Resource transfer information detection method, apparatus, device, and storage medium

Abstract

The application relates to the technical field of Internet, and provides a resource transfer information detection method, device and equipment, a storage medium and a computer program product, which can improve the identification efficiency of a resource transfer path, and comprises the following steps: in the process of searching a resource transfer path for a resource transfer relationship graph, determining a current search node, a reference node in a current resource transfer path pointing to the current search node, and a candidate node pointed to by the current search node in the resource transfer relationship graph; obtaining a resource transfer time difference between a first resource transfer time between the current search node and the reference node and a second resource transfer time between the current search node and the candidate node; when the resource transfer time difference meets a time difference condition, adding the candidate node to the current resource transfer path to obtain a target resource transfer path; the time difference condition is a time difference condition that a target resource flows from the reference node to the current search node and the candidate node in sequence.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a method, apparatus, computer equipment, storage medium, and computer program product for detecting resource transfer information. Background Technology

[0002] With the development of internet technology, online payment platforms have emerged, allowing users to transfer funds and other resources online, greatly improving transaction efficiency and reducing transaction costs.

[0003] In many cases, it is necessary to detect resource transfer information, such as detecting transfers of resources from uncertified sources. Currently, this detection is mainly done manually, resulting in low efficiency. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, storage medium, and computer program product for detecting resource transfer information to address the aforementioned technical problems.

[0005] A method for detecting resource transfer information, the method comprising:

[0006] Obtain a set of resource transfer identifiers to be detected for malicious activity; the set of resource transfer identifiers includes multiple resource transfer identifiers.

[0007] Obtain the resource transfer identifier pair corresponding to the resource transfer identifier set, and determine the resource transfer direction corresponding to the resource transfer identifier pair; the resource transfer identifier pair is composed of resource transfer identifiers in the resource transfer identifier set that have a resource transfer relationship;

[0008] Using the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer relationship graph, and connecting the nodes corresponding to the resource transfer identifiers with directed edges according to the resource transfer direction, the resource transfer relationship graph is obtained.

[0009] During the process of searching for resource transfer paths in the resource transfer relationship graph, the current search node in the current searched resource transfer path is determined, the node in the current resource transfer path that points to the current search node is taken as the reference node, and the node in the resource transfer relationship graph that the current search node points to is taken as the candidate node.

[0010] Determine the first resource transfer time between the current search node and the reference node, and the second resource transfer time between the current search node and the candidate node;

[0011] The resource transfer time difference between the first resource transfer time and the second resource transfer time is determined. When the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path to obtain the target resource transfer path. The time difference condition is the time difference condition of the target resource flowing from the reference node to the current search node and the candidate node in sequence.

[0012] A resource transfer information detection device, the device comprising:

[0013] The identifier set acquisition module is used to acquire a set of resource transfer identifiers to be maliciously detected; the resource transfer identifier set includes multiple resource transfer identifiers.

[0014] The transfer direction determination module is used to obtain resource transfer identifier pairs corresponding to the resource transfer identifier set and determine the resource transfer direction corresponding to the resource transfer identifier pairs; the resource transfer identifier pairs are composed of resource transfer identifiers in the resource transfer identifier set that have resource transfer relationships.

[0015] The relationship graph acquisition module is used to take the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer relationship graph, and connect the nodes corresponding to the resource transfer identifiers with directed edges according to the resource transfer direction to obtain the resource transfer relationship graph;

[0016] The node determination module is used to determine the current search node in the current resource transfer path during the process of searching the resource transfer relationship graph, and to take the node pointing to the current search node in the current resource transfer path as the reference node and the node pointed to by the current search node in the resource transfer relationship graph as the candidate node.

[0017] The time determination module is used to determine the first resource transfer time between the current search node and the reference node, and the second resource transfer time between the current search node and the candidate node;

[0018] The node adding module is used to determine the resource transfer time difference between the first resource transfer time and the second resource transfer time. When the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path to obtain the target resource transfer path. The time difference condition is the time difference condition of the target resource flowing from the reference node to the current search node and the candidate node in sequence.

[0019] In some embodiments, the time determination module is further configured to: obtain a set of resource transfer records between the current search node and the reference node; the set of resource transfer records includes multiple resource transfer records; obtain the resource transfer time and resource transfer value in each of the resource transfer records; determine the time weight corresponding to the resource transfer time based on the resource transfer value; the time weight is positively correlated with the resource transfer value; and perform a weighted calculation on the resource transfer times in the set of resource transfer records based on the time weight corresponding to the resource transfer time to obtain a first resource transfer time between the current search node and the reference node.

