A method and device for updating graph data

Abstract

The present invention provides a method and device for updating graph data. The method comprises: determining whether there is data to be stored in a data collection queue; determining a target template in a preset template list according to a first region ID; extracting knowledge from the data to be stored using the target template to obtain graph data to be stored; writing the graph data to be stored into a graph database, and updating a knowledge graph using the written graph data. The present invention can update a graph database and a knowledge graph in real time, improve data processing efficiency, and at the same time improve the accuracy of identifying fraudulent behavior.

Description

Technical Field

[0001] The present invention relates to the field of knowledge graph technology, and in particular to a method and device for updating graph data. Background Art

[0002] Knowledge graph is an emerging technology that combines artificial intelligence and big data. It has been widely used in search engines, intelligent question and answer, language understanding, recommendation computing, big data decision analysis and other fields. In the financial field, when identifying and preventing gang fraud, relationship network marketing and loan monitoring and early warning, knowledge graphs are used to calculate graph feature increment variables from the complex relationship network data reflected by the knowledge graph, referred to as graph features, that is, customer feature data calculated by graph algorithms or statistical models based on the network (graph) formed by customer relationship, for example: Graph feature 1: Count the number of people who applied for the same device with different ID numbers within 30 days, Graph feature 2: Count the number of people who applied for the same device with different ID numbers in the past day when the first contact's mobile phone number is the same, Graph feature 3: Count the number of people in the blacklist of the current applicant in the two-dimensional node, Graph feature 4: Count the number of wifi blacklists in the two-dimensional node associated with the current applicant. Using the calculation results of graph features, it is possible to judge the relationship characteristics between customers, so as to timely discover fraudulent behaviors such as customer false applications, gang fraud, and intermediary packaging applications.

[0003] At present, when the financial field uses knowledge graphs to discover fraudulent behaviors such as false customer applications, group fraud, and intermediary packaging applications, the existing technology needs to convert the data to be written into node list data and relationship list data within a specified time when writing the data to be written into the database, and then write the node list data and relationship list data into the database respectively. The graph update processing steps are complicated and the data processing speed is slow. The data to be written cannot be written into the database in time, so that the relationship network in the knowledge graph cannot be updated in time, and further the problem of failure to timely discover fraudulent behaviors such as false customer applications, group fraud, and intermediary packaging applications. Summary of the invention

[0004] In view of this, the present invention provides a method and device for updating graph data, which can update the graph database and knowledge graph in real time, improve data processing efficiency, and at the same time improve the accuracy of identifying fraudulent behavior.

[0005] In order to achieve the above object, the present invention mainly provides the following technical solutions:

[0006] In a first aspect, the present invention provides a method for updating graph data, the method comprising:

[0007] Determine whether there is data to be stored in the data collection queue;

[0008] If so, determining the target template in the preset template list according to the first area ID, wherein the first area ID is used to distinguish the storage area storing the data to be stored in the data acquisition queue;

[0009] Using the target template to perform knowledge extraction on the data to be stored to obtain graph data to be stored;

[0010] The graph data to be stored is written into the graph database, and the knowledge graph is updated using the written graph data.

[0011] In a second aspect, the present invention provides a device for updating graph data, the device comprising:

[0012] A monitoring module, used to determine whether there is data to be stored in the data collection queue;

[0013] A determination module, configured to determine a target template in a preset template list according to the first area ID;

[0014] An extraction module, used for performing knowledge extraction on the data to be stored using the target template to obtain graph data to be stored;

[0015] A writing module is used to write the graph data to be stored into the graph database and update the knowledge graph using the written graph data.

[0016] By means of the above technical scheme, the present invention provides a method and device for updating graph data, by judging whether there is data to be stored in the data collection queue, it can accurately judge whether the data needs to be processed, and when it is judged that there is data to be stored in the data collection queue, by using the first area ID to select the corresponding target template, the data to be stored is converted into graph data to be stored with a fixed format, which can effectively improve the data processing efficiency, and can process the data to be stored in real time, and further improve the accuracy of identifying fraudulent behavior. At the same time, in an embodiment of the present invention, by judging whether there is data to be stored in the data collection queue, the data to be stored can be processed in real time, and the graph database can be updated in real time, and the knowledge graph can be updated at the same time, effectively avoiding the need to convert the data to be written into node list data and relationship list data within a specified time in the prior art, and then write the node list data and relationship list data into the database respectively, the graph update processing steps are complicated, the data processing speed is slow, the data to be written cannot be written into the database in time, so that the relationship network in the knowledge graph cannot be updated in time, and further the problem of not being able to timely discover fraudulent behaviors such as false customer applications, gang fraud, and intermediary packaging applications.

