A data processing method, a computer device and a readable storage medium

Abstract

The application discloses a data processing method and device, computer equipment and a readable storage medium, the method comprises: obtaining target business attribute data corresponding to a business request, taking the target business attribute data and the associated business attribute data of the associated users in the user social group as attribute nodes, and respectively constructing an attribute isomorphic graph and an attribute heterogeneous graph; the attribute isomorphic graph is processed through community discovery by a risk control detection model, and the attribute label for the business request is obtained; the attribute isomorphic graph and the attribute heterogeneous graph are respectively sampled by the risk control detection model, and the graph correlation feature vector of the attribute node corresponding to the target business attribute data is generated according to the attribute node sequence sampled; the risk prediction result of the target is obtained by the risk prediction processing of the attribute label, the graph correlation feature vector and the behavior characteristics corresponding to the target business attribute data through the risk control detection model. The detection accuracy of the cheating traffic can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, a computer device, and a readable storage medium. Background Art

[0002] In the traffic risk control industry, fraudulent traffic is rampant in multiple industries such as advertising, retail, e-commerce, and travel. For example, false exposure clicks, false installation and activation, false registration and login, etc., will cause tens of billions of business expenses losses every year.

[0003] Existing technologies typically rely on manual experience to identify fraudulent traffic from massive amounts of business data. They then identify and analyze the source of the fraudulent traffic, labeling the malicious resources and methods that generate it. This allows for rapid identification of traffic generated by these labeled malicious resources or methods. However, the resources and methods used by black market operators to generate fraudulent traffic are numerous, and these methods are constantly evolving to combat traffic risk control. Manual labeling is inefficient and cannot keep pace with the evolving nature of black market operators, resulting in insufficient detection coverage for fraudulent traffic. This makes it easier for fraudulent traffic to circumvent risk control, reduces detection accuracy, and causes losses to the business. Summary of the Invention

[0004] The embodiments of the present application provide a data processing method, a computer device, and a readable storage medium, which can improve the detection coverage and detection accuracy of fraudulent traffic.

[0005] An embodiment of the present application provides a data processing method, including:

[0006] Obtain the business request initiated by the target user, and use the decision engine to obtain the risk control detection model associated with the business request from the model library in the model deployment platform;

[0007] Obtain the target business attribute data corresponding to the business request, obtain the user social group of the target user, and use the target business attribute data and the associated business attribute data of the associated users in the user social group as attribute nodes to construct an attribute isomorphic graph and an attribute heterogeneous graph respectively;

[0008] The risk control detection model performs community discovery on the attribute isomorphism graph to obtain attribute labels for business requests.

[0009] The risk control detection model samples node sequences of attribute homogeneous graphs and attribute heterogeneous graphs respectively. Based on the sampled attribute node sequences, the graph association feature vectors of the attribute nodes corresponding to the target business attribute data are generated.

[0010] The risk control detection model performs risk prediction processing on the attribute labels, graph-related feature vectors, and behavioral characteristics corresponding to the target business attribute data to obtain the target risk prediction results;

[0011] The decision engine performs anti-fraud processing on business requests in association with target risk prediction results.

[0012] In one aspect, an embodiment of the present application provides a data processing device, including:

[0013] The acquisition module is used to obtain the business request initiated by the target user and obtain the risk control detection model associated with the business request from the model library in the model deployment platform through the decision engine;

[0014] The acquisition module is also used to obtain the target business attribute data corresponding to the business request and obtain the user social group of the target user;

[0015] A graph construction module is used to construct an attribute isomorphic graph and an attribute heterogeneous graph respectively using the target business attribute data and the associated business attribute data of associated users in the user social group as attribute nodes;

[0016] The label determination module is used to perform community discovery processing on the attribute isomorphism graph through the risk control detection model to obtain attribute labels for business requests;

[0017] The graph vector determination module is used to sample node sequences of attribute isomorphic graphs and attribute heterogeneous graphs respectively through the risk control detection model, and generate graph association feature vectors of attribute nodes corresponding to target business attribute data based on the sampled attribute node sequences;

[0018] The risk determination module is used to perform risk prediction processing on the attribute labels, graph-related feature vectors, and behavioral characteristics corresponding to the target business attribute data through the risk control detection model to obtain the target risk prediction result;

[0019] The anti-fraud module is used to perform anti-fraud processing on business requests in association with target risk prediction results through the decision engine.

[0020] Among them, the graph construction module includes:

[0021] A node determination unit is configured to use target business attribute data and associated business attribute data of associated users in the user social group as attribute nodes; the number of attribute nodes is at least two;

[0022] An isomorphic graph construction unit, configured to obtain attribute nodes with the same attribute type from at least two attribute nodes as isomorphic attribute nodes;

[0023] An isomorphic graph construction unit, configured to determine a first edge weight between isomorphic attribute nodes based on common information between the isomorphic attribute nodes;

[0024] An isomorphic graph construction unit, configured to construct an attribute isomorphic graph according to isomorphic attribute nodes and first edge weights;

[0025] The heterogeneous graph construction unit is used to construct an attribute heterogeneous graph containing at least two attribute nodes according to the connection relationship between two attribute nodes in the at least two attribute nodes.

[0026] The label determination module includes:

[0027] The community division unit is used to divide the attribute nodes in the attribute isomorphism graph according to the modularity of the attribute isomorphism graph in the risk control detection model to obtain the attribute node community;

[0028] a label selection unit, configured to determine the attribute node community to which the attribute node corresponding to the target business attribute data belongs, as the target attribute node community;

[0029] The label selection unit is further configured to use the community attribute label of the target attribute node community as the attribute label for the service request.

[0030] Among them, the community division units include:

[0031] Initial subunits are used to divide attribute nodes in the attribute isomorphism graph into initial attribute node communities in the risk control detection model;

[0032] Transfer subunit, used to transfer attribute nodes T in the attribute isomorphism graph i Transfer to the initial attribute node community where the neighbor attribute node is located, and obtain the transferred attribute node community; the neighbor node and the attribute node T in the attribute isomorphic graph i have a connection relationship; i is a positive integer less than or equal to the total number of attribute nodes in the attribute isomorphism graph;

[0033] The transfer subunit is further used to determine a modularity change value based on the initial attribute node community and the transferred attribute node community;

[0034] A reconstruction subunit, configured to use the transferred attribute node community as a reconstructed attribute node to obtain a reconstructed attribute isomorphism graph if the modularity change value satisfies a community aggregation condition;

[0035] The iterator unit is further configured to use the transferred attribute node community as the attribute node community if the community structures of the reconstructed attribute isomorphism graph and the attribute isomorphism graph are the same;

[0036] The iterator unit is further configured to continue transferring the reconstructed attribute nodes in the reconstructed attribute isomorphism graph if the community structures of the reconstructed attribute isomorphism graph and the attribute isomorphism graph are different.

[0037] The graph vector determination module includes:

[0038] The isomorphic vector determination unit is used to perform a random walk on the attribute isomorphic graph through the risk control detection model, sample the attribute nodes on the random walk path, and obtain an isomorphic attribute node sequence;

[0039] The isomorphic vector determining unit is further configured to generate an isomorphic graph feature vector of the attribute node corresponding to the target business attribute data based on the isomorphic attribute node sequence;

[0040] A heterogeneous vector determination unit is used to perform a random walk on the attribute heterogeneous graph through a risk control detection model, sample attribute nodes on the random walk path, and obtain a heterogeneous attribute node sequence;

[0041] The heterogeneous vector determination unit is further configured to generate a heterogeneous graph feature vector of the attribute node corresponding to the target business attribute data according to the heterogeneous attribute node sequence;

[0042] The splicing unit is used to splice the homogeneous graph feature vector and the heterogeneous graph feature vector to obtain the graph-related feature vector of the attribute node corresponding to the target business attribute data.

[0043] Among them, the target risk prediction result includes the target risk value and the target risk type label;

[0044] Risk determination module, including:

[0045] A feature concatenation unit is used to concatenate the attribute labels, the graph-related feature vectors, and the behavioral features corresponding to the target business attribute data to obtain a target feature vector;

[0046] A result determination unit is used to input the target feature vector into the classification layer of the risk prediction model, and determine the risk probability of the target feature vector under each candidate risk type label of at least two candidate risk type labels through the classification layer;

[0047] The result determination unit is also used to generate a target risk value for the business request based on the risk probability corresponding to each candidate risk type label, and determine the candidate risk type label corresponding to the maximum risk probability as the target risk type label among the risk probabilities corresponding to each candidate risk type label.

[0048] Among them, the anti-cheating module includes:

[0049] A strategy acquisition unit, configured to acquire, through the decision engine, an anti-fraud risk control strategy that is mapped to a risk tag;

[0050] The anti-fraud unit is used to obtain the risk control threshold corresponding to the target risk type label based on the anti-fraud risk control strategy;

[0051] The anti-fraud unit is also used to reject the business request if the target risk value is greater than or equal to the risk control threshold;

[0052] The anti-cheating unit is also used to respond to the business request if the target risk value is less than the risk control threshold.

[0053] The data processing device further includes:

[0054] A feature determination module is used to obtain a historical business request sequence associated with target business attribute data through a risk control detection model;

[0055] The feature determination module is also used to generate request behavior statistical information corresponding to the target business attribute data based on the historical business attribute data of the historical business requests in the historical business request sequence and the historical time period in which the historical business requests are located; and generate behavioral features corresponding to the target business attribute data based on the request behavior statistical information.

[0056] The data processing device further includes:

[0057] The model generation module is used to obtain the risk control model file to be deployed through the model deployment platform;

[0058] The model generation module is also used to identify the model file format of the risk control model file, parse the risk control model file based on the model file format, and obtain the risk control detection model corresponding to the risk control model file;

[0059] The version configuration module is used to respond to version management operations initiated for the risk control detection model in the model deployment platform and assign model version information to the risk control detection model;

[0060] The test quality determination module is used to respond to the deployment and online operation initiated for the risk control detection model, test the risk control detection model, and obtain the test service quality;

[0061] Add a module to add the risk control detection model and model version information to the model library in the model deployment platform if the test service quality meets the model online conditions.

[0062] Among them, the test quality determination module includes:

[0063] The offline data acquisition unit is used to obtain offline sample attribute data through the model deployment platform; the offline sample attribute data is added with risk control tags; the risk control tags are used to characterize the risk of the offline sample attribute data;

[0064] The offline prediction unit is used to perform offline prediction processing on the risk control detection model service based on offline sample data to obtain offline prediction results;

[0065] The offline prediction unit is also used to evaluate the test service quality of the risk control detection model service based on the error results between the offline prediction results and the risk control labels.

[0066] The data processing device further includes:

[0067] The traffic configuration module is used to respond to traffic configuration operations for the risk control detection model through the model deployment platform and determine the target user group associated with the risk control detection model; the target user group includes the target users; the risk control detection model is used to respond to business requests initiated by the target user group;

[0068] A policy configuration module is used to generate a risk control policy for a target user group in response to a risk control policy configuration operation for the target user group through the decision engine; the risk control policy includes a processing type field and an anti-fraud processing policy associated with the processing type field;

[0069] The policy configuration module is further used to map at least two risk prediction results of the risk control detection model to the processing type field;

[0070] Then, the anti-cheating module includes:

[0071] A target field determination unit is used to determine, through a decision engine, a processing type field that has a mapping relationship with a target risk prediction result as a target processing type field;

[0072] The policy processing unit is used to perform anti-cheating processing on the service request according to the anti-cheating processing policy associated with the target processing type field.