[0020] In some embodiments, the time determination module is further configured to: sum the resource transfer values ​​in the resource transfer record set to obtain resource transfer statistics; calculate the proportion of the resource transfer values ​​in the resource transfer statistics, and use the proportion as the time weight corresponding to the resource transfer time.

[0021] In some embodiments, the first resource transfer time is the first tail resource transfer time from the reference node to the current search node, and the second resource transfer time is the second head resource transfer time from the current search node to the candidate node; the device further includes a time difference processing module, configured to: determine a time sequence indication value between the first resource transfer time and the second resource transfer time; obtain a time difference range corresponding to the time sequence indication value; and determine that the resource transfer time difference satisfies a time difference condition when the resource transfer time difference is within the time difference range.

[0022] In some embodiments, the node adding module is further configured to: when the time sequence indicator value indicates that the first resource transfer time is later than the second resource transfer time, obtain a first time difference between the first resource transfer time and the second resource transfer time; obtain a first initial resource transfer time between the reference node and the current search node, and obtain a second final resource transfer time between the current search node and the candidate node; obtain a second time difference between the second final resource transfer time and the first initial resource transfer time; calculate the time ratio between the first time difference and the second time difference as the resource transfer time difference between the first resource transfer time and the second resource transfer time; wherein the time difference range is less than or equal to a time ratio threshold.

[0023] In some embodiments, the node adding module is further configured to: when the time sequence indicator value indicates that the first resource transfer time is earlier than the second resource transfer time, obtain a first time difference between the first resource transfer time and the second resource transfer time; use the first time difference as the resource transfer time difference between the first resource transfer time and the second resource transfer time; the time difference range is less than or equal to a time difference threshold.

[0024] In some embodiments, the node adding module is further configured to: obtain a first amount of transferred resources from the reference node to the current search node, and a second amount of transferred resources from the current search node to the candidate node; when the resource transfer time difference meets the time difference condition, and it is determined that the amount of resources between the first amount of transferred resources and the second amount of transferred resources is less than the difference amount, add the candidate node to the current resource transfer path to obtain the target resource transfer path.

[0025] In some embodiments, the node adding module is further configured to: calculate the resource ratio between the first transferred resource amount and the second transferred resource amount; when it is determined that the resource ratio is greater than a first threshold and less than a second threshold, determine that the resource amount between the first transferred resource amount and the second transferred resource amount is less than the difference amount; the first threshold is less than 1, and the second threshold is greater than 1.

[0026] In some embodiments, the node adding module is further configured to: when the resource transfer time difference meets the time difference condition, obtain the path attribute identifier corresponding to the stored candidate node; the path attribute identifier is added when it is determined that the candidate node has a sub-path in the resource transfer path obtained by searching the resource transfer relationship graph; obtain the sub-path based on the path attribute identifier, and sequentially concatenate the candidate node and the sub-path to the current resource transfer path to obtain the target resource transfer path.

[0027] In some embodiments, the node determination module is configured to: select a node that satisfies a preset starting node condition from the nodes included in the resource transfer relationship graph as the starting node of the current resource transfer path; the preset starting node condition includes at least one of the following conditions: the in-degree of the node is less than or equal to an in-degree threshold, or the ratio of the total amount of resources transferred into the node to the total amount of resources transferred out of the node is less than a preset ratio; if the amount of resources transferred from the starting node to the node pointed to by the starting node is greater than or equal to a resource transfer amount threshold, then the current resource transfer path is formed based on the starting node and the node pointed to by the starting node, and the node pointed to by the starting node is selected as the current search node.

[0028] A computer device includes a memory and a processor, the memory storing a computer program and the processor performing the above-described method.

[0029] A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor using the methods described above.

[0030] A computer program product includes a computer program that, when executed by a processor, implements the above-described method.

[0031] The aforementioned resource transfer information detection method, apparatus, computer equipment, storage medium, and computer program product acquire a set of resource transfer identifiers to be maliciously detected; the resource transfer identifier set includes multiple resource transfer identifiers; acquire resource transfer identifier pairs corresponding to the resource transfer identifier set, and determine the resource transfer direction corresponding to the resource transfer identifier pair; the resource transfer identifier pair consists of resource transfer identifiers in the resource transfer identifier set that have a resource transfer relationship; use the resource transfer identifiers in the resource transfer identifier set as nodes in a resource transfer relationship graph, and connect the nodes corresponding to the resource transfer identifier pairs with directed edges according to the resource transfer direction to obtain the resource transfer relationship graph; during the process of searching for resource transfer paths in the resource transfer relationship graph, determine... The current search node in the current resource transfer path is used as the reference node, and the node pointed to by the current search node in the resource transfer relationship graph is used as the candidate node. The first resource transfer time between the current search node and the reference node, and the second resource transfer time between the current search node and the candidate node are determined. The resource transfer time difference between the first resource transfer time and the second resource transfer time is determined. When the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path to obtain the target resource transfer path. The time difference condition is the time difference condition for the target resource to flow from the reference node to the current search node and the candidate node in sequence. In this application, by determining the nodes connected by directed edges based on whether there is a resource transfer relationship between resource transfer identifiers, the obtained resource transfer relationship graph accurately reflects the resource transfer situation between resource transfer identifiers. This is beneficial for accurately identifying the transfer path of uncertified resources from massive resource transfers, thus improving path identification efficiency. In addition, during the resource transfer path search in the resource transfer relationship graph, if the time difference between the first resource transfer time between the current search node and the reference node and the second resource transfer time between the current search node and the candidate node meets the time difference condition, the candidate node is added to the current resource transfer path. This indicates that the target resource flows from the reference node to the current node and the candidate node in chronological order. Therefore, the target resource transfer path obtained based on the current resource transfer path improves the path identification accuracy. Attached Figure Description

[0032] Figure 1 This is a diagram illustrating the application environment of the resource transfer information detection method in some embodiments;

[0033] Figure 2 This is a flowchart illustrating the resource transfer information detection method in some embodiments;

[0034] Figure 3(a) is a resource transfer relationship diagram in some embodiments;

[0035] Figure 3(b) is a schematic diagram of resource transfer path search of resource transfer relationship graph in some embodiments;

[0036] Figure 3(c) is a resource transfer relationship diagram in some embodiments;

[0037] Figure 4 This is a schematic diagram illustrating the determination of net resources transferred out between nodes and the time corresponding to the net resources transferred out in some embodiments;

[0038] Figure 5 This is a schematic diagram illustrating the determination of net resources transferred out between nodes and the time corresponding to the net resources transferred out in some embodiments;

[0039] Figure 6(a) is a schematic diagram of the time sequence corresponding to the net transfer-out resources between nodes in some embodiments;

[0040] Figure 6(b) is a schematic diagram of the time sequence corresponding to the net transfer-out of resources between nodes in some embodiments;

[0041] Figure 7 This is a one-way graph of net resource transfer between multiple nodes in some embodiments;

[0042] Figure 8 This is a flowchart illustrating the resource transfer information detection method in some embodiments;

[0043] Figure 9 This is a structural block diagram of the resource transfer information detection device in some embodiments;

[0044] Figure 10 This is a diagram showing the internal structure of a computer device in some embodiments. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0046] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least some of the embodiments of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0047] The resource transfer information detection method provided in this application involves multiple resource transfer identifiers (hereinafter referred to as identifiers) with resource transfer relationships. Based on the resource source of one identifier, the method can trace the destination of the corresponding resource, thereby identifying the transfer path of resources with unapproved sources, such as the transfer path of illegal funds with unapproved sources or the transfer path of game equipment with unapproved sources. In some scenarios, the transfer path of game equipment with unapproved sources can be understood as the transfer path of illegal game equipment that may not have been generated by the official game platform but privately generated by illegal players and has not yet been certified by the game platform. When the resource is funds, it can be a transfer path that determines the source of funds as illegal, such as a path where illegal funds are transformed into legitimate funds through a series of transfer operations.

[0048] like Figure 1 As shown, resource transfer can be performed between identifier a and identifier b via server 104. For example, if identifier a wants to transfer resources to identifier b, identifier a can first send the quantity of resources to be transferred and the identifier information of identifier b to server 104. After receiving the quantity of resources sent by identifier a and the identifier information of identifier b, server 104 allocates the aforementioned quantity of resources from the resources owned by identifier a to identifier b, thus completing the resource transfer operation from identifier a to identifier b. Server 104 stores resource transfer records between various resource transfer identifiers. When malicious detection of resource transfer is required, such as detecting the transfer path of a large amount of resources from an uncertified source, the resource transfer records can be obtained. Based on the resource transfer records, a set of resource transfer identifiers to be maliciously detected can be obtained to execute the resource transfer information detection method provided in this application embodiment, obtain the target resource transfer path, and server 104 can further confirm whether the target resource transfer path is a malicious resource transfer path based on the target resource transfer path, for example, by predicting the probability that the path is a transfer path of resources from an uncertified source based on information such as resource transfer behavior in the target resource transfer path and a pre-trained resource transfer path detection model. The server can also send the detected target resