure is shown. The method 400 may include constructing a user knowledge graph at block 402 .

[0068] According to an exemplary embodiment, the user knowledge graph construction of block 402 may include data collection in sub-block 402 - 1 .

[0069] According to an exemplary embodiment, data collection may include, but is not limited to, domain knowledge, user transaction behavior knowledge, and supplementary knowledge, etc.

[0070] Domain knowledge may include but is not limited to transaction characteristics of the industry or occupation to which the user belongs, that is, group characteristics in the field form domain knowledge about the transaction characteristics of users. Domain knowledge may not depend on individual users, but reflect the commonalities with the user group in the field. Domain knowledge can be collected, for example, through statistics or experience.

[0071] User transaction behavior knowledge may include but is not limited to some personal characteristics of the user that are related to the transaction behavior. Supplementary knowledge may include but is not limited to information collected through active communication with the user, and can serve as a supplement to the above user transaction behavior knowledge.

[0072] After the data is collected, while the data is still being collected, the construction of the user knowledge graph in box 402 may include data combing in subbox 402-2.

[0073] Data combing may include combing the collected data. According to exemplary embodiments, combing may include, for example, classifying, arranging, associating, etc. the data to organize it into knowledge. For example, according to some exemplary embodiments, each piece of knowledge may be represented as a SPO triple (Subject-Predicate-Object), where the relationship between the subject (Subject) and the object (Object) is expressed by the predicate (Predicate).

[0074] After the data is combed, the user knowledge graph construction of block 402 may include constructing the user knowledge graph based on the combed data in sub-block 402-3. According to an exemplary embodiment, the subject and object in each piece of knowledge may be used as nodes in the knowledge graph, and the predicate in each piece of knowledge may be used as a directed edge between the node representing the subject and the node as the object.

[0075] For a single user, the user knowledge graph may be expanded outward with the user node as the center. According to an exemplary embodiment, the knowledge graph may include one or more users, and nodes associated with different users may have relationships and be represented by directed edges.

[0076] The method 400 may further include modeling the user knowledge graph at block 404. The goal of modeling the user knowledge graph may include making classification predictions for an entire constructed user knowledge graph.

[0077] Modeling the user knowledge graph in block 404 may include mapping the constructed user knowledge graph into a spatial domain-based graph convolutional network in subblock 404-1. According to an exemplary embodiment, since each user's knowledge graph is not determined to consist of several nodes, a spatial domain-based graph convolutional network such as GAT or GraphSAGE may be used to make full use of all nodes around the user.

[0078] Modeling the user knowledge graph in block 404 may further include training the model of the user knowledge graph in sub-block 404-2. The training may include using the existing labeled data as the ground truth of the model, and training the model of the user's knowledge graph on this basis to train the weights of the edges between nodes (also known as "attention"). To some extent, the weight of each edge after training reflects the corresponding relationship (that is, the importance of the neighbor node to the user node).

[0079] Specifically, according to an exemplary embodiment, the attention coefficient of the directed edge can be obtained by calculating the similarity coefficient between the user node h1 and its neighbor nodes and itself (for example, based on the eigenvalues ​​or eigenvectors of the neighbor nodes and the user node itself), and then normalizing the result.

[0080] Subsequently, the eigenvalue or eigenvector of each neighbor node can be weightedly summed according to the calculated directed edge attention coefficient to obtain the new features of the user node output (i.e., the input to the next layer of neurons in the model).

[0081] Generally speaking, since one layer of neurons can complete the calculation of node relationships within one hop, when the user node in the exemplary user knowledge graph model includes more than one layer of neighbor nodes, the model needs to train corresponding multiple layers of neurons to complete the calculation of the relationship with all associated nodes. According to an exemplary embodiment, a suitable hop count threshold can be set.

[0082] In this way, the output of the last layer of neurons can be connected to the classifier, and it can be trained to determine whether the user node is abnormal based on the ground truth. For example, when the hop count threshold is 1 (i.e., only the neighboring nodes within one hop from the user node are considered), the new feature h'1 can be directly connected to the classifier to determine whether the user node is abnormal.