[0017] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A schematic diagram of a flow chart of a method for updating graph data disclosed in the present invention;

[0020] Figure 2 A flowchart of a method for determining a first area ID disclosed in the present invention;

[0021] Figure 3 A schematic flow chart of a method for updating a graph database disclosed in the present invention;

[0022] Figure 4 A schematic diagram of a calibration method disclosed in the present invention;

[0023] Figure 5 A schematic diagram of a flow chart of a graph feature calculation method disclosed in the present invention;

[0024] Figure 6 A schematic flow chart of a method for determining features of a graph to be calculated disclosed in the present invention;

[0025] Figure 7 A schematic diagram of a flow chart of a graph feature early warning method disclosed in the present invention;

[0026] Figure 8 A schematic diagram of a graph data updating device disclosed in the present invention;

[0027] Fig. 9 This is a schematic diagram of another graph data updating device disclosed in the present invention. DETAILED DESCRIPTION

[0028] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0029] At present, when the financial field uses knowledge graphs to discover fraudulent behaviors such as false customer applications, group fraud, and intermediary packaging applications, the existing technology needs to convert the data to be written into node list data and relationship list data within a specified time when writing the data to be written into the database, and then write the node list data and relationship list data into the database respectively. The graph update processing steps are complicated and the data processing speed is slow. The data to be written cannot be written into the database in time, so that the relationship network in the knowledge graph cannot be updated in time, and further the problem of failure to timely discover fraudulent behaviors such as false customer applications, group fraud, and intermediary packaging applications.

[0030] In order to solve the above problems, an embodiment of the present invention provides a method for updating graph data. Figure 1 As shown, the method includes:

[0031] Step 101, determining whether there is data to be stored in the data acquisition queue.

[0032] Specifically, in the steps of the embodiment of the present invention, the data acquisition queue is monitored in real time, wherein the data acquisition queue is used to receive data to be written, and temporarily store the data to be written in a storage area in the data acquisition queue. When the data to be stored is stored in the storage area of ​​the data acquisition queue, it is determined that there is data to be stored in the data acquisition queue, and further processing is required for the data to be stored. By real-time monitoring of the data acquisition queue, the data to be stored can be processed in real time, thereby improving data processing efficiency.

[0033] Step 102: Determine a target template in a preset template list according to the first area ID.

[0034] The first area ID is used to distinguish a storage area in the data acquisition queue that stores the data to be stored.

[0035] Specifically, after executing step 101, when it is determined in step 101 that there is data to be stored in the data acquisition queue, the storage area of ​​the data to be stored in the data acquisition queue is obtained, and the first area ID of the storage area is obtained according to the storage area of ​​the data to be stored in the data acquisition queue, and the first area ID is used to select the target template corresponding to the first area ID in the preset template list. In this embodiment, the preset template list is pre-configured and used to extract knowledge from data to be stored in different data formats, and multiple target templates are pre-stored in the preset template list. Each target template can extract knowledge from data to be stored in a unique data format, and each target template corresponds to a first area ID. When it is determined that there is data to be stored in the data acquisition queue, the first area ID is obtained according to the storage area of ​​the data to be stored in the data acquisition queue, and the target template corresponding to the first area ID is determined in the preset template list according to the first area ID.

[0036] Step 103: Use the target template to perform knowledge extraction on the data to be stored to obtain graph data to be stored.

[0037] Specifically, after executing step 103, after determining the target template according to the first area ID, the target template is used to perform knowledge extraction on the data to be stored to obtain graph data to be stored with a fixed structure. Preferably, the graph data to be stored in the present invention is triple data. Specifically, in this embodiment, the target template is used to extract data related to the triple data from the data to be stored to form triple data in an inherent fixed data format.

[0038] Step 104: write the graph data to be stored into the graph database, and use the written graph data to update the knowledge graph.

[0039] Specifically, after executing step 103, after obtaining the graph data to be stored using the target template, the standardized triple data is converted into a script that can be written into the graph database, and the triple data is written into the graph database using the script to obtain the graph data, and when the writing is completed, the written graph data is used to update the knowledge graph. Specifically, in the embodiment of the present invention, the graph database is preferably neo4j or ongdb.

[0040] In step 105, there is no need to update the graph database.

[0041] Specifically, after executing step 101, when it is determined that there is no data to be stored in the data acquisition queue, there is no need to update the graph.

[0042] Specifically, by judging whether there is data to be stored in the data collection queue, it is possible to accurately judge whether the data needs to be processed, and when judging whether the data to be stored is stored in the data collection queue, by using the first area ID to select the corresponding target template, the data to be stored is converted into graph data to be stored with a fixed format, which can effectively improve the data processing efficiency, and the data to be stored can be processed in real time, and the accuracy of identifying fraudulent behavior is further improved. At the same time, in an embodiment of the present invention, by judging whether there is data to be stored in the data collection queue, the data to be stored can be processed in real time, and the graph database can be updated in real time, and the knowledge graph can be updated at the same time, effectively avoiding the need to convert the data to be written into node list data and relationship list data within a specified time in the prior art, and then write the node list data and relationship list data into the database respectively, the graph update processing steps are complicated, the data processing speed is slow, the data to be written cannot be written into the database in time, so that the relationship network in the knowledge graph cannot be updated in time, and further the problem of not being able to timely discover fraudulent behaviors such as false customer applications, gang fraud, and intermediary packaging applications.

[0043] Furthermore, an embodiment of the present invention also provides a method for determining a first area ID. Figure 1 The specific introduction before "determining whether there is data to be stored in the data acquisition queue" in step 101 of the embodiment shown in the figure is as follows: Figure 2 As shown, the method also includes:

[0044] Step 201, obtaining the data format of the data to be written received in the data acquisition queue.