[0073] The data processing device further includes:

[0074] The result recording module is used to record the predicted risk prediction results obtained by the risk control detection model in response to the business requests initiated by the target user group into the model execution log corresponding to the risk control detection model;

[0075] The monitoring module is used to monitor the risk status of the target user group and determine the real risk label of the target user group based on the risk status;

[0076] Adjust the prompt module to generate risk control strategy quality for the risk control detection model based on the error between the actual risk label and the predicted risk prediction results in the model execution log;

[0077] The adjustment prompt module is also used to generate a strategy adjustment prompt for the risk control detection model when the risk control strategy quality does not meet the risk control conditions; the strategy adjustment prompt is used to prompt the adjustment of the anti-fraud processing strategy associated with the risk control detection model.

[0078] In one aspect, an embodiment of the present application provides a computer device, including: a processor and a memory;

[0079] The processor is connected to a memory, wherein the memory is used to store a computer program. When the computer program is executed by the processor, the computer device executes the method provided in the embodiment of the present application.

[0080] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. The computer program is suitable for being loaded and executed by a processor so that a computer device having the processor executes the method provided by the embodiment of the present application.

[0081] In one aspect, embodiments of the present application provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method provided in the embodiments of the present application.

[0082] In an embodiment of the present application, after obtaining a business request initiated by a target user, a risk control detection model associated with the business request can be obtained from a model library in a model deployment platform through a decision engine, and then the target business attribute data corresponding to the business request and the user social group of the target user are obtained. The target business attribute data and the associated business attribute data of the associated users in the user social group are used as attribute nodes to construct an attribute isomorphism graph and an attribute heterogeneity graph respectively. The attribute isomorphism graph is then processed by the risk control detection model for community discovery to obtain attribute labels for the business request. The attribute isomorphism graph and the attribute heterogeneity graph are sampled for node sequences through the risk control detection model respectively, and a graph association feature vector of the attribute node corresponding to the target business attribute data is generated based on the attribute node sequence obtained by sampling. Finally, the attribute label, the graph association feature vector and the behavioral characteristics corresponding to the target business attribute data are subjected to risk prediction processing through the risk control detection model to obtain a target risk prediction result. The business request is subjected to anti-cheating processing associated with the target risk prediction result through the decision engine. The embodiment of the present application can automatically extract attribute labels, graph-related feature vectors and behavioral features used to characterize different dimensional features of business requests, and perform risk prediction processing on business requests based on these multiple dimensional features to obtain target risk prediction results. It can be seen that the embodiment of the present application can mine dimensional features that are difficult to discover through manual experience, thereby improving the accuracy of the target risk prediction results, and then performing anti-cheating processing on business requests based on the target risk prediction results, thereby improving the detection coverage and detection accuracy of cheating traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0084] Figure 1a This is a schematic diagram of a network architecture provided by an embodiment of the present application;

[0085] Figure 1b This is a schematic diagram of a risk warning scenario provided by an embodiment of the present application;

[0086] Figure 2 This is a flow chart of a data processing method provided in an embodiment of the present application;

[0087] Figure 3a This is a schematic diagram of the structure of an attribute isomorphism graph provided in an embodiment of the present application;

[0088] Figure 3bThis is a schematic diagram of the structure of an attribute heterogeneous graph provided in an embodiment of the present application;

[0089] Figure 4 This is a flow chart of a risk control detection method provided in an embodiment of the present application;

[0090] Figure 5 This is a schematic diagram of a community discovery process provided by an embodiment of the present application;

[0091] Figure 6 This is a schematic diagram of a scenario for implementing isomorphic graph node embedding provided by an embodiment of the present application;

[0092] Figure 7 This is a schematic diagram of the relationship between a decision engine and a model deployment platform provided in an embodiment of the present application;

[0093] Figure 8 This is a schematic diagram of the architecture of a model deployment platform provided in an embodiment of the present application;

[0094] Figure 9 is a structural diagram of a data processing device provided in an embodiment of the present application;

[0095] Figure 10 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0096] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0097] It should be noted that the terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or that are inherent to these processes, methods, products, or devices. The data processing method of the present application is described below. This specification provides method operation steps such as the embodiments or flow charts, but more or fewer operation steps may be included based on conventional or non-creative work. The order of steps listed in the embodiments is only one way of executing the steps and does not represent the only order of execution. When the system or server product is executed in practice, it can be executed in the order of the methods shown in the embodiments or the accompanying drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment).

[0098] Artificial intelligence (AI) refers to the theories, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive field within computer science that seeks to understand the essence of intelligence and produce new intelligent machines that can respond in a manner similar to human intelligence. AI also studies the design principles and implementation methods of various intelligent machines, enabling them to possess the capabilities of perception, reasoning, and decision-making. AI technology is an interdisciplinary discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0099] Natural language processing (NLP) is a key area of ​​research in computer science and artificial intelligence. It studies the theories and methods that enable effective communication between humans and computers using natural language. Natural language processing (NLP) integrates linguistics, computer science, and mathematics. Therefore, research in this field involves natural language—the language we use in everyday life—and is closely linked to the study of linguistics. Natural language processing technologies typically include text processing, semantic understanding, machine translation, robotic question answering, and knowledge graphs.

[0100] Machine learning (ML) is a multidisciplinary field that encompasses probability theory, statistics, approximation theory, convex analysis, and algorithmic complexity theory. It specifically studies how computers can simulate or implement human learning behaviors to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is at the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications span all areas of AI. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning.

[0101] The solutions provided in the embodiments of this application involve artificial intelligence natural language processing technology and machine learning technology, which are specifically described through the following embodiments. Figure 1a , Figure 1a This is a network architecture diagram provided by an embodiment of the present application. Figure 1a As shown, the system may include a business server 100 and a terminal device cluster, and the terminal device cluster may include terminal device 10a, terminal device 10b, ..., terminal device 10n, wherein there may be a communication connection between the terminal device clusters, for example, there is a communication connection between terminal device 10a and terminal device 10b, and there is a communication connection between terminal device 10b and terminal device 10n, and any terminal device in the terminal device cluster may have a communication connection with the business server 100, for example, there is a communication connection between terminal device 10a and business server 100, and there is a communication connection between terminal device 10b and business server 100.

[0102] It should be understood that Figure 1a Each terminal device in the terminal cluster shown can be installed with an application client. When the application client runs in each terminal device, it can be respectively connected to the above Figure 1aThe business servers 100 shown in the figure interact with each other so that the business server 100 can receive business data from each terminal device. Among them, the application client can be a game application, video editing application, social application, instant messaging application, live broadcast application, short video application, video application, music application, shopping application, novel application, payment application, browser, etc., which has the function of displaying text, images, audio, video and other data information. Among them, the application client can be an independent client or an embedded sub-client integrated in a client (such as an instant messaging client, a social client, a video client, etc.), which is not limited here.

[0103] After receiving a service request from each terminal device through the application client, the business server 100 should respond to the service request, execute the service method corresponding to the service request, and return the execution result to the application client. However, in order to gain profits, black market personnel often use false traffic or malicious inflating to initiate malicious service requests. This not only occupies network resources and computing and memory resources of the business server 100, but also causes errors in the service data corresponding to the application client and makes it no longer authentic. In a feasible embodiment, taking a shopping application as an example, the praise rate of a product is one of the factors that users consider when purchasing the product. In order to increase the purchase rate of a product, some sellers will inflate the praise rate of the product. For example, they may initiate multiple business requests for the same product through the same account, initiate business requests for the same product through fake accounts, etc. The business server 100 does not identify the authenticity of the business requests, responds to these malicious business requests and executes them, ultimately making the praise rate of the product much higher than the actual praise rate given by the user. In a feasible embodiment, taking video applications as an example, the number of views of a TV series is one of the indicators for measuring the popularity of the TV series. Therefore, in order to increase the number of views of the TV series, some drama producers will adopt improper playback methods, such as simulating fake terminal devices through simulators, multiple clones, cloud control, etc., and then installing video applications, and initiating a business request to play the TV series to the business server 100. The business server 100 did not identify the authenticity of the business request, responded to these malicious business requests and executed them, ultimately making the number of views of the TV series far higher than the actual number of views.

[0104] In order to curb the cheating traffic caused by the above-mentioned malicious brushing, false traffic, etc., the service server 100 will obtain the target service attribute data corresponding to the service request after receiving the service request initiated by the target user, and then perform risk prediction on the service request based on the target service attribute data, identify whether the service request is a real service request, and then perform anti-cheating processing on the service request based on the risk prediction result. For the specific process, please refer to Figure 1b , Figure 1b This is a schematic diagram of a risk warning scenario provided by an embodiment of the present application. Figure 1b As shown, the terminal device 10b (can also be the above Figure 1a Any terminal device other than the terminal device 10b) is integrated with the shopping application 200, and user A has a binding relationship with the terminal device 10b. User A initiates a business request to the business server 100 through the shopping application 200 to comment on product B, attempting to give a five-star rating to product B. Assuming that the account used by user A to log in to the shopping application 200 is a fake account (such as a white account without real name, an account registered with a virtual operator's non-real-name card, etc.), if the business server 100 receives the business request, it directly responds to the business request and sends the review page to the terminal device 10b. User A can then use the fake account to complete a five-star rating for product B. Then, user A can log in to multiple fake accounts through the shopping application 200 of the terminal device 10b and give a five-star rating to product B, thereby causing other users who intend to purchase product B to obtain a false rating. The quality of product B may not match the rating, causing losses to other users. Therefore, the business server 100 needs to first perform risk prediction processing on the business request to determine whether the business request is a normal business request or an abnormal business request. If the business request is a normal business request, the business server 100 can respond to the business request and send the corresponding comment interface to the terminal device 10b, and the terminal device 10b will then display the comment interface; if the business request is an abnormal business request, the business server 100 will reject the business request, and can also give a corresponding risk prompt based on the risk prediction result and send it to the terminal device 10b.