[0083] Modeling the user knowledge graph in box 404 may further include using the trained model in subbox 404-3 to classify the model of the user knowledge graph, that is, to determine whether the corresponding user node is abnormal.

[0084] This paper innovatively proposes a solution for user anomaly identification based on knowledge graph and graph convolution. By applying knowledge graph and graph convolution model to user anomaly identification, not only can all known information and newly surveyed information of users be utilized, but also the group characteristics of the user group can be fully utilized.

[0085] Since a complete user graph is introduced, the disclosed solution can make full use of the user's previous information and currently collected information when judging whether the user is abnormal, and more importantly, it can use the group characteristics of the user's category. By using the existing labeled data as the ground truth of the model and training the model on this basis, it is possible to predict whether the unlabeled user is abnormal.

[0086] Applying knowledge graphs to user anomaly recognition can not only utilize all known information about users and newly surveyed supplementary information, but also utilize the group characteristics of the user's group. The use of graph convolution models can ensure that the information of the user graph is fully utilized.

[0087] The above description is only an exemplary embodiment of the present invention. However, the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present invention should be included in the protection scope of the present invention.

[0088] The various illustrative logical blocks, modules, and circuits described in conjunction with the present disclosure may be implemented or executed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device (PLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any commercially available processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

[0089] The steps of the method or algorithm described in conjunction with the present disclosure may be implemented directly in hardware, in a software module executed by a processor, or in a combination of the two. The software module may reside in any form of storage medium known in the art. Some examples of usable storage media include random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, hard disks, removable disks, CD-ROMs, and the like. The software module may include a single instruction, or many instructions, and may be distributed over several different code segments, distributed between different programs, and distributed across multiple storage media. A storage medium may be coupled to a processor so that the processor can read and write information from / to the storage medium. Alternatively, a storage medium may be integrated into a processor.

[0090] The methods disclosed herein include one or more steps or actions for achieving the described methods. These method steps and / or actions may be interchangeable with each other without departing from the scope of the claims. In other words, unless a specific order of steps or actions is specified, the order and / or use of specific steps and / or actions may be changed without departing from the scope of the claims.

[0091] The processor can execute software stored on a machine-readable medium. The processor can be implemented with one or more general and / or special processors. Examples include microprocessors, microcontrollers, DSP processors, and other circuit systems that can execute software. Software should be broadly interpreted as meaning instructions, data, or any combination thereof, whether it is called software, firmware, middleware, microcode, hardware description language, or other. As an example, a machine-readable medium may include RAM (random access memory), flash memory, ROM (read-only memory), PROM (programmable read-only memory), EPROM (erasable programmable read-only memory), EEPROM (electrically erasable programmable read-only memory), registers, disks, optical disks, hard drives, or any other suitable storage media, or any combination thereof. The machine-readable medium may be implemented in a computer program product. The computer program product may include packaging materials.

[0092] In a hardware implementation, the machine-readable medium may be a part of a processing system that is separate from the processor. However, as will be readily appreciated by those skilled in the art, the machine-readable medium or any part thereof may be external to the processing system. As an example, the machine-readable medium may include a transmission line, a carrier modulated by data, and / or a computer product separate from the wireless node, all of which may be accessed by the processor via a bus interface. Alternatively or in addition, the machine-readable medium or any part thereof may be integrated into the processor, such as a cache and / or a general register file may be the case.

[0093] The processing system can be configured as a general processing system having one or more microprocessors providing processor functionality and external memory providing at least a portion of the machine-readable medium, all linked together with other supporting circuitry via an external bus architecture. Alternatively, the processing system can be implemented with an ASIC (Application Specific Integrated Circuit) with a processor, bus interface, user interface (in the case of an access terminal), supporting circuitry, and at least a portion of the machine-readable medium integrated in a single chip, or with one or more FPGAs (field programmable gate arrays), PLDs (programmable logic devices), controllers, state machines, gating logic, discrete hardware components, or any other suitable circuitry, or any combination of circuits capable of performing the various functionalities described throughout this disclosure. Depending on the specific application and the overall design constraints imposed on the overall system, those skilled in the art will recognize how to implement the functionality described with respect to the processing system.