[0045] Specifically, before executing step 101, after the data collection queue receives the data to be written, the data format of each data to be written is obtained in sequence. Specifically, since the data collection queue is connected to multiple business clients, the format of the data to be written collected by each business client is different. When the data collection queue receives the data to be written sent by different business clients, the data format of each data to be written is obtained in sequence. In the embodiment of the present invention, for example, the received data to be written is credit application data, and the data format of the credit application data is: basic information, guarantee information, co-borrowing information, communication information, address information, and equipment information.

[0046] Step 202: Match the data format of the data to be written with the data formats stored in different storage areas in the data acquisition queue.

[0047] Specifically, after executing step 202, after obtaining the data format of the data to be written, the data format of the data to be written is matched with the data formats stored in different storage areas in the data acquisition queue. When the data format stored in the storage area of ​​the data acquisition queue is the same as the data format of the data to be written, it is determined that the match is successful. When the data format stored in the storage area of ​​the data acquisition queue is different from the data format of the data to be written, it is determined that the match fails. Specifically, in the embodiment of the present invention, the data acquisition queue has multiple storage areas, each of which can store data in a data format. After the data acquisition queue receives the data to be written, the data format of each data to be written is matched with the data format stored in different storage areas in the data acquisition queue. For example, the data format to be written is: basic information, guarantee information, co-borrowing information, communication information, address information, and device information. Then, the data format of the data is matched with the data format stored in different storage areas in the data acquisition queue. When the data format of the data is the same as the data format stored in any storage area in the data acquisition queue, it is determined that the match is successful. When the data format of the data is different from the data format stored in all storage areas in the data acquisition queue, it is determined that the match fails.

[0048] Step 203, when the match is successful, the data to be written is stored in a designated storage area in the data acquisition queue according to the matching result, and the data to be stored and the first area ID are obtained.

[0049] Specifically, after executing step 202, when it is determined in step 202 that the data format matches successfully, the data to be written is stored in the designated storage area of ​​the data acquisition queue, wherein the designated storage area is a storage area in which the data format of the data to be written is the same as the data format stored in the storage area in the data acquisition queue, and the first area ID of the storage area is obtained. Specifically, in the embodiment of the present invention, each storage area in the data acquisition queue has a unique first area ID, which is used to mark the storage area of ​​the data acquisition queue, and the first area ID can also identify the data format stored in the storage area. For example, there are 4 storage areas in the data acquisition queue, namely the first storage area, the second storage area, the third storage area and the fourth storage area, and the first area ID of each storage area is 11, 12, 13 and 14 respectively. When the data format of the data to be written successfully matches the third storage area in the data acquisition queue, the data to be written is written to the third storage area of ​​the data acquisition queue to obtain the data to be stored, and the first area ID of the data to be stored is 13, wherein the first area ID can also be selected in other ways, as long as it can distinguish different storage areas.

[0050] Step 204: when the matching fails, the corresponding data to be written is deleted.

[0051] Specifically, after executing step 202, when it is determined in step 202 that the data format match fails, it is determined that the data format of the data to be written that fails to match cannot be stored, and thus the data to be written cannot be written into the graph database, so the data to be written with a failed matching result is deleted.

[0052] Specifically, the present invention can accurately determine whether to process the data to be written by acquiring the data format of the data to be written and matching the data format of the data to be written with the data format stored in the storage area of ​​the data acquisition queue. When the match is successful, the data to be written can be processed in real time by storing the data to be written in the designated storage area in the data acquisition queue, thereby improving the data processing efficiency. At the same time, by determining the first area ID of the data to be stored, the target template can be accurately determined, and the knowledge extraction method for the data to be stored can be accurately selected through the first area ID, so that the data can be accurately processed. While improving the data processing efficiency, the knowledge graph can be updated in a timely manner, thereby improving the accuracy of identifying fraudulent behavior.

[0053] Furthermore, an embodiment of the present invention also provides a method for updating a graph database. Figure 1 The specific introduction before "writing the graph data to be stored into the graph database and updating the knowledge graph using the written graph data" in step 104 of the embodiment shown in the figure is as follows: Figure 3 As shown, the method also includes:

[0054] Step 301: convert the format of the first identification identifier of the graph data to be stored into the format of the second identification identifier in the graph database, and determine whether the first identification identifier of the graph data to be stored is the same as the second identification identifier.

[0055] The first identification mark is used to identify different graph data to be stored, the second identification mark is formed according to the first identification mark, and the format of the second identification mark is different from that of the first identification mark.