[0105] Specifically, when the business server 100 obtains the business request initiated by user A, it will obtain the target business attribute data corresponding to the business request through the decision engine 300. Among them, the target business attribute data includes attribute data such as the requesting account, the requesting mobile phone number, the requesting IP (Internet Protocol), and the requesting device number. Then, the business server 100 will call the risk control detection model associated with the business request in the model library of the model deployment platform 400 through the decision engine 300, and then perform risk prediction processing on the business request based on the risk control detection model and the target business attribute data through the model deployment platform 400 to obtain the target risk prediction result, and then return the target risk prediction result to the decision engine 300. The decision engine 300 will then perform anti-cheating processing on the business request associated with the target risk prediction result. The specific process is as follows:

[0106] After the business server 100 obtains the target business attribute data corresponding to the business request through the decision engine 300, it transmits it to the risk control detection model associated with the business request in the model deployment platform 400. The business server 100 then uses the risk control detection model to obtain user A's user social group. Using the target business attribute data and the associated business attribute data of associated users in the user social group as attribute nodes, it constructs an attribute isomorphic graph and an attribute heterogeneous graph, respectively. The user social group includes multiple users associated with user A, each of whom has corresponding business attribute data such as a requesting account, a requesting mobile phone number, a requesting IP address, and a requesting device number. Both the attribute isomorphic graph and the attribute heterogeneous graph are composed of multiple attribute nodes and edges. The attribute nodes in the attribute isomorphic graph have the same attributes, and the edge weights are determined by the common information between the attribute nodes. For example, the attribute nodes in the attribute isomorphic graph can all be requesting accounts of different users. If the common information between requesting account 1 and requesting account 2 is that they share 2 IP addresses, then the edge weights of the attribute nodes corresponding to requesting account 1 and requesting account 2 are both 2. In an attribute heterogeneous graph, attribute nodes with different attributes can exist. If there is a connection between attribute nodes with different attributes, then there is a connecting edge between the attribute nodes. For example, if attribute node 3 corresponds to requesting account 1, and attribute node 4 corresponds to requesting device number 5, and requesting account 1 has logged in to requesting device number 5, then there is a connection between attribute node 3 and attribute node 4. The computer device then uses the risk control detection model to perform community discovery on the resulting homogeneous graph to obtain an attribute label for the service request. Community discovery involves partitioning the attribute nodes in the homogeneous graph, assigning closely connected attribute nodes to the same community. The attribute label is the community attribute label of the community in which the attribute node corresponding to the service attribute data of the service request resides. Attribute nodes belonging to the same community are closely connected and share a sense of community. For example, if attribute nodes 1 and 3 in community A are requesting accounts belonging to a black market operator, and the attribute node corresponding to the requesting account that initiated the service request also belongs to community A, then the requesting account may also be a requesting account owned by a black market operator. At the same time, the computer device will perform node embedding processing on the homogeneous graph and the heterogeneous graph through the risk control detection model, that is, sampling the node sequence of the homogeneous graph and the heterogeneous graph respectively, and generating the graph-related feature vector of the attribute node corresponding to the target business attribute data based on the attribute node sequence obtained by sampling. At the same time, the computer device will also generate the behavioral characteristics for the business request based on the target business attribute data through the risk control detection model. Among them, generating the graph-related feature vector corresponding to the target business attribute data based on the attribute node sequence can be achieved through some vector modeling algorithms, such as the node2vec (node ​​embedding) algorithm. Node embedding mainly vectorizes the graph and presents the graph through vectors.Among them, the graph-associated feature vector is used to describe the structural information and potential characteristics of homogeneous graphs and heterogeneous graphs, and can characterize the association relationship between target business attribute data and associated business attribute data under multiple attribute dimensions. Among them, the behavioral feature is generated based on the behavioral statistical information associated with a certain business attribute data in the target business attribute data within a certain historical time period. For example, the behavioral statistical information may include: how many requests have been initiated by the requesting account in the last ten minutes, how many devices have been logged into by the account in the last hour, and so on. Finally, the computer device will splice the attribute label, graph-associated feature vector and behavioral feature through the risk control detection model to obtain the target feature vector, and then perform risk prediction on the business request based on the target feature vector, and output the target risk prediction result, which is returned to the decision engine 300. The decision engine 300 can determine whether the business request is a normal business request or an abnormal business request based on the target risk prediction result.

[0107] like Figure 1b As shown, after the above processing, the business server 100 will determine through the decision engine 300 that the business request initiated by user A is an abnormal business request. The business server 100 will refuse to execute the business method associated with the business request and send an abnormal prompt to the terminal device 10b.

[0108] Optionally, the application client integrated and installed in each terminal device of the terminal device cluster may correspond to an application server. Then, when each terminal device initiates a service request to the corresponding application server through the application client, the service server may intercept the service request and perform risk prediction processing on the service request. If it is determined that the service request is a normal service request, the service request will be forwarded to the application server. If it is determined that the service request is an abnormal service request, the service request will be rejected.

[0109] It is understandable that the above processing process can be executed by the service server alone, by the terminal device alone, or by the service server and the terminal device together, and there is no limitation here.

[0110] It should be noted that the above data processing solution can be applied to various scenarios that require initiating business requests, such as games, videos, and instant messaging. The embodiments of this application only use video applications and shopping applications as examples for relevant explanations.

[0111] It is understandable that the method provided in the embodiment of the present application can be performed by a computer device, and the computer device includes but is not limited to a terminal device or a business server. Wherein, the business server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud databases, cloud services, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal device can be a smart phone, tablet computer, laptop computer, desktop computer, PDA, mobile internet device (mobile internet device, MID), wearable device (such as smart watch, smart bracelet, etc.), smart computer, etc., which can run the above-mentioned application client. Wherein, the terminal device and the business server can be directly or indirectly connected by wired or wireless means, and the embodiment of the present application is not limited here.

[0112] It is understandable that the above-mentioned devices (such as the above-mentioned business server 100, terminal device 200a, terminal device 200b, ..., terminal device 200n) can be a node in a distributed system, wherein the distributed system can be a blockchain system, and the blockchain system can be a distributed system formed by connecting the multiple nodes through network communication. Among them, a peer-to-peer (P2P) network can be formed between the nodes, and the P2P protocol is an application layer protocol running on the Transmission Control Protocol (TCP) protocol. In a distributed system, any form of computer device, such as a server, terminal device, or other electronic device, can become a node in the blockchain system by joining the peer-to-peer network.

[0113] Further, see Figure 2 , Figure 2 This is a flow chart of a data processing method provided by an embodiment of the present application. Figure 1a The computer device described in the embodiment can be executed Figure 1a The business server 100 in Figure 1a The terminal device cluster in (also includes terminal device 200a, terminal device 200b and terminal device 200n). Figure 2 As shown, the data processing method may include the following steps S101 to S106.

[0114] Step S101: Obtain a business request initiated by a target user, and obtain a risk control detection model associated with the business request from a model library in a model deployment platform through a decision engine.

[0115] Specifically, when black market operators generate fraudulent traffic, they can achieve this through a combination of various black market elements and resources on the market. For example, device resources have evolved from simulators, multiple clones, and device modification software to group control and cloud control. In 2020, cloud phone boxes appeared, claiming that one phone box is equivalent to over 600 mobile phones. IP resources have also shifted from traditional proxy IPs to instant dial IPs. Mobile phone numbers have also shifted from cat pools to public code receiving platforms. With the crackdown on code receiving platforms through national policies, this has gradually shifted to offline code receiving. In other words, service requests are not necessarily initiated by real users; they may also be generated by black market personnel or automated tools. Therefore, it should be noted that the target user can be understood as a fictitious user. That is, when a computer device receives a service request, it will assume that the service request was initiated by a fictitious user, and this fictitious user is bound to the service attribute data corresponding to the service request. Among them, the target service attribute data includes account number, mobile phone number, IP number, device number, etc. For ease of understanding, assume that black market operator A initiates service request A. The computer device receives service request A and determines that the service attribute data corresponding to service request A includes account number 1, mobile number 2, IP number 3, and device number 4. The computer device believes that service request A was initiated by imaginary user A. If the computer device receives another service request with service attribute data of account number 1, mobile number 2, IP number 3, and device number 4, the computer device believes that the service request was initiated by imaginary user A. If black market operator A changes his mobile number to mobile number 5 and then initiates service request B, the computer device receives service request B and determines that the service attribute data corresponding to service request B includes account number 1, mobile number 5, IP number 3, and device number 4. The computer device believes that service request A was initiated by imaginary user B. Therefore, it can be understood that each imaginary user is bound to a unique set of service attribute data.

[0116] Specifically, the decision engine can configure and execute risk strategies, and the model deployment platform can rapidly complete model deployment, testing, rollout, updates, and iteration. The model deployment platform's model library can contain multiple versions and types of risk control models for anti-fraud. The model deployment platform can allocate traffic to different versions and types of risk control models, specifically by determining the hypothetical user groups associated with each risk control model. For example, if the model deployment platform performs risk control for a target application with 10,000 accounts, it might associate 1,000 accounts with risk control model A and another 9,000 accounts with risk control model B. In this case, the hypothetical user in the hypothetical user group associated with risk control model A corresponds to an account in the target business attribute data, corresponding to one of the 1,000 accounts associated with risk control model A. Traffic allocation by the model deployment platform can also be based on business attribute data, such as account number, IP number, mobile phone number, or device number, either separately or jointly, without limitation. After the computer device obtains the business request initiated by the target user, it will obtain the risk control detection model associated with the business request from the model library in the model deployment platform through the decision engine, where the hypothetical user group associated with the risk control detection model includes the target user.

[0117] Step S102 : obtaining target business attribute data corresponding to the business request, obtaining the user social group of the target user, and constructing an attribute isomorphic graph and an attribute heterogeneous graph respectively using the target business attribute data and the associated business attribute data of associated users in the user social group as attribute nodes.

[0118] Specifically, as can be seen from the above, the target business attribute data is the business attribute information such as the account number, mobile phone number, IP number, device number, etc. corresponding to the business request initiated by the target user. The user social group of the target user contains associated users who have direct or indirect contact with the target user. Among them, the associated users are also virtual users like the target user, and each associated user corresponds to a set of associated business attribute data. If part of the data in the associated business attribute data corresponding to the first user is the same as part of the data in the target business attribute data, it is considered that the first user and the target user have a direct contact. For example, if the account of target user A is 1 and the account of user B is also 1, it is considered that target user A and user B have a direct contact; if the user who has a direct contact with the second user has a direct contact with the target user, it is considered that there is an indirect contact between the second user and the target user. For example, if target user A has a direct contact with user B and user B has a direct contact with user C, then target user A and user C have an indirect contact.

[0119] Specifically, the process of constructing an attribute isomorphic graph and an attribute heterogeneous graph respectively using the target business attribute data and the associated business attribute data of the associated users in the user social group as attribute nodes can be as follows: using the target business attribute data and the associated business attribute data of the associated users in the user social group as attribute nodes; the number of attribute nodes is at least two; among the at least two attribute nodes, attribute nodes with the same attribute type are obtained as isomorphic attribute nodes; based on the common information between the isomorphic attribute nodes, the first edge weight between the isomorphic attribute nodes is determined; based on the isomorphic attribute nodes and the first edge weight, an attribute isomorphic graph is constructed; based on the second edge weight between two attribute nodes with a connection relationship among the at least two attribute nodes, an attribute heterogeneous graph containing at least two attribute nodes is constructed.

[0120] To understand the attribute isomorphism graph, please refer to Figure 3a , Figure 3a This is a schematic diagram of the structure of an attribute isomorphic graph provided in an embodiment of the present application. Figure 3a As shown, the attribute isomorphic graph 30 includes multiple isomorphic attribute nodes such as isomorphic attribute node 301, isomorphic attribute node 302, and isomorphic attribute node 303. Assuming that the attribute isomorphic graph 30 is an account isomorphic graph, the isomorphic attribute nodes in the attribute isomorphic graph 30 can be the account data included in the target business attribute data and the associated business data. It can be understood that repeated account data can be counted as the same account data, and only one corresponding isomorphic attribute node is generated. Isomorphic attribute node 301 can be account 1, isomorphic attribute node 302 can be account 2, and isomorphic attribute node 303 can be account 3. Weighted edges can be connected between isomorphic attribute nodes, such as Figure 3a As shown, the edge weight between isomorphic attribute node 301 and isomorphic attribute node 302 is 1, the edge weight between isomorphic attribute node 301 and isomorphic attribute node 303 is 2, and there is no connection between isomorphic attribute node 302 and isomorphic attribute node 303, which can be understood as an edge weight of 0. The weight of the edge between isomorphic attribute nodes is determined by the common information between the isomorphic attribute nodes. For example, when the isomorphic attribute nodes are accounts, the common information can be the number of shared IPs. At this time, the edge weight between isomorphic attribute node 301 and isomorphic attribute node 302 is 1, indicating that the number of shared IPs between account 1 and account 2 is 1. The computer device can construct attribute isomorphism graphs corresponding to multiple different attribute types based on the target business attribute data and the associated business attribute data, taking into account the actual situation, and there is no limitation here.

[0121] To understand attribute heterogeneous graphs, please refer to Figure 3b , Figure 3b This is a schematic diagram of the structure of an attribute heterogeneous graph provided in an embodiment of the present application. Figure 3bAs shown, the attribute heterogeneous graph contains attribute nodes of various attribute types, such as first attribute node 321, second attribute node 331, third attribute node 341, and fourth attribute node 351. There can be multiple attribute nodes of the same attribute type, for example, the attribute nodes for the first attribute also include first attribute node 322, first attribute node 323, and so on. Each business attribute data item in the target business attribute data and associated business attribute data can find a corresponding attribute node in the heterogeneous attribute graph. Based on the connection relationship between attribute nodes of different attribute types, the second edge weight between two attribute nodes can be determined. For example, if second attribute node 331 is device 1 and third attribute node 341 is device model a, and device 1's model is device model a, then second attribute node 331 and third attribute node 341 are connected and have a connection relationship, and there is a connecting edge between them. For example, if first attribute node 321 is IP2, and device 1 has never used IP2, then there is no connection or connection relationship between device 1 and IP2, and therefore no connecting edge exists.

[0122] Step S103: performing community discovery processing on the attribute isomorphism graph through the risk control detection model to obtain an attribute label for the business request.

[0123] Specifically, in a risk control detection model, a computer device can divide and process the attribute nodes in an attribute isomorphism graph according to the modularity of the attribute isomorphism graph to obtain an attribute node community. The attribute node community to which the attribute node corresponding to the target business attribute data belongs is then determined as the target attribute node community. Finally, the community attribute label of the target attribute node community is used as the attribute label for the business request. The attribute nodes and the edges determined based on the common information between the attribute nodes form an isomorphic network. In such an isomorphic network, some attribute nodes are closely connected, while some attribute nodes are sparsely connected. In such an isomorphic network, the more closely connected portion can be considered an attribute node community. The attribute nodes within an attribute node community have a relatively close connection, while the connection between two attribute node communities is relatively sparse. This is called a community structure.

[0124] Specifically, attribute nodes in the attribute isomorphism graph are partitioned using its modularity to obtain attribute node communities. This means that densely connected attribute nodes are grouped together in a community, which increases the modularity. Ultimately, the partition with the highest modularity is the optimal community partition. Modularity refers to the proportion of edges connecting vertices within a community structure, minus the expected proportion of connections between any two attribute nodes under the same community structure.

[0125] Specifically, how to divide the attribute nodes in the attribute isomorphism graph to obtain the attribute node community can also be achieved through other methods, such as minimum cut or regularized cut, that is, by calculating the minimum cut of the graph, the network is divided into a predetermined number of groups, and the number of edges connecting each group is minimized; non-negative matrix decomposition: the basic principle is to decompose the original matrix to obtain the community indicator matrix and the basis matrix; community division based on node similarity, etc., are not restricted here.

[0126] Step S104 : performing node sequence sampling on the attribute isomorphic graph and the attribute heterogeneous graph respectively through the risk control detection model, and generating a graph association feature vector of the attribute node corresponding to the target business attribute data according to the attribute node sequence obtained by sampling.

[0127] Specifically, the computer device uses a risk control detection model to perform a random walk on an attribute isomorphic graph, sampling attribute nodes along the random walk path to obtain a sequence of isomorphic attribute nodes. Based on the isomorphic attribute node sequence, an isomorphic graph feature vector is generated for the attribute nodes corresponding to the target business attribute data. The risk control detection model also performs a random walk on an attribute heterogeneous graph, sampling attribute nodes along the random walk path to obtain a sequence of heterogeneous attribute nodes. Based on the heterogeneous attribute node sequence, a heterogeneous graph feature vector is generated for the attribute nodes corresponding to the target business attribute data. Finally, the isomorphic and heterogeneous graph feature vectors are concatenated to obtain a graph association feature vector for the attribute nodes corresponding to the target business attribute data. The process of randomly selecting a node from a node's neighbors as the next hop is called a random walk. Repeating the random walk process multiple times and sampling attribute nodes along the random walk path can generate a walk sequence. The process of generating an isomorphic graph feature vector of the attribute nodes corresponding to the target business attribute data based on the isomorphic attribute node sequence may be to deliver the isomorphic attribute node sequence as a training sample to the isomorphic graph embedding layer of the risk control detection model for training, thereby obtaining the isomorphic graph feature vector of the attribute nodes corresponding to the target business attribute data, that is, the node embedding vector, i.e., embedding. The process of generating an heterogeneous graph feature vector of the attribute nodes corresponding to the target business attribute data based on the heterogeneous attribute node sequence may be to deliver the heterogeneous attribute node sequence as a training sample to the heterogeneous graph embedding layer of the risk control detection model for training, thereby obtaining the heterogeneous graph feature vector of the attribute nodes corresponding to the target business attribute data.

[0128] Step S105 , performing risk prediction processing on the attribute labels, graph-related feature vectors, and behavioral features corresponding to the target business attribute data through the risk control detection model to obtain a target risk prediction result.

[0129] Specifically, the computer device will perform feature splicing on the attribute label, the graph-related feature vector, and the behavioral features corresponding to the target business attribute data to obtain a target feature vector; then the target feature vector is input into the classification layer of the risk prediction model, and the risk probability of the target feature vector under each candidate risk type label among at least two candidate risk type labels is determined through the classification layer; then, based on the risk probability corresponding to each candidate risk type label, a target risk value is generated for the business request, and among the risk probabilities corresponding to each candidate risk type label, the candidate risk type label corresponding to the maximum risk probability is determined as the target risk type label. Among them, the candidate risk type label is used to characterize the risk type corresponding to the business request, such as an illegal account, an illegal login IP, etc., and the risk score is used to describe the risk level corresponding to the risk type.

[0130] Specifically, the process by which a computer device determines the behavioral characteristics of target business attribute data may include: obtaining a historical business request sequence associated with the target business attribute data through a risk control detection model; then, generating request behavior statistics corresponding to the target business attribute data based on the historical business attribute data of the historical business requests in the historical business request sequence and the historical time period in which the historical business requests occurred; and then, generating behavioral characteristics corresponding to the target business attribute data based on the request behavior statistics. For example, the behavioral characteristics corresponding to the target business attribute data may include the number of requests for a certain mobile phone number in the past hour, the number of IP addresses used by a certain mobile phone number in the past 10 minutes, and so on.

[0131] Step S106: performing anti-cheating processing associated with the target risk prediction result on the business request through the decision engine.

[0132] Specifically, the computer device can obtain an anti-fraud risk control policy that has a mapping relationship with the risk label through the decision engine; then obtain the risk control threshold corresponding to the target risk type label based on the anti-fraud risk control policy; if the target risk value is greater than or equal to the risk control threshold, the business request is rejected; if the target risk value is less than the risk control threshold, the business request is responded to.

[0133] Optionally, after obtaining a target risk prediction result related to a business request, the target risk prediction result can be bound to the target user within a certain time period. That is, if a new business request is received from the target user within the certain time period, the decision engine can directly perform anti-fraud processing associated with the target risk prediction result on the new business request. After the specified time period, if the decision engine receives a new business request from the target user, it will re-invoke the corresponding risk control detection model to perform risk prediction processing on it.

[0134] Optionally, the model deployment platform can also pre-identify and predict the target risk prediction results of multiple sets of business attribute data offline. When a business request is received, the corresponding target business attribute data is obtained by simply matching them among the multiple sets of offline predicted business attribute data, and then obtaining the target risk prediction results corresponding to the business attribute data that matches the target business attribute data. The anti-fraud processing associated with the target risk prediction results is directly performed on the business request through the decision engine, which can improve the timeliness of identifying fraudulent traffic.

[0135] Through the method provided in the embodiment of the present application, the computer device can call the risk control detection model through the decision engine, construct a homogeneous attribute graph and a heterogeneous attribute graph for the target business attribute data corresponding to the received business request, and then determine the attribute label for the business request based on the homogeneous attribute graph. Based on the homogeneous attribute graph and the heterogeneous attribute graph, the graph association feature vector corresponding to the target business attribute data of the business request can be obtained, and the behavioral characteristics corresponding to the target business attribute data can be obtained. Then, based on the attribute label, the graph association feature vector and the behavioral characteristics, a multi-dimensional target feature vector for the business request is obtained. Then, the computer device can obtain the target risk prediction result of the business request based on the target feature vector, and then perform anti-cheating processing on the business request based on the target risk prediction result through the decision engine. Using the method provided in the embodiment of the present application, more dimensions can be provided to characterize business requests, thereby improving the detection coverage and detection accuracy of cheating traffic.

[0136] For further information, see Figure 4 , Figure 4 This is a flow chart of a risk control detection method provided by an embodiment of the present application. Figure 1a The computer device described in the embodiment can be executed Figure 1a The business server 100 in Figure 1a The terminal device cluster in (also includes terminal device 200a, terminal device 200b and terminal device 200n). Figure 4 As shown, the process of the risk control detection method is as follows:

[0137] Step S21 : extracting features from the business data associated with the business request to obtain target business attribute data.

[0138] Specifically, for business requests received online in real time, the computer device can access the business data associated with the request through the corresponding interface of the decision engine. The computer device then performs feature engineering on the acquired business data to extract the required target business attribute data, such as account number, device number, IP address, and other information. Of course, after processing each business request, the computer device will store the corresponding account number, device number, mobile phone number, IP address, and other business data in the database to facilitate subsequent model training or the construction of behavioral features.

[0139] Step S22: constructing an attribute isomorphic graph and an attribute heterogeneous graph based on the target business attribute data.

[0140] Specifically, after obtaining the target business attribute data, it can be input into the homogeneous model and heterogeneous model, respectively, to obtain the corresponding attribute homogeneous graph and attribute heterogeneous graph. The homogeneous model and heterogeneous model can be unsupervised learning models. The computer device trains the homogeneous model and heterogeneous model using unlabeled business attribute data.

[0141] Specifically, the number of attribute isomorphism graphs can be one or more. The computer device can construct an attribute isomorphism graph with the attribute type being an account, an attribute isomorphism graph with the attribute information being an IP, and so on based on the acquired target business attribute data. The specific attribute type of attribute isomorphism graph to be constructed can be determined based on actual conditions and is not restricted here.

[0142] Step S23: Perform community discovery processing on the attribute isomorphic graph using a community discovery model, and output attribute labels.

[0143] Specifically, for each attribute isomorphism graph, a modularity-based community discovery (FastUnfolding) model can be used to mine community attribute labels of the communities described by attribute nodes corresponding to target business attribute data in the attribute isomorphism graph as attribute labels.

[0144] For easier understanding, please refer to Figure 5 , Figure 5 This is a schematic diagram of a community discovery process provided by an embodiment of the present application. The computer device divides the attribute nodes in the attribute isomorphism graph according to the modularity of the attribute isomorphism graph to obtain the attribute node community, which mainly includes two stages, such as Figure 5 As shown in the figure, the first stage is modularity optimization, which mainly divides each attribute node into the node community where its adjacent attribute nodes are located, so that the modularity value continues to increase. The specific process is as follows:

[0145] First, initialize and divide the attribute nodes in the attribute isomorphism graph 51 into initial attribute node communities, that is, each attribute node is counted as an initial attribute node community; then, divide the attribute nodes T i Transfer to the initial attribute node community where the neighbor attribute node is located, and obtain the transferred attribute node community; the neighbor node and the attribute node T in the attribute isomorphic graph i The algorithm uses the following formula: 1) a connected relationship; 2) i is a positive integer less than or equal to the total number of attribute nodes in the attribute isomorphism graph; 3) a modularity change is determined based on the initial attribute node community and the transferred attribute node community: the modularity corresponding to the transferred attribute node community minus the modularity corresponding to the transferred attribute node community. In other words, each attribute node is partitioned into the community of its neighboring attribute nodes, the resulting modularity is calculated, and the difference ΔQ between the modularity before and after the partition is determined to be positive. If so, the partition is accepted; otherwise, the partition is abandoned.