[0094] The machine-readable medium may include several software modules. These software modules include instructions that cause a processing system to perform various functions when executed by a device (such as a processor). These software modules may include a transmission module and a reception module. Each software module may reside in a single storage device or be distributed across multiple storage devices. As an example, when a triggering event occurs, a software module may be loaded into a RAM from a hard drive. During the execution of the software module, the processor may load some instructions into a cache to increase access speed. One or more cache lines may then be loaded into a general register file for execution by the processor. When the functionality of a software module is described below, it will be understood that such functionality is implemented by the processor when the processor executes instructions from the software module.

[0095] If implemented in software, each function can be stored on or transmitted by one or more instructions or codes on a computer-readable medium. Computer-readable media include both computer storage media and communication media, and these media include any media that facilitate the transfer of a computer program from one place to another. Storage media can be any available media that can be accessed by a computer. As an example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage devices, or any other media that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer. Any connection is also properly referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology (such as infrared (IR), radio, and microwave), the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, radio, and microwave) is included in the definition of the medium. As used herein, disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk, and blue-ray disc, wherein disk often reproduces data magnetically, and disc reproduces data optically with laser. Therefore, in some aspects, computer-readable medium may include non-transient computer-readable medium (e.g., tangible medium). In addition, for other aspects, computer-readable medium may include transient computer-readable medium (e.g., signal). The above combination should also be included in the scope of computer-readable medium.

[0096] Thus, some aspects may include a computer program product for performing the operations presented herein. For example, such a computer program product may include a computer-readable medium having stored (and / or encoded) thereon instructions that can be executed by one or more processors to perform the operations described herein. In some aspects, a computer program product may include packaging materials.

[0097] It will be understood that the claims are not limited to the precise configuration and components illustrated above. Various changes, substitutions and variations may be made in the arrangement, operation and details of the methods and apparatus described above without departing from the scope of the claims.

Claims

1. A method for abnormality identification, comprising: Collect information about users; Organizing the user's information into knowledge, wherein the knowledge includes the relationship between the user and the information, or between the information and the information, wherein the information includes the domain information of the group to which the user belongs, and the domain information of the group to which the user belongs includes transaction characteristics of the industry or occupation category to which the user belongs; Building a knowledge graph based on the organized knowledge, the knowledge graph including a user node corresponding to the user and an information node for each item of information, and including edges corresponding to corresponding relationships; Modeling the knowledge graph using a spatial domain-based graph convolutional network to obtain a model; as well as The model is trained to determine whether the user is abnormal based on graph convolution calculation of the knowledge graph.

2. The method of claim 1, wherein: The knowledge consists of subject, predicate and object SPO triples.

3. The method of claim 2, wherein: The knowledge graph includes knowledge with the user as the subject and information as the object, or knowledge with information as the subject and further information related to the information as the object.

4. The method of claim 3, wherein: The knowledge with the user as the subject and the information as the object corresponds to the neighbor nodes with a one-hop distance from the node corresponding to the user in the model, and the knowledge with the information as the subject and further information related to the information as the object corresponds to the nodes with a distance greater than one-hop from the node corresponding to the user in the model.

5. The method of claim 1, wherein: Training the model includes using annotated users as ground truth of the model to train the model so that the weights of the edges in the knowledge graph after training reflect the importance of the corresponding relationship in the anomaly identification.

6. The method of claim 1, wherein: The information also includes known individual information of the user.

7. The method of claim 6, wherein: The known individual information of the user includes the personal transaction behavior characteristics of the user.