[0056] Specifically, before executing step 104, the format of the first identification identifier of the graph data to be stored is first converted into the format of the second identification identifier, and the format of the first identification identifier is unified with the format of the second identification identifier. After the conversion is completed, it is determined whether the data information marked by the first identification identifier is the same as the data information marked by the second identification identifier. When the data information marked by the first identification identifier and the second identification identifier are the same, it is determined that the graph data to be stored has been stored in the graph database. When the data information marked by the first identification identifier and the second identification identifier are different, it is determined that the graph data to be stored has not been written into the graph database. Specifically, in an embodiment of the present invention, when the graph data to be stored is obtained using the target template, the graph data to be stored is marked with the first identification identifier, for example, the graph data to be stored is marked with a name, and when the graph data to be stored with the first identification identifier is written to the graph database, the first identification identifier is expressed using a query statement of the graph database, for example, the second identification identifier is expressed using a cypher statement. Specifically, before the new graph data to be stored is written into the graph database, the format of the first identification identifier of the new graph data to be stored is converted into the format of the second identification identifier, and the first identification identifier is compared with all the second identification identifiers in the graph database to determine whether the first identification identifier is the same as the second identification identifier. For example, the first identification identifier of the new graph data to be stored is Zhang San, and the first identification identifier Zhang San is expressed using a cypher statement, and then the first identification identifier is compared with the second identification identifier to determine whether the first identification identifier and the second identification identifier are the same. When Zhang San also exists in the second identification identifier, it is determined that the data information marked by the first identification identifier and the second identification identifier are the same. When Zhang San does not exist in the second identification identifier, it is determined that the data information marked by the first identification identifier and the second identification identifier are different.

[0057] Step 302: Use the to-be-stored graph data corresponding to the first identification information to update the graph data corresponding to the second identification information.

[0058] Specifically, after executing step 301, when it is determined in step 301 that the data information marked by the first identification identifier and the second identification identifier are the same, it is determined that the graph data to be stored has been written into the graph database. In this case, there is no need to write all the information of the graph data to be stored into the graph database. Instead, only the information that is different between the graph data to be stored and the data already stored in the graph database needs to be written into the graph database, thereby updating the graph data in the graph database.

[0059] Step 303: write the graph data to be stored into the graph database, and use the written graph data to update the knowledge graph.

[0060] Specifically, after executing step 302, when it is determined in step 302 that the first identification information is different from the information marked by the second identification identification, it is determined that the graph data to be stored is equivalent to the data in the graph database and is new data. Therefore, all data information of the graph data to be stored needs to be written into the graph database to obtain the graph data, and the knowledge graph is updated based on the obtained graph data.

[0061] Specifically, the embodiment of the present invention can accurately determine how to write the graph data to be stored into the graph database by converting the format of the first identification identifier of the graph data to be stored into the second identification identifier format of the graph data, and by comparing the first identification identifier with the second identification identifier. When the information marked by the first identification identifier and the second identification identifier of the graph data to be stored are the same, the graph data in the library is updated using the graph data to be stored. By comparing the first identification identifier with the second identification identifier, the corresponding operation is selected according to different comparison results, thereby saving the time of writing the graph data to be stored into the graph database, thereby improving data processing efficiency.

[0062] Furthermore, the present invention also provides a verification method. Figure 3 In the embodiment shown, the specific description before step 301 of "converting the format of the first identification identifier of the graph data to be stored into the format of the second identification identifier in the graph database, and determining whether the first identification identifier of the graph data to be stored is the same as the second identification identifier" is as follows: Figure 4 As shown, the method also includes:

[0063] Step 401: Use preset verification rules to determine whether there is any missing data in the graph data to be stored.

[0064] Specifically, before performing step 301, after the graph data to be stored is obtained by using the target template, the graph data to be stored is verified using pre-configured verification rules. Specifically, the data information in the graph data to be stored is verified. For example, when the graph data to be stored includes information such as an ID card number or a mobile phone number, the number of digits of the ID card number or the mobile phone number is verified. When the graph data to be stored includes address information, the province, city, district and other contents included in the address information are verified. When the verification result is that there is no missing data information, it is determined that there is no missing data in the graph data to be stored. When the verification result is that there is missing data, it is determined that there is missing data in the graph data to be stored.

[0065] Step 402: obtaining a second identification mark of the graph data in the graph database.

[0066] Specifically, after executing step 401, when it is determined that there is no data missing in the data information of the graph data to be stored, it is determined that the graph data to be stored needs to be written into the graph database, and the second identification identifier in the graph database is obtained to determine the writing method of the graph data to be stored.

[0067] Step 403: sending the first identification mark of the graph data to be stored to the early warning notification queue.

[0068] Specifically, after step 401, when it is determined that there is data missing in the data information of the graph data to be stored, it is determined that the graph data to be stored has triggered the preset warning rule, and at the same time, the first identification identifier of the graph data to be stored that has triggered the preset warning rule is sent to the warning notification queue, and the warning notification queue sends the warning information to the business client corresponding to the graph data to be stored.

[0069] Specifically, the present invention pre-configures verification rules to accurately verify each graph data to be stored, thereby ensuring that all data information that needs to be written into the graph data to be stored is complete, thereby ensuring the accuracy of the updated knowledge graph and, at the same time, improving the accuracy of identifying fraudulent behavior using the knowledge graph.

[0070] Furthermore, an embodiment of the present invention also provides a method for calculating graph features. Figure 1 The specific description after step 104 of the embodiment shown in the figure, "writing the graph data to be stored into the graph database, and updating the knowledge graph using the written graph data", the specific steps are Figure 5 As shown, the method also includes:

[0071] Step 501: store the first identification mark of the graph data to be stored in the storage area in the computing task queue according to the corresponding relationship between the first area ID and the second area ID.