[0146] The calculation of modularity can be achieved by the following formula (1):

[0147]

[0148] Among them, ∑ in represents the weight within community c, ∑ tot It represents the sum of the edge weights between communities, m is the sum of all weights of the graph, and Q is the modularity.

[0149] The calculation of ΔQ can refer to the following formula (2):

[0150]

[0151] Among them, k i,in It represents the weight between attribute node i and attribute node in. Attribute node in refers to the neighbor attribute node of attribute node i. i is the sum of the edge weights connected to attribute node i.

[0152] Repeat the above process until the modularity can no longer be increased, that is, no matter which attribute node is moved to the community where the neighbor attribute node is located, the modularity change value is not positive. At this time, it is determined that the modularity change value meets the community aggregation condition. Figure 5As shown, the attribute isomorphism graph 51 is optimized for modularity to obtain a transfer attribute isomorphism graph 52, which contains four transfer attribute node communities. For ease of understanding, the attribute nodes in different transfer attribute node communities are marked with different colors. Within each transfer attribute node community, the connection relationship between attribute nodes is relatively close, while the connection relationship between different transfer attribute node communities is relatively sparse. For example, the attribute nodes in the transfer attribute node community 522 are closely connected, while the connection between the transfer attribute node community 521 and the transfer attribute node community 522 is relatively sparse. Then, the computer device will execute the second stage: community aggregation, and use the transfer attribute node community as a reconstructed attribute node to obtain a reconstructed attribute isomorphism graph, that is, the transfer attribute node community divided in the first stage is aggregated into a reconstructed attribute node, and then the isomorphic network is reconstructed according to the community structure generated in the first stage. Community aggregation processing is performed on the transfer attribute isomorphism graph 52 to obtain a reconstructed attribute isomorphism graph 53. As shown in the reconstructed attribute isomorphism graph 53, each reconstructed attribute node represents a transfer attribute node community, and the edge weight between the reconstructed attribute nodes is the sum of the edge weights of all attribute nodes in its corresponding transfer attribute node community, as shown in FIG. Figure 5 As shown, assuming that in the transfer attribute isomorphism graph 52, the weights of the edges are all 1, at this time the only edge between the transfer attribute node community 522 and the transfer attribute node community 521 is the connecting edge between the attribute node 11 and the attribute node 6 with an edge weight of 1, then in the reconstructed attribute isomorphism graph 53, the edge weight between the reconstructed attribute node 531 and the reconstructed attribute node 532 is 1.

[0153] Then, if the community structures of the reconstructed attribute isomorphism graph and the attribute isomorphism graph are the same, the transferred attribute node community corresponding to the reconstructed attribute isomorphism graph will be used as the attribute node community. If the community structures of the reconstructed attribute isomorphism graph and the attribute isomorphism graph are different, the reconstructed attribute nodes in the reconstructed attribute isomorphism graph will continue to be transferred. In other words, since the community structures of the attribute isomorphism graph 51 and the reconstructed attribute isomorphism graph 53 are different, the computer device will repeatedly perform the above-mentioned first and second stages on the reconstructed attribute isomorphism graph 53 to obtain a new reconstructed attribute isomorphism graph until the community structure of the new reconstructed attribute isomorphism graph no longer changes. Assuming that the final community structure that remains unchanged is the reconstructed attribute isomorphism graph 54, the computer device will use the corresponding transferred attribute node community in the reconstructed attribute isomorphism graph 54 as the attribute node community. Each attribute node community is identified by a community attribute label. The computer device will determine the attribute node community to which the attribute node corresponding to the target business attribute data belongs as the target attribute node community, and use the community attribute label of the target attribute node community as the attribute label for the business request.

[0154] Step S24 , performing node embedding processing on the attribute isomorphic graph and the attribute heterogeneous graph through a homogeneous-heterogeneous hybrid model to obtain a graph association feature vector.

[0155] Specifically, the purpose of node embedding is to map entities into a continuous vector space so that entities can be represented by vectors. Node embedding, that is, to retain information in the graph through embedding, for example, the embedding vector of a certain point can be used to find its neighbors in the graph. At the same time, the embedding vector of a certain point can be directly used as the input of downstream tasks. The idea of ​​node embedding is to randomly walk, sample the attribute nodes on the random walk path to obtain an attribute node sequence, and then use the word vector processing method to model such a sequence to obtain the vector representation of the attribute node. For easier understanding, please refer to Figure 6 , Figure 6 This is a scenario diagram of an isomorphic graph node embedding implementation provided by an embodiment of the present application. The computer device obtains a sequence length parameter; then randomly selects an attribute node in the attribute isomorphic graph and adds it to the sampling node sequence; then the attribute node added to the sampling node sequence is used as the target sampling node; subsequently, the computer device randomly selects an attribute node from the neighboring nodes of the target sampling node and adds it to the sampling node sequence; if the total number of attribute nodes in the sampling node sequence is equal to the sequence length parameter, the random walk node sequence sampling is stopped, and the sampling node sequence is used as a group of isomorphic attribute node sequences; if the total number of attribute nodes in the sampling node sequence is less than the sequence length parameter, the attribute node newly added to the sampling node sequence is used as the new target sampling node, and continues to randomly select an attribute node from the neighboring nodes of the new target sampling node and add it to the sampling node sequence. As Figure 6As shown, after sampling the attribute isomorphic graph 60, sequence 1, sequence 2 and sequence 3 are obtained, wherein sequence 1 includes v1, v2, v0... wherein v1 is attribute node 1, v2 is attribute node 2, and v0 is attribute node 0. The process of obtaining three groups of isomorphic attribute node sequences can be as follows: assuming that the sequence length parameter is 10, when the computer device randomly walks and samples, it first randomly selects attribute node 1 as the target sampling node, and then randomly selects attribute node 2 from the neighboring nodes of attribute node 1 and adds it to the sampling node sequence. At this time, there are only two attribute nodes in the sampling node sequence, and the computer device will use attribute node 2 as the target sampling node and continue sampling. Until the sampling node sequence contains ten attribute nodes, the computer device will use the sampling node sequence as a group of isomorphic attribute node sequences. The computer device can collect multiple groups of isomorphic attribute node sequences according to actual setting requirements. Then, the computer device will use the collected multiple groups of isomorphic attribute node sequences as input to the skip-gram (a neural network) model and output the isomorphic graph feature vector corresponding to the isomorphic graph. The implementation of the heterogeneous graph feature vector corresponding to the heterogeneous graph is similar. First, attribute nodes in the heterogeneous graph are sampled, and then the resulting sequence of heterogeneous attribute nodes is embedded to obtain the heterogeneous graph feature vector corresponding to the heterogeneous graph. The homogeneous and heterogeneous graph feature vectors are then concatenated to obtain the graph-association feature vector for the attribute nodes corresponding to the target business attribute data. Using a homogeneous-heterogeneous hybrid model, we go beyond the modularity of the graph and mine the behavior and relationship chain data between the target business attribute data to obtain the graph-association feature vector, providing more dimensional feature information for characterizing business requests.

[0156] Step S25: determining the behavior characteristics corresponding to the target business attribute data.

[0157] Specifically, the computer device extracts a sequence of historical service requests associated with the target service attribute data within the statistical time period. Based on the historical service attribute data of the historical service requests in the historical service request sequence and the historical time period in which the historical service requests occurred, the computer device generates request behavior statistics corresponding to the target service attribute data. Then, based on the request behavior statistics, the computer device generates behavioral features corresponding to the target service attribute data. For example, assuming the target service attribute data includes mobile phone number 1 and account number 2, and the statistical time period is one week, the computer device will query the historical service request sequence within the week and then use the historical service requests in the historical service request sequence that include mobile phone number 1 or account number 2 as the historical service request sequence associated with the target service attribute data. For example, historical service request a for mobile phone number 1 and account number 3, historical service request b for mobile phone number 4 and account number 2, and so on. The computer device can then obtain request behavior statistics based on different historical time periods, such as how many historical service requests were sent by mobile phone number 1 in the last hour, how many accounts were used by mobile phone number 1 in the last ten minutes, etc. Based on the request behavior statistics, the computer device can obtain behavioral features corresponding to the target service attribute data.

[0158] Step S26: Obtain a target feature vector according to the attribute label, the graph association feature vector, and the behavior feature.

[0159] Step S27: input the target feature vector into the classification layer, and output the risk score and risk label.

[0160] Specifically, the classification layer can be implemented using a supervised learning model, such as the XGBoost model. The implementation of steps S26 and S27 can be found in the above Figure 2 The implementation of steps S105 and S106 in the corresponding embodiment will not be described in detail here.

[0161] By adopting the method provided in the embodiment of the present application, the attribute labels, graph-related feature vectors and behavioral features used to characterize business requests can be obtained through the risk control detection model, and the attribute labels, graph-related feature vectors and behavioral features can be spliced ​​together to obtain the target feature vector. The target feature vector can be used to characterize the business request from multiple dimensions, and finally the target feature vector can be used to output the risk score and risk type of the business request, which can improve the detection coverage and accuracy of fraudulent traffic.

[0162] Further, see Figure 7 , Figure 7 This is a schematic diagram of the relationship between a decision engine and a model deployment platform provided by the embodiment of the present application. Figure 7As shown, the model deployment platform 72 includes a model repository that can store multiple risk control detection models of different types and versions. The model deployment platform 72 can deploy each risk control detection model in the model repository as an online model service, allowing the decision engine to call the risk control detection model to obtain real-time model services. The model deployment platform 72 can configure traffic for the risk control detection model and determine the target user group associated with the risk control detection model. The risk control detection model will then be used to respond to service requests initiated by the target user group.

[0163] like Figure 7 As shown, the decision engine 71 can provide functions such as risk control rule configuration, policy management, device fingerprint identification, and model calling. Among them, risk control rule configuration means that the decision engine 71 can respond to the risk control policy configuration operation for the target user group and generate a risk control policy for the target user group. Among them, the risk control policy includes a processing type field and an anti-cheating processing policy associated with the processing type field. For example, if the processing type field is true, the associated anti-cheating processing policy can be to allow the response to the business request; if the processing type field is false, the associated anti-cheating processing policy can be to refuse to respond to the business request. Among them, the policy management user maps at least two risk prediction results of the risk control detection model with the processing type field. For example, the risk prediction results include a first risk prediction result and a second risk prediction result. The first risk prediction result is mapped to the processing type field true, and the second risk prediction result is mapped to the processing type field false.

[0164] like Figure 7 As shown, after the mapping configuration between the risk control strategy of the decision engine 71 and the risk control detection model in the model deployment platform 72 is completed, the decision engine 71 can call the risk control detection model online, and then the model deployment platform 72 can provide real-time risk control detection model services through the called risk control detection model. The specific process is as follows:

[0165] After receiving the business request of the target user, the decision engine 71 will call the risk control detection model associated with the target user group to which the target user belongs, and then pass the business data related to the business request of the target user to the risk control detection model. The risk control detection model will output the target risk prediction result based on the business request, and return the target prediction result to the decision engine 71. The decision engine 71 will then determine the processing type field that has a mapping relationship with the target risk prediction result as the target processing type field, and then perform anti-cheating processing on the business request according to the anti-cheating processing strategy associated with the target processing type field. For example, if the target prediction result is the first risk prediction result mentioned above, the first risk prediction result is mapped to the processing type field true, and the anti-cheating processing strategy associated with the processing type field true can be to allow the business request to be responded to. At this time, the decision engine 71 will not intercept the business request, and the computer device will respond to the business request and execute the business method associated with the business request.

[0166] like Figure 7 As shown, the decision engine 71 and the model deployment platform 72 also jointly manage the status of the real-time risk control detection model service provided by the risk control detection model. The model deployment platform 72 counts the number of calls to each risk control detection model in the model warehouse, as well as its memory usage, operating status, etc., and sends this information to the decision engine 71. The decision engine 71 then displays the service status of each risk control detection model in real time. Strategists can manage the risk control detection model by performing configuration operations such as resource allocation, upgrade rollback, suspension, and activation based on the displayed service status.

[0167] like Figure 7 As shown, the decision engine 71 device fingerprint can be used to verify the device number and fingerprint information of the target user initiating the service request. If the verification is successful, the service request is responded to. The decision engine 71 can also provide a real-time indicator calculation service, which can calculate the association and statistical data between accounts in real time over a period of time, and is used to identify account associations and behavioral anomalies in the service flow.

[0168] By adopting the method provided in the embodiment of the present application, the risk control strategy and the mapping relationship between the risk control strategy and the risk control detection model can be adjusted at any time through the decision engine, without the need for additional development and online deployment, saving time and effort, and being able to quickly respond to changes in the black market.

[0169] Further, see Figure 8 , Figure 8 This is a schematic diagram of the architecture of a model deployment platform provided in an embodiment of the present application. Figure 8 As shown, the model deployment platform 80 may include a decision engine 801 , a page configuration layer 802 , a model layer 803 , a configuration layer 804 , a service layer 805 and a tool layer 806 .

[0170] After the model trainer has trained the risk control detection model, he can upload the model file through the page corresponding to the page configuration layer 801. The model layer 803 can support multiple model file formats such as pmml (Predictive Model Markup Language), pb (a binary file), zip (a file format for data compression and document storage), and .m (a program text file) to meet the needs of traditional machine learning models, tree models, and model files of different deep learning libraries. In other words, after the model deployment platform 80 obtains the risk control model file to be deployed uploaded by the page configuration layer 802 through the model layer 803, it can identify the model file format of the risk control model file, parse the risk control model file based on the model file format, and obtain the risk control detection model corresponding to the risk control model file. Then, the model deployment platform 80 can perform version management, traffic allocation, model deployment and model testing on the risk control detection model through the configuration layer 804. Specifically, in the model deployment platform 80, in response to the version management operation initiated for the risk control detection model, the model version information is assigned to the risk control detection model through the configuration layer 804; then, in response to the deployment and online operation initiated for the risk control detection model, the risk control detection model is tested and processed to obtain the test service quality; if the test service quality meets the model online conditions, the risk control detection model and the model version information are added to the model library in the model deployment platform. Among them, the model version information can be used to distinguish between risk control detection models with different functions, and can also be used to distinguish between the same series of risk control detection models that meet the different usage requirements of different users, such as risk control detection models with the same function applicable to different operating environments or different platforms. It can also distinguish between old and new risk control detection models. After the old risk control detection model is put into use, it has been running for a period of time and a change requirement is raised. The developer makes a major revision or error correction to it, enhances the function or improves the performance, and then re-uploads the new risk control detection model. The process of testing the risk control detection model to obtain the test service quality can include: obtaining offline sample attribute data through the model deployment platform; then performing offline prediction processing on the risk control detection model service based on the offline sample data to obtain offline prediction results; and evaluating the test service quality of the risk control detection model service based on the error between the offline prediction results and the risk control labels. The offline sample attribute data is added with risk control labels; the risk control labels are used to characterize the riskiness of the offline sample attribute data.

[0171] like Figure 8As shown, after the risk control detection model is successfully deployed, the service layer 805 can provide risk control detection services. After the risk control detection service is online, the ability to reference the risk control detection model can be configured in the decision engine 801, and the business fields corresponding to the business data can be mapped into the input parameters of the risk control detection model. The output of the risk control detection model is returned to the decision engine 801 and configured into the risk control strategy and rules. Figure 2 After the input and output configuration of the risk control detection model in the corresponding embodiment is completed, the model deployment platform 80 can execute the above Figure 2 The description of steps S101 to S106 in the corresponding embodiment.

[0172] like Figure 8As shown, the model deployment platform 80 can provide scheduling management, upgrade rollback, field mapping, and service monitoring functions through the tool layer 806. Field mapping is used to implement the mapping relationship between the output of the risk control detection model and the risk control policy in the decision engine 801. It can be understood that the field mapping function decouples the risk control detection model and the risk control policy. When the risk control policy changes, it is only necessary to readjust the mapping relationship between the new risk control policy and the risk control detection model through field mapping, without having to re-launch the risk control detection model. This allows for more efficient risk control policy updates and accelerates the evolution of resources and means to combat fraudulent traffic generated by black market personnel. The service monitoring process can be as follows: the tool layer 806 of the model deployment platform 80 can record the predicted risk control detection results obtained by the risk control detection model in response to business requests initiated by the target user group in the model execution log corresponding to the risk control detection model; subsequently, the risk status of the target user group is monitored over a period of time, and the actual risk label of the target user group is determined based on the risk status; based on the error between the actual risk label and the predicted risk control detection results in the model execution log, the risk control policy quality of the risk control detection model is generated. When the quality of the risk control strategy does not meet the risk control conditions, a strategy adjustment prompt is generated for the risk control detection model. The strategy adjustment prompt is used to prompt the adjustment of the anti-fraud processing strategy associated with the risk control detection model. Service monitoring can also include: recording the operation data of each model, and then generating the operation supervision results for each model based on the recognition results in the model service execution log and the call volume and resource usage of each model service. The operation data includes the call volume and resource usage of each model service in different time periods. The risk control strategy quality and operation supervision results obtained by service monitoring can be visualized through the corresponding page of the tool layer 806, so that strategy personnel can understand the status of the risk prediction service provided by the risk control detection model at any time. Through the tool layer 806, policy personnel can schedule and manage and upgrade and rollback the risk control detection model based on the service monitoring results. Among them, scheduling management can be to adjust the amount of resources and memory occupied by the risk control detection model according to the call volume of the risk control detection model to ensure maximum resource utilization; upgrade and rollback can be to roll back to the old version of the risk control detection model if the risk control strategy quality of a new version of the risk control detection model does not meet expectations, and retrain and optimize the new version of the risk control detection model before putting it back online.

[0173] In a feasible embodiment, in order to ensure the scalability of the model automatic deployment platform, the model layer can support model files in the .pmml file format. PMML files have the characteristics of platform independence and compatibility. PMML can decouple the model deployment platform from the model training platform. After training the risk control detection model, it is only necessary to export the risk control detection model and convert it into the pmml format to quickly deploy it through the model deployment platform. Among them, compatibility means that a PMML-compatible model deployment platform can read and deploy standard PMML files exported by other platforms. Therefore, the model deployment platform can adopt the PMML standard model specification, integrate the AI ​​Serving (an open source machine learning and deep learning model deployment reasoning system) library and the Tensorflow Serving (a flexible, high-performance application system suitable for machine learning models) library to provide model online prediction services. Traditional machine learning models use AI Serving services, and deep learning models use Tensorflow Serving. The model deployment service offers excellent performance and high stability. On a single 8-core 16G (Gigabyte, a decimal unit) machine, QPS (Queries per second) can reach 30,000 / s, with 99.99% latency within 100ms (milliseconds), meeting the latency requirements of traffic risk control customers. The automated model deployment platform is independent of the model training platform and can run independently to provide services. The model service can meet the high concurrency requests of the decision engine. The model deployment platform supports monitoring of server resources and service execution status, and can run a variety of commonly used machine learning models and models generated in various common platform environments. It also supports Docker (container engine) for rapid deployment of model services, offering the advantages of low platform coupling, high concurrency, high stability, high model compatibility, and support for rapid deployment.

[0174] Further, see Figure 9 , Figure 9 : is a structural diagram of a data processing device provided in an embodiment of the present application. The above-mentioned data processing device can be a computer program (including program code) running on a computer device, for example, the data processing device is an application software; the data processing device can be used to execute the corresponding steps of the method provided in an embodiment of the present application. Figure 9 As shown, the data processing device 1 may include: an acquisition module 101 , a graph construction module 102 , a label determination module 103 , a graph vector determination module 104 , a risk determination module 105 and an anti-cheating module 106 .

[0175] The acquisition module 101 is used to obtain a business request initiated by a target user and obtain a risk control detection model associated with the business request from the model library in the model deployment platform through the decision engine;

[0176] The acquisition module 101 is further used to obtain target business attribute data corresponding to the business request and obtain the user social group of the target user;

[0177] A graph construction module 102 is configured to construct an attribute isomorphic graph and an attribute heterogeneous graph using target business attribute data and associated business attribute data of associated users in the user social group as attribute nodes;

[0178] The label determination module 103 is used to perform community discovery processing on the attribute isomorphism graph through the risk control detection model to obtain attribute labels for the business request;

[0179] The graph vector determination module 104 is used to sample node sequences of the attribute isomorphic graph and the attribute heterogeneous graph respectively using the risk control detection model, and generate graph association feature vectors of the attribute nodes corresponding to the target business attribute data based on the sampled attribute node sequences;

[0180] The risk determination module 105 is used to perform risk prediction processing on the attribute labels, graph-related feature vectors, and behavioral features corresponding to the target business attribute data through the risk control detection model to obtain a target risk prediction result;

[0181] The anti-cheating module 106 is configured to perform anti-cheating processing on the service request in association with the target risk prediction result through the decision engine.

[0182] The specific functional implementation of the acquisition module 101, the graph construction module 102, the label determination module 103, the graph vector determination module 104, the risk determination module 105 and the anti-cheating module 106 can be found in Figure 2 The detailed description of steps S101 to S106 in the corresponding embodiment will not be repeated here.

[0183] Please see again Figure 9 The graph construction module 102 may include: a node determination unit 1021 , a homogeneous graph construction unit 1022 , and a heterogeneous graph construction unit 1023 .

[0184] The node determination unit 1021 is configured to use the target business attribute data and the associated business attribute data of associated users in the user social group as attribute nodes; the number of attribute nodes is at least two;

[0185] The isomorphic graph construction unit 1022 is configured to obtain attribute nodes with the same attribute type from at least two attribute nodes as isomorphic attribute nodes;

[0186] The isomorphic graph construction unit 1022 is configured to determine the first edge weights between the isomorphic attribute nodes based on the commonality information between the isomorphic attribute nodes;

[0187] An isomorphic graph construction unit 1022 is used to construct an attribute isomorphic graph according to the isomorphic attribute nodes and the first edge weights;

[0188] The heterogeneous graph construction unit 1023 is configured to construct an attribute heterogeneous graph including at least two attribute nodes according to a connection relationship between two attribute nodes in the at least two attribute nodes.

[0189] The specific functional implementation of the node determination unit 1021, the homogeneous graph construction unit 1022 and the heterogeneous graph construction unit 1023 can be found in Figure 2 The specific description of step S102 in the corresponding embodiment will not be repeated here.

[0190] Please see again Figure 9 The label determination module 103 may include: a community division unit 1031 and a label selection unit 1032 .

[0191] The community division unit 1031 is used to divide the attribute nodes in the attribute isomorphism graph according to the modularity of the attribute isomorphism graph in the risk control detection model to obtain attribute node communities;

[0192] The label selection unit 1032 is used to determine the attribute node community to which the attribute node corresponding to the target business attribute data belongs as the target attribute node community;

[0193] The label selection unit 1032 is further configured to use the community attribute label of the target attribute node community as the attribute label for the service request.

[0194] The specific functional implementation of the community division unit 1031 and the label selection unit 1032 can be found in Figure 2 The specific description of step S103 in the corresponding embodiment will not be repeated here.

[0195] Please see again Figure 9 The community division unit 1031 may include: an initial subunit 10311 , a transfer subunit 10312 , a transfer subunit 10312 , and an iteration subunit 10314 .

[0196] Initial subunit 10311 is used to divide the attribute nodes in the attribute isomorphism graph into initial attribute node communities in the risk control detection model;

[0197] Transfer subunit 10312, used to transfer attribute node T in the attribute isomorphism graph i Transfer to the initial attribute node community where the neighbor attribute node is located, and obtain the transferred attribute node community; the neighbor node and the attribute node T in the attribute isomorphic graph ihave a connection relationship; i is a positive integer less than or equal to the total number of attribute nodes in the attribute isomorphism graph;

[0198] The transfer subunit 10312 is further configured to determine a modularity change value based on the initial attribute node community and the transferred attribute node community;

[0199] The reconstruction subunit 10313 is configured to use the transferred attribute node community as a reconstructed attribute node to obtain a reconstructed attribute isomorphism graph if the modularity change value satisfies a community aggregation condition;

[0200] The iterator unit 10314 is further configured to use the transferred attribute node community as the attribute node community if the community structures of the reconstructed attribute isomorphism graph and the attribute isomorphism graph are the same;

[0201] The iterator unit 10314 is further configured to continue transferring the reconstructed attribute nodes in the reconstructed attribute isomorphism graph if the community structures of the reconstructed attribute isomorphism graph and the attribute isomorphism graph are different.

[0202] The specific functional implementation of the initial subunit 10311, the transfer subunit 10312, the transfer subunit 10312 and the iterative subunit 10314 can be found in Figure 5 The specific description in the corresponding embodiment will not be repeated here.

[0203] Please see again Figure 9 The graph vector determination module 104 may include: a homogeneous vector determination unit 1041 , a heterogeneous vector determination unit 1042 and a splicing unit 1043 .

[0204] The isomorphic vector determination unit 1041 is used to perform a random walk on the attribute isomorphic graph using the risk control detection model, sample attribute nodes on the random walk path, and obtain an isomorphic attribute node sequence;

[0205] The isomorphic vector determining unit 1041 is further configured to generate an isomorphic graph feature vector of the attribute node corresponding to the target business attribute data based on the isomorphic attribute node sequence;

[0206] The heterogeneous vector determination unit 1042 is configured to perform a random walk on the attribute heterogeneous graph using a risk control detection model, sample attribute nodes on the random walk path, and obtain a heterogeneous attribute node sequence;

[0207] The heterogeneous vector determining unit 1042 is further configured to generate a heterogeneous graph feature vector of the attribute node corresponding to the target business attribute data according to the heterogeneous attribute node sequence;

[0208] The splicing unit 1043 is used to splice the homogeneous graph feature vector and the heterogeneous graph feature vector to obtain the graph-associated feature vector of the attribute node corresponding to the target business attribute data.

[0209] The specific functional implementation of the isomorphic vector determining unit 1041, the heterogeneous vector determining unit 1042 and the splicing unit 1043 can be found in Figure 2 The specific description of step S104 in the corresponding embodiment will not be repeated here.

[0210] Among them, the target risk prediction result includes the target risk value and the target risk type label;

[0211] Please see again Figure 9 The risk determination module 105 may include: a feature splicing unit 1051 and a result determination unit 1052.

[0212] The feature concatenation unit 1051 is configured to concatenate the attribute label, the graph-related feature vector, and the behavior feature corresponding to the target business attribute data to obtain a target feature vector.

[0213] A result determination unit 1052 is configured to input the target feature vector into a classification layer of a risk prediction model, and determine the risk probability of the target feature vector under each of at least two candidate risk type labels through the classification layer;

[0214] The result determination unit 1052 is further configured to generate a target risk value for the business request based on the risk probabilities corresponding to each candidate risk type label, and determine the candidate risk type label corresponding to the maximum risk probability as the target risk type label among the risk probabilities corresponding to each candidate risk type label.

[0215] The specific functional implementation of the feature splicing unit 1051 and the result determination unit 1052 can be found in Figure 2 The specific description of S105 in the corresponding embodiment will not be repeated here.

[0216] Please see again Figure 9 The anti-cheating module 106 may include: a strategy acquisition unit 1061 and an anti-cheating unit 1062 .

[0217] The strategy acquisition unit 1061 is configured to acquire, through the decision engine, an anti-fraud risk control strategy that has a mapping relationship with the risk tag;

[0218] The anti-cheating unit 1062 is configured to obtain a risk control threshold corresponding to a target risk type label according to an anti-cheating risk control policy;

[0219] The anti-cheating unit 1062 is further configured to reject the service request if the target risk value is greater than or equal to the risk control threshold;

[0220] The anti-cheating unit 1062 is further configured to respond to the service request if the target risk value is less than the risk control threshold.

[0221] The specific functional implementation of the strategy acquisition unit 1061 and the anti-cheating unit 1062 can be found in Figure 2 The specific description of step S106 in the corresponding embodiment will not be repeated here.

[0222] Please see again Figure 9 The above-mentioned data processing device 1 may further include: a feature determination module 107.

[0223] A feature determination module 107 is configured to obtain a historical business request sequence associated with target business attribute data through a risk control detection model;

[0224] The feature determination module 107 is also used to generate request behavior statistical information corresponding to the target business attribute data based on the historical business attribute data of the historical business requests in the historical business request sequence and the historical time period in which the historical business requests are located; and generate behavioral features corresponding to the target business attribute data based on the request behavior statistical information.

[0225] The specific functional implementation of the feature determination module 107 can be found in Figure 2 The specific description of step S105 in the corresponding embodiment will not be repeated here.

[0226] Please see again Figure 9 The data processing device 1 may include: a model generation module 108 , a version configuration module 109 , a test quality determination module 110 and an adding module 111 .

[0227] The model generation module 108 is used to obtain the risk control model file to be deployed through the model deployment platform;

[0228] The model generation module 108 is further configured to identify the model file format of the risk control model file, parse the risk control model file based on the model file format, and obtain a risk control detection model corresponding to the risk control model file;

[0229] The version configuration module 109 is used to respond to the version management operation initiated for the risk control detection model in the model deployment platform and allocate model version information for the risk control detection model;

[0230] The test quality determination module 110 is used to respond to the deployment and online operation initiated for the risk control detection model, test the risk control detection model, and obtain the test service quality;

[0231] Adding module 111 is used to add the risk control detection model and model version information to the model library in the model deployment platform if the test service quality meets the model online conditions.

[0232] The specific functional implementation of the model generation module 108, the version configuration module 109, the test quality determination module 110 and the adding module 111 can be found in Figure 8 The detailed description of the configuration layer 804 in the corresponding embodiment will not be repeated here.

[0233] Please see again Figure 9 The test quality determination module 110 may include: an offline data acquisition unit 1101 and an offline prediction unit 1102 .

[0234] The offline data acquisition unit 1101 is used to acquire offline sample attribute data through the model deployment platform; the offline sample attribute data is added with a risk control label; the risk control label is used to characterize the risk of the offline sample attribute data;

[0235] The offline prediction unit 1102 is used to perform offline prediction processing on the risk control detection model service based on the offline sample data to obtain an offline prediction result;

[0236] The offline prediction unit 1102 is further used to evaluate the test service quality of the risk control detection model service based on the error result between the offline prediction result and the risk control label.

[0237] The specific functional implementation of the offline data acquisition unit 1101 and the offline prediction unit 1102 can be found in Figure 8 The detailed description of the configuration layer 804 in the corresponding embodiment will not be repeated here.

[0238] Please see again Figure 9 The above-mentioned data processing device 1 may include: a traffic configuration module 112 and a policy configuration module 113.

[0239] Traffic configuration module 112 is used to respond to traffic configuration operations for the risk control detection model through the model deployment platform and determine the target user group associated with the risk control detection model; the target user group includes target users; the risk control detection model is used to respond to service requests initiated by the target user group;

[0240] The policy configuration module 113 is configured to generate a risk control policy for the target user group in response to the risk control policy configuration operation for the target user group through the decision engine; the risk control policy includes a processing type field and an anti-cheating processing policy associated with the processing type field;

[0241] The policy configuration module 113 is further configured to map at least two risk prediction results of the risk control detection model with the processing type field.

[0242] The specific functional implementation of the traffic configuration module 112 and the policy configuration module 113 can be found in Figure 7 The specific description in the corresponding embodiment will not be repeated here.

[0243] Please see again Figure 9 The anti-cheating module 106 may include: a target field determination unit 1061 and a policy processing unit 1062 .

[0244] A target field determining unit 1061 is configured to determine, through a decision engine, a processing type field that has a mapping relationship with a target risk prediction result as a target processing type field;

[0245] The policy processing unit 1062 is configured to perform anti-cheating processing on the service request according to the anti-cheating processing policy associated with the target processing type field.

[0246] The specific functional implementation of the target field determination unit 1061 and the policy processing unit 1062 can be found in Figure 7 The specific description in the corresponding embodiment will not be repeated here.

[0247] Please see again Figure 9 The data processing device 1 may include: a result recording module 114 , a monitoring module 115 and an adjustment prompt module 116 .

[0248] The result recording module 114 is used to record the predicted risk prediction results obtained by the risk control detection model in response to the business request initiated by the target user group into the model execution log corresponding to the risk control detection model;

[0249] A monitoring module 115 is used to monitor the risk status of the target user group and determine the real risk label of the target user group based on the risk status;

[0250] An adjustment prompt module 116 is used to generate the risk control strategy quality for the risk control detection model based on the error results between the actual risk label and the predicted risk prediction results in the model execution log;

[0251] The adjustment prompt module 116 is further configured to generate a policy adjustment prompt for the risk control detection model when the risk control policy quality does not meet the risk control conditions; the policy adjustment prompt is configured to prompt an adjustment to the anti-cheating processing policy associated with the risk control detection model.

[0252] The specific functional implementation of the result recording module 114, the monitoring module 115 and the adjustment prompt module 116 can be found in Figure 8 The specific description in the corresponding embodiment will not be repeated here.

[0253] Further, see Figure 10 , Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 10 As shown above Figure 9 The data processing device 1 in the corresponding embodiment can be applied to the above-mentioned computer device 1000, and the above-mentioned computer device 1000 may include: a processor 1001, a network interface 1004 and a memory 1005. In addition, the above-mentioned computer device 1000 also includes: a user interface 1003, and at least one communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. Among them, the user interface 1003 may include a display screen (Display), a keyboard (Keyboard), and the user interface 1003 may optionally include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk memory. The memory 1005 may optionally also be at least one storage device located away from the aforementioned processor 1001. As Figure 10 As shown, the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a device control application.