8. The method of claim 6, wherein: The information also includes newly obtained supplementary information of the user.

9. The method of claim 1, wherein: Each node in the knowledge graph carries its own eigenvalue or eigenvector, wherein the graph convolution calculation of the knowledge graph is based on the eigenvalues ​​or eigenvectors of the user nodes and the information node subset.

10. The method of claim 9, wherein: The subset of information nodes is determined based on a hop count threshold.

11. A device for abnormality identification, comprising: Devices used to collect information about users; A device for organizing the user's information into knowledge, wherein the knowledge includes the relationship between the user and the information, or between the information and the information, wherein the information includes the domain information of the group to which the user belongs, and the domain information of the group to which the user belongs includes transaction characteristics of the industry or occupation category to which the user belongs; Means for constructing a knowledge graph based on the organized knowledge, the knowledge graph comprising a user node corresponding to the user and an information node for each item of information, and comprising edges corresponding to corresponding relationships; A device for modeling the knowledge graph using a spatial domain-based graph convolutional network to obtain a model; as well as A device for training the model to determine whether the user is abnormal based on graph convolution calculation of the knowledge graph.

12. The device of claim 11, wherein: The knowledge consists of subject, predicate and object SPO triples.

13. The apparatus of claim 12, wherein: The knowledge graph includes knowledge with the user as the subject and information as the object, or knowledge with information as the subject and further information related to the information as the object.

14. The device of claim 13, wherein: The knowledge with the user as the subject and the information as the object corresponds to the neighbor nodes with a one-hop distance from the node corresponding to the user in the model, and the knowledge with the information as the subject and further information related to the information as the object corresponds to the nodes with a distance greater than one-hop from the node corresponding to the user in the model.

15. The apparatus of claim 11, wherein: Training the model includes using annotated users as ground truth of the model to train the model so that the weights of the edges in the knowledge graph after training reflect the importance of the corresponding relationship in the anomaly identification.

16. The apparatus of claim 11, wherein: The information also includes known individual information of the user.

17. The apparatus of claim 16, wherein: The known individual information of the user includes the personal transaction behavior characteristics of the user.

18. The apparatus of claim 16, wherein: The information also includes newly obtained supplementary information of the user.

19. The apparatus of claim 11, wherein: Each node in the knowledge graph carries its own eigenvalue or eigenvector, wherein the graph convolution calculation of the knowledge graph is based on the eigenvalues ​​or eigenvectors of the user nodes and the information node subset.

20. The apparatus of claim 19, wherein: The subset of information nodes is determined based on a hop count threshold.

21. A device for abnormality identification, comprising: Memory; as well as a processor coupled to the memory and configured to: Collect information about users; Organizing the user's information into knowledge, wherein the knowledge includes the relationship between the user and the information, or between the information and the information, wherein the information includes the domain information of the group to which the user belongs, and the domain information of the group to which the user belongs includes transaction characteristics of the industry or occupation category to which the user belongs; Building a knowledge graph based on the organized knowledge, the knowledge graph including a user node corresponding to the user and an information node for each item of information, and including edges corresponding to corresponding relationships; Modeling the knowledge graph using a spatial domain-based graph convolutional network to obtain a model; as well as The model is trained to determine whether the user is abnormal based on graph convolution calculation of the knowledge graph.

22. A computer-readable storage medium having processor-executable instructions stored thereon, wherein the processor-executable instructions, when executed by a processor, are used to cause the processor to perform an abnormality identification operation, wherein the abnormality identification operation comprises: Collect information about users; Organizing the user's information into knowledge, wherein the knowledge includes the relationship between the user and the information, or between the information and the information, wherein the information includes the domain information of the group to which the user belongs, and the domain information of the group to which the user belongs includes transaction characteristics of the industry or occupation category to which the user belongs; Building a knowledge graph based on the organized knowledge, the knowledge graph including a user node corresponding to the user and an information node for each item of information, and including edges corresponding to corresponding relationships; Modeling the knowledge graph using a spatial domain-based graph convolutional network to obtain a model; as well as The model is trained to determine whether the user is abnormal based on graph convolution calculation of the knowledge graph.

Images