[0072] The second area ID is used to distinguish the storage area storing the first identification mark in the computing task queue.

[0073] Specifically, after executing step 104, after the graph data is written into the graph database, the first identification mark of the graph data to be stored is sent to the computing task queue for storage, wherein there are multiple storage areas in the computing task queue, and the second area ID is used to distinguish each storage area of ​​the computing task queue. Preferably, the number of storage areas of the computing task queue is the same as the number of storage areas of the data acquisition queue. The data in the storage area of ​​the computing task queue can also be selected according to the type of graph actually processed, such as personal graph or enterprise graph. Specifically, when only personal graph and enterprise graph are processed, the number of storage areas of the computing task queue is the same as the number of storage areas of the data acquisition queue, and the first identification mark stored in the first storage area of ​​the data acquisition queue will be stored in the first storage area of ​​the computing task queue. For example, the first identification mark of the graph data to be stored is stored in the third storage area of ​​the data acquisition queue. After the graph data to be stored is written into the graph database, the first identification mark is stored in the third storage area of ​​the computing task queue.

[0074] Step 502: Determine a calculation mode of the first identification mark according to the second area ID.

[0075] Specifically, after executing step 501, after storing the first identification mark in the designated storage area of ​​the computing task queue, according to the pre-configured computing mode, a computing mode is pre-configured for each second area ID of the computing task queue, wherein the computing mode includes a real-time computing mode and a timing computing mode. For example, there are four storage areas in the computing task queue, namely, the first storage area, the second storage area, the third storage area and the fourth storage area. The second area ID of each storage area is 21, 22, 23 and 24. At the same time, a computing mode is pre-configured for each storage area, for example, the first storage area is real-time computing, the second storage area is timing computing, the third storage area is real-time computing, and the fourth storage area is timing computing. Specifically, after obtaining the second area ID, the computing mode of the first identification mark can be determined according to the second area ID, thereby accurately computing graph features.

[0076] Step 503: When it is detected that the calculation mode is the preset calculation mode, the required-calculation graph feature corresponding to the second region ID is determined in the preset graph feature calculation list.

[0077] The preset graph feature list is used to store graph features and query calculation statements of graph features.

[0078] Specifically, after executing step 502, after determining the calculation mode of the first identification identifier, when the calculation mode of the first identification identifier is the real-time calculation mode, the calculation mode of the first identification identifier is determined as the preset calculation mode. At the same time, when the calculation mode of the first identification identifier is the preset calculation mode, the graph feature corresponding to the second area ID is loaded into the preset graph feature calculation list to obtain the graph feature to be calculated, and at the same time, the query calculation statement corresponding to the graph feature to be calculated is obtained.

[0079] Step 504, using the updated knowledge graph, execute the query calculation statement corresponding to the graph feature to be calculated in the graph database to obtain the feature value of the graph feature to be calculated.

[0080] Specifically, after executing step 503, after obtaining the query calculation statement of the feature to be calculated, the relationship between customers displayed in the knowledge graph is used to execute the query calculation statement of the graph feature to be calculated in the graph database, and the relationship statistics of the graph features to be calculated are performed to obtain the statistical results, that is, the feature values ​​of the graph features to be calculated.

[0081] Step 505: store the first identification identifier, the graph feature to be calculated, and the feature value of the graph feature to be calculated in an ElasticSearch database, wherein the ElasticSearch database is also used to query the feature value of the graph feature to be calculated according to the first identification identifier.

[0082] Specifically, after executing step 504, when all the feature values ​​of the graph features to be calculated corresponding to the second region ID are calculated, the first identification identifier, the graph features to be calculated, and the feature values ​​of the graph features to be calculated are bound and stored in the ElasticSearch database. At the same time, when it is necessary to query the graph features corresponding to the first identification identifier, the ElasticSearch database can be queried.

[0083] Specifically, after the present invention uses graph data to update the knowledge graph, it calculates graph features of the written graph data. At the same time, it matches different graph features to be calculated according to different second area IDs. At the same time, according to the calculation mode of each graph feature, it performs diversion calculation on the graph features, and gives priority to calculating the graph features of the real-time calculation mode, thereby improving the calculation efficiency of the graph features, and further improving the accuracy of detecting fraudulent behaviors such as false customer applications, gang fraud, and intermediary packaging applications.

[0084] Furthermore, an embodiment of the present invention also provides a method for determining the features of a graph to be calculated. Figure 5 The specific introduction of "determining the required graph feature to be calculated corresponding to the second region ID in the preset graph feature calculation list" in step 503 of the embodiment shown in the figure is as follows Figure 6As shown, including:

[0085] Step 601: Using a preset configuration rule, extract the graph feature corresponding to the second region ID from the preset graph feature list to obtain a first graph feature list.

[0086] Specifically, in this embodiment, all graph features are stored in the preset graph feature calculation list. Specifically, the graph features in the preset graph feature list are pre-configured, and each configured graph feature has a unique calculation mode. At the same time, one or more graph features are bound to the second area ID, that is, each second area ID corresponds to one or more graph features. After determining the second area ID of the first identification identifier, the graph features bound to the second area ID are extracted from the preset graph feature calculation list, and the first graph feature list is constructed based on the extracted graph features.

[0087] Step 602: extract graph features whose calculation mode is a preset calculation mode from the first graph feature list to obtain a second graph feature list.

[0088] Specifically, after executing step 601, after obtaining the graph features corresponding to the second area ID, the calculation mode of each graph feature is determined respectively, and in the first graph feature list, the graph feature calculation mode is extracted as the real-time calculation mode, and a second graph feature list is constructed based on the graph features as the real-time calculation mode.

[0089] Step 603: Obtain the graph features whose feature status of extracted graph features is enabled in the second graph feature list to obtain a third graph feature list.

[0090] Specifically, after executing step 602, the status of the graph features in the second graph feature list is judged, and the graph features with a feature status of "disabled" are eliminated in the second graph feature list, and the graph features with a feature status of "enabled" are retained, and when the elimination is completed, a third graph feature list is obtained.

[0091] Step 604: Determine the graph features in the third graph feature list as the graph features to be calculated.

[0092] Specifically, after executing step 604, the graph features in the third graph feature list are determined as the graph features to be calculated. Specifically, for example, the graph features stored in the third graph feature list are: Graph feature 1: Counting the number of people who have applied for the same device with different ID numbers within 30 days, Graph feature 2: Counting the number of people who have applied with different ID numbers in the past day when the mobile phone number of the first contact is the same, then graph features 1 and 2 are determined as the graph features to be calculated.

[0093] Furthermore, the embodiment of the present invention also provides a graph feature early warning method, which is to Figure 5The specific introduction of "storing the first identification mark, the graph feature to be calculated, and the feature value of the graph feature to be calculated in the ElasticSearch database" in step 505 of the embodiment shown in the figure is as follows: Figure 7 As shown, the method also includes:

[0094] Step 701: using a preset warning rule, determine whether the feature value of the graph feature to be calculated is greater than or equal to a threshold.

[0095] Specifically, when executing step 505, that is, when the calculation of the graph feature to be calculated is completed, the pre-configured warning rule is obtained, and it is judged whether the characteristic value of each graph feature is greater than or equal to the threshold, wherein the threshold of each graph feature to be calculated is unique. For example, the threshold corresponding to graph feature 1 is 5, and the characteristic value of graph feature 1 is compared with 5 to determine whether the characteristic value of graph feature 1 is greater than or equal to 5. When the characteristic value of graph feature 1 is greater than or equal to 5, it is determined that graph feature 1 triggers the preset warning rule. When the characteristic value of graph feature 1 is less than 5, it is determined that the characteristic value of graph feature 1 does not trigger the preset warning rule. It is known to those skilled in the art that when issuing a warning, the judgment condition can also be changed according to the actual situation. For example, it can be determined that the warning rule is triggered when it is less than the threshold, not equal to the threshold, equal to the threshold, or greater than or equal to the threshold.

[0096] Step 702: simultaneously sending the first identification identifier to the early warning notification queue.

[0097] Specifically, after executing step 701, when step 701 determines that the graph feature to be calculated triggers the warning rule, while the characteristic value of the feature to be calculated is written into the ElasticSearch database, the first identification identifier corresponding to the graph feature to be calculated that triggers the warning rule is synchronously sent to the warning notification queue to warn the corresponding business client. At the same time, after the feature to be calculated triggers the warning rule, the ElasticSearch database will update the status of the warning identifier of the first identification information that triggers the warning rule to "yes", wherein the warning identifier is used to prompt that the first identification identifier has triggered the warning rule when the user uses the ElasticSearch database to query the characteristic value of the graph feature of the first identification identifier.

[0098] Step 703: storing the first identification mark, the graph feature to be calculated, and the feature value of the graph feature to be calculated in an ElasticSearch database.

[0099] Specifically, this step is the same as step 505 and will not be described in detail here.

[0100] Specifically, by using preset early warning rules to judge the characteristic values ​​of graph features, the knowledge graph can be used to accurately judge fraudulent behaviors such as false applications, group fraud, and intermediary packaged applications. By using the real-time updated knowledge graph and real-time calculation of graph features, the efficiency of identifying fraudulent behaviors can be improved, and at the same time, the accuracy of detecting fraudulent behaviors such as customer false applications, group fraud, and intermediary packaged applications can be improved.

[0101] Furthermore, as mentioned above Figure 1-7 The implementation of the method embodiment shown in the figure, the embodiment of the present invention provides a graph data updating device, which can update the graph database and knowledge graph in real time, improve the data processing efficiency, and at the same time improve the accuracy of identifying fraudulent behavior. The embodiment of the device corresponds to the aforementioned method embodiment. For the sake of ease of reading, this embodiment will no longer repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment, specifically as follows Figure 8 As shown, the device comprises:

[0102] A monitoring module 10 is used to determine whether there is data to be stored in the data collection queue;

[0103] The determination module 20 is used to determine a target template in a preset template list according to the first area ID when the monitoring module 10 determines that there is data to be stored.

[0104] The extraction module 30 is used to determine the target template determined by the module 20, and use the target template to perform knowledge extraction on the data to be stored to obtain the graph data to be stored.

[0105] The writing module 40 is used to write the graph data to be stored into the graph database according to the graph data to be stored obtained by the extraction module 30, and update the knowledge graph using the written graph data.

[0106] Further, such as Fig. 9 As shown, the graph data updating device further includes a storage module 50, and the storage module 50 includes:

[0107] The format unit 510 is used to obtain the data format of the data to be written received in the data acquisition queue.

[0108] The matching unit 520 is used to match the data format of the data to be written with the data formats stored in different storage areas in the data acquisition queue according to the data format of the data to be written determined by the format unit 510.

[0109] The storage unit 530 is used for storing the data to be written into the designated storage area in the data acquisition queue according to the matching result when the matching unit 520 is successfully matched, so as to obtain the data to be stored and the first area ID.

[0110] Further, such as Fig. 9 As shown, the graph updating device further includes a selection module 60, and the selection module 60 includes:

[0111] The identification judgment unit 610 is used to convert the format of the first identification identifier of the graph data to be stored into the format of the second identification identifier in the graph database, and to judge whether the first identification identifier of the graph data to be stored is the same as the second identification identifier.

[0112] The updating unit 620 is used to update the graph data corresponding to the second identification identifier information using the to-be-stored graph data corresponding to the first identification identifier when the judging unit 610 judges that the first identification identifier is the same as the second identification identifier.

[0113] The writing unit 630 is used to determine in the judgment unit 610 that the first identification identifier is different from the second identification identifier, write the graph data to be stored into the graph database, and use the written graph data to update the knowledge graph.

[0114] Further, such as Fig. 9 As shown, the map updating device further includes a verification module 70, and the verification module 70 includes:

[0115] The missing judgment unit 710 is used to judge whether there is any missing data in the graph data to be stored by using a preset verification rule.

[0116] The identification acquisition unit 720 is used to obtain a second identification identifier of the graph data in the graph database when the missing judgment unit 710 determines that there is no data missing.

[0117] The identification sending unit 730 is used to send the first identification identifier of the to-be-stored graph data to the early warning notification queue when the missing judgment unit 710 judges that there is data missing.

[0118] Further, such as Fig. 9 As shown, the graph updating device further includes a graph feature calculation module 80, and the graph feature calculation module 80 includes:

[0119] The computing storage unit 810 is used to store the first identification mark of the to-be-stored graph data into the storage area in the computing task queue according to the correspondence between the first area ID and the second area ID.

[0120] The calculation mode determination unit 820 is used to determine the calculation mode of the first identification mark according to the second area ID determined by the calculation storage unit 810.

[0121] The graph feature determination unit 830 is used to determine the graph feature to be calculated corresponding to the second area ID in the preset graph feature calculation list when it is detected that the calculation mode determined by the calculation mode determination unit 820 is the preset calculation mode.

[0122] The graph feature calculation unit 840 is used to use the updated knowledge graph to execute the query calculation statement corresponding to the graph feature to be calculated determined by the graph feature determination unit 830 in the graph database to obtain the feature value of the graph feature to be calculated.

[0123] The graph feature storage unit 850 is used to store the first identification identifier stored in the calculation storage unit 810, the graph features to be calculated determined by the graph feature determination unit 830, and the feature values ​​of the graph features to be calculated calculated by the graph feature calculation unit 840 into the ElasticSearch database.

[0124] Further, such as Fig. 9 As shown, the graph feature calculation unit 840 is also used to use preset configuration rules to extract the graph features corresponding to the second area ID in the preset graph feature list to obtain a first graph feature list; extract the graph features whose calculation mode is the preset calculation mode in the first graph feature list to obtain a second graph feature list; obtain the graph features whose feature state of the extracted graph features is enabled in the second graph feature list to obtain a third graph feature list; and determine the graph features in the third graph feature list as the graph features to be calculated.

[0125] Further, such as Fig. 9 As shown, the map updating device further includes an early warning module 90, and the early warning module 90 includes:

[0126] The threshold judgment unit 910 is used to judge whether the feature value of the graph feature to be calculated is greater than or equal to the threshold by using a preset warning rule.

[0127] The early warning sending unit 920 is used to simultaneously send the first identification identifier to the early warning notification queue.

[0128] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0129] It is understandable that the related features in the above methods and devices can be referenced to each other. In addition, the "first", "second" and the like in the above embodiments are used to distinguish the embodiments, but do not represent the advantages and disadvantages of the embodiments.

[0130] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be described one by one here.

[0131] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0132] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0133] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0134] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0135] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0136] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0137] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0138] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0139] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0140] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0141] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0142] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for updating graph data, characterized in that: The method comprises: Determine whether there is data to be stored in the data collection queue; If so, determining the target template in the preset template list according to the first area ID, wherein the first area ID is used to distinguish the storage area storing the data to be stored in the data acquisition queue; Using the target template to perform knowledge extraction on the data to be stored to obtain graph data to be stored, wherein the target template can perform knowledge extraction on the data to be stored in a single data format; Writing the graph data to be stored into the graph database, and updating the knowledge graph using the written graph data; According to the correspondence between the first region ID and the second region ID, the first identification mark of the graph data to be stored is stored in a storage area in the computing task queue, wherein the second region ID is used to distinguish the storage area in the computing task queue where the first identification mark is stored; Determining a calculation mode of the first identification mark according to the second area ID; When it is detected that the calculation mode is a preset calculation mode, the graph feature to be calculated corresponding to the second area ID is determined in a preset graph feature calculation list, wherein the preset graph feature calculation list is used to store graph features and query calculation statements of graph features.

2. The method according to claim 1, characterized in that Before determining whether there is data to be stored in the data acquisition queue, the method further includes: Acquire the data format of the data to be written received in the data acquisition queue; Matching the data format of the data to be written with the data formats stored in different storage areas in the data acquisition queue; When the match is successful, the data to be written is stored in a designated storage area in the data acquisition queue according to the matching result, and the data to be stored and the first area ID are obtained.

3. The method according to claim 1, characterized in that Before writing the graph data to be stored into the graph database and updating the knowledge graph using the written graph data, the method further includes: Convert the format of the first identification identifier of the graph data to be stored into the format of the second identification identifier in the graph database, and determine whether the data information marked by the first identification identifier of the graph data to be stored is the same as that marked by the second identification identifier, wherein the first identification identifier is used to identify different graph data to be stored, the second identification identifier is formed according to the first identification identifier, and the format of the second identification identifier is different from that of the first identification identifier; If they are the same, the graph data to be stored corresponding to the first identification identifier is used to update the graph data corresponding to the second identification identifier; If they are not the same, the graph data to be stored is written into the graph database, and the knowledge graph is updated using the written graph data.

4. The method according to claim 3, characterized in that Before converting the format of the first identification identifier of the graph data to be stored into the format of the second identification identifier in the graph database and determining whether the first identification identifier of the graph data to be stored is the same as the second identification identifier, the method further includes: Using a preset verification rule, determining whether the graph data to be stored has data missing; If not present, obtaining a second identification mark of the graph data in the graph database; If so, the first identification identifier of the graph data to be stored is sent to the early warning notification queue.

5. The method according to claim 1, characterized in that The method further comprises: Using the updated knowledge graph, executing the query calculation statement corresponding to the graph feature to be calculated in the graph database to obtain the feature value of the graph feature to be calculated; The first identification identifier, the graph feature to be calculated, and the feature value of the graph feature to be calculated are stored in an ElasticSearch database, wherein the ElasticSearch database is also used to query the feature value of the graph feature to be calculated according to the first identification identifier.

6. The method according to claim 1, characterized in that The determining the required graph feature corresponding to the second region ID in the preset graph feature calculation list includes: Using a preset configuration rule, extracting a graph feature corresponding to the second region ID from the preset graph feature calculation list to obtain a first graph feature list; Extracting graph features whose calculation mode is a preset calculation mode from the first graph feature list to obtain a second graph feature list; Acquire graph features whose feature status of extracted graph features is enabled in the second graph feature list to obtain a third graph feature list; The graph features in the third graph feature list are determined as the graph features to be calculated.

7. The method according to claim 5, characterized in that When storing the first identification mark, the graph feature to be calculated, and the feature value of the graph feature to be calculated in the ElasticSearch database, the method further includes: Using the preset warning rules, determine whether the characteristic value of the graph feature to be calculated is greater than or equal to the threshold; If yes, the first identification identifier is simultaneously sent to the early warning notification queue; If not, the first identification mark, the graph feature to be calculated, and the feature value of the graph feature to be calculated are stored in the ElasticSearch database.

8. A graph data updating device, characterized in that: The device comprises: A monitoring module, used to determine whether there is data to be stored in the data collection queue; A determination module, configured to determine a target template in a preset template list according to the first area ID; An extraction module, used for performing knowledge extraction on the data to be stored using the target template to obtain graph data to be stored, wherein the target template can perform knowledge extraction on the data to be stored in a single data format; A writing module, used to write the graph data to be stored into the graph database, and update the knowledge graph using the written graph data; A computing storage unit, used for storing the first identification mark of the graph data to be stored in a storage area in the computing task queue according to the corresponding relationship between the first area ID and the second area ID, wherein the second area ID is used to distinguish the storage area in the computing task queue where the first identification mark is stored; a calculation mode determination unit, configured to determine a calculation mode of the first identification mark according to the second area ID; A graph feature determination unit is used to determine the graph feature to be calculated corresponding to the second area ID in a preset graph feature calculation list when it is detected that the calculation mode is a preset calculation mode, wherein the preset graph feature calculation list is used to store graph features and query calculation statements of graph features.

9. A terminal, characterized in that: The terminal is used to run a program, wherein the terminal executes the method for updating graph data described in any one of claims 1 to 7 when running.

10. A storage medium, characterized in that: The storage medium is used to store a computer program, wherein when the computer program is running, it controls the device where the storage medium is located to execute the method for updating graph data described in any one of claims 1-7.

Images