[0254] exist Figure 10 In the computer device 1000 shown, the network interface 1004 can provide network communication functions; the user interface 1003 is mainly used to provide an interface for user input; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve:

[0255] Obtain the business request initiated by the target user, and use the decision engine to obtain the risk control detection model associated with the business request from the model library in the model deployment platform;

[0256] Obtain the target business attribute data corresponding to the business request, obtain the user social group of the target user, and use the target business attribute data and the associated business attribute data of the associated users in the user social group as attribute nodes to construct an attribute isomorphic graph and an attribute heterogeneous graph respectively;

[0257] The risk control detection model performs community discovery on the attribute isomorphism graph to obtain attribute labels for business requests.

[0258] The risk control detection model samples node sequences of attribute homogeneous graphs and attribute heterogeneous graphs respectively. Based on the sampled attribute node sequences, the graph association feature vectors of the attribute nodes corresponding to the target business attribute data are generated.

[0259] The risk control detection model performs risk prediction processing on the attribute labels, graph-related feature vectors, and behavioral characteristics corresponding to the target business attribute data to obtain the target risk prediction results;

[0260] The decision engine performs anti-fraud processing on business requests in association with target risk prediction results.

[0261] It should be understood that the computer device 1000 described in the embodiments of the present application can execute the description of the data processing method in each of the above embodiments, and can also execute the above Figure 9 The description of the data processing device 1 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of adopting the same method will not be repeated here either.

[0262] In addition, it should be noted that: the embodiment of the present application also provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program executed by the data processing device 1 mentioned above. When the processor loads and executes the computer program, it can perform the description of the data processing method described in any of the above embodiments. Therefore, it will not be repeated here. In addition, the description of the beneficial effects of using the same method will not be repeated. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0263] The computer-readable storage medium may be the data processing device provided in any of the aforementioned embodiments or the internal storage unit of the computer device, such as the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device. Furthermore, the computer-readable storage medium may also include both the internal storage unit of the computer device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0264] The above disclosure is only a preferred embodiment of the present application, and certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data processing method, characterized in that: include: Obtain a business request initiated by a target user, and obtain a risk control detection model associated with the business request from the model library in the model deployment platform through the decision engine; Obtain target business attribute data corresponding to the business request, obtain the user social group of the target user, and construct an attribute isomorphic graph and an attribute heterogeneous graph respectively using the target business attribute data and the associated business attribute data of associated users in the user social group as attribute nodes; Performing community discovery processing on the attribute isomorphism graph through the risk control detection model to obtain an attribute label for the business request; Performing node sequence sampling on the attribute isomorphic graph and the attribute heterogeneous graph respectively by the risk control detection model, and generating a graph association feature vector of the attribute node corresponding to the target business attribute data according to the attribute node sequence obtained by the sampling; Performing risk prediction processing on the attribute labels, graph-related feature vectors, and behavioral features corresponding to the target business attribute data through the risk control detection model to obtain a target risk prediction result; The decision engine performs anti-cheating processing on the business request in association with the target risk prediction result.

2. The method according to claim 1, characterized in that The target business attribute data and the associated business attribute data of the associated users in the user social group are used as attribute nodes to construct an attribute isomorphic graph and an attribute heterogeneous graph respectively, including: The target business attribute data and the associated business attribute data of associated users in the user social group are used as attribute nodes; the number of the attribute nodes is at least two; From at least two of the attribute nodes, obtain attribute nodes with the same attribute type as isomorphic attribute nodes; Determining a first edge weight between the isomorphic attribute nodes according to the commonality information between the isomorphic attribute nodes; Constructing an attribute isomorphism graph according to the isomorphic attribute nodes and the first edge weights; According to the connection relationship between two attribute nodes among the at least two attribute nodes, an attribute heterogeneous graph including the at least two attribute nodes is constructed.

3. The method according to claim 1, characterized in that The performing community discovery processing on the attribute isomorphism graph by the risk control detection model to obtain an attribute label for the business request includes: In the risk control detection model, attribute nodes in the attribute isomorphism graph are divided according to the modularity of the attribute isomorphism graph to obtain attribute node communities; Determine the attribute node community to which the attribute node corresponding to the target business attribute data belongs as the target attribute node community; The community attribute label of the target attribute node community is used as the attribute label for the service request.

4. The method according to claim 3, characterized in that In the risk control detection model, attribute nodes in the attribute isomorphism graph are divided according to the modularity of the attribute isomorphism graph to obtain attribute node communities, including: In the risk control detection model, the attribute nodes in the attribute isomorphism graph are divided into initial attribute node communities; The attribute node T in the attribute isomorphism graph i Transfer to the initial attribute node community where the neighbor attribute node is located to obtain a transferred attribute node community; the neighbor node is isomorphic to the attribute node T in the attribute graph i have a connection relationship; i is a positive integer less than or equal to the total number of attribute nodes in the attribute isomorphism graph; Determining a modularity change value based on the initial attribute node community and the transferred attribute node community; If the modularity change value satisfies the community aggregation condition, the transferred attribute node community is used as the reconstructed attribute node to obtain a reconstructed attribute isomorphism graph; If the community structures of the reconstructed attribute isomorphism graph and the attribute isomorphism graph are the same, the transferred attribute node community is used as the attribute node community; If the community structures of the reconstructed attribute isomorphism graph and the attribute isomorphism graph are different, the reconstructed attribute nodes in the reconstructed attribute isomorphism graph continue to be transferred.

5. The method according to claim 1, wherein The step of sampling node sequences of the attribute isomorphic graph and the attribute heterogeneous graph respectively by the risk control detection model, and generating graph association feature vectors corresponding to the attribute nodes corresponding to the target business attribute data according to the attribute node sequences obtained by the sampling, includes: Performing a random walk on the attribute isomorphic graph using the risk control detection model, sampling attribute nodes on the random walk path, and obtaining an isomorphic attribute node sequence; Generating an isomorphic graph feature vector of the attribute node corresponding to the target business attribute data according to the isomorphic attribute node sequence; Performing a random walk on the attribute heterogeneous graph using the risk control detection model, sampling attribute nodes on the random walk path, and obtaining a heterogeneous attribute node sequence; Generating a heterogeneous graph feature vector of the attribute node corresponding to the target business attribute data according to the heterogeneous attribute node sequence; The homogeneous graph feature vector and the heterogeneous graph feature vector are concatenated to obtain a graph-associated feature vector of an attribute node corresponding to the target business attribute data.

6. The method according to claim 1, characterized in that The target risk prediction result includes a target risk value and a target risk type label; the risk prediction processing of the attribute label, the graph association feature vector, and the behavioral characteristics corresponding to the target business attribute data by the risk control detection model to obtain the target risk prediction result includes: Perform feature splicing on the attribute label, the graph-related feature vector, and the behavior feature corresponding to the target business attribute data to obtain a target feature vector; Inputting the target feature vector into the classification layer of the risk control detection model, and determining the risk probability of the target feature vector under each of at least two candidate risk type labels through the classification layer; A target risk value for the business request is generated according to the risk probabilities corresponding to each candidate risk type label, and among the risk probabilities corresponding to each candidate risk type label, the candidate risk type label corresponding to the maximum risk probability is determined as the target risk type label.

7. The method according to claim 6, characterized in that The performing anti-fraud processing on the business request according to the target risk prediction result by the decision engine includes: Obtaining, through the decision engine, an anti-fraud risk control strategy having a mapping relationship with the risk tag; Obtaining a risk control threshold corresponding to the target risk type label according to the anti-fraud risk control strategy; If the target risk value is greater than or equal to the risk control threshold, reject the business request; If the target risk value is less than the risk control threshold, respond to the business request.

8. The method according to claim 1, characterized in that Also includes: Acquire a historical business request sequence associated with the target business attribute data through the risk control detection model; Generate request behavior statistics corresponding to the target service attribute data according to the historical service attribute data of the historical service requests in the historical service request sequence and the historical time period in which the historical service requests are located; A behavior feature corresponding to the target service attribute data is generated based on the request behavior statistical information.

9. The method according to claim 1, characterized in that Also includes: Obtain the risk control model file to be deployed through the model deployment platform; Identifying a model file format of the risk control model file, parsing the risk control model file based on the model file format, and obtaining a risk control detection model corresponding to the risk control model file; In the model deployment platform, in response to a version management operation initiated for the risk control detection model, model version information is allocated to the risk control detection model; In response to a deployment and online operation initiated for the risk control detection model, the risk control detection model is tested to obtain a test service quality; If the test service quality meets the model online conditions, the risk control detection model and the model version information are added to the model library in the model deployment platform.

10. The method according to claim 9, characterized in that The testing of the risk control detection model to obtain the test service quality includes: Obtain offline sample attribute data through the model deployment platform; add risk control tags to the offline sample attribute data; the risk control tags are used to characterize the risk of the offline sample attribute data; Performing offline prediction processing on the risk control detection model service based on the offline sample data to obtain an offline prediction result; The test service quality of the risk control detection model service is evaluated based on the error result between the offline prediction result and the risk control label.

11. The method according to claim 9, characterized in that Also includes: The model deployment platform responds to a traffic configuration operation for the risk control detection model to determine a target user group associated with the risk control detection model; the target user group includes the target user; and the risk control detection model is used to respond to a service request initiated by the target user group; generating a risk control policy for the target user group by a decision engine in response to the risk control policy configuration operation for the target user group; the risk control policy includes a processing type field and an anti-cheating processing policy associated with the processing type field; Mapping at least two risk prediction results of the risk control detection model to the processing type field; Then, performing anti-cheating processing associated with the target risk prediction result on the business request by the decision engine includes: Determine, by the decision engine, a processing type field having a mapping relationship with the target risk prediction result as a target processing type field; Perform anti-cheating processing on the service request according to the anti-cheating processing policy associated with the target processing type field.

12. The method according to claim 9, characterized in that Also includes: Recording the predicted risk prediction results obtained by the risk control detection model in response to the business request initiated by the target user group into the model execution log corresponding to the risk control detection model; Monitoring the risk status of the target user group, and determining a true risk label of the target user group based on the risk status; Generating the risk control strategy quality for the risk control detection model based on the error result between the actual risk label and the predicted risk prediction result in the model execution log; When the quality of the risk control policy does not meet the risk control conditions, a policy adjustment prompt for the risk control detection model is generated; the policy adjustment prompt is used to prompt an adjustment of the anti-cheating processing policy associated with the risk control detection model.

13. A data processing device, characterized in that: include: An acquisition module is used to obtain a business request initiated by a target user and obtain a risk control detection model associated with the business request from a model library in a model deployment platform through a decision engine; The acquisition module is further configured to acquire target business attribute data corresponding to the business request and acquire the user social group of the target user; A graph construction module, configured to construct an attribute isomorphic graph and an attribute heterogeneous graph respectively using the target business attribute data and the associated business attribute data of associated users in the user social group as attribute nodes; The label determination module is used to perform community discovery processing on the attribute isomorphism graph through the risk control detection model to obtain attribute labels for business requests; A graph vector determination module is configured to perform node sequence sampling on the attribute isomorphic graph and the attribute heterogeneous graph respectively using the risk control detection model, and generate a graph association feature vector of the attribute node corresponding to the target business attribute data based on the attribute node sequence obtained by the sampling; A risk determination module is configured to perform risk prediction processing on the attribute labels, graph association feature vectors, and behavioral features corresponding to the target business attribute data using the risk control detection model to obtain a target risk prediction result; An anti-cheating module is configured to perform anti-cheating processing associated with the target risk prediction result on the business request through the decision engine.

14. A computer device, characterized in that: include: processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide a network communication function, the memory is used to store program code, and the processor is used to call the program code to execute the method according to any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which is suitable for being loaded by a processor and executing the method according to any one of claims 1 to 12.

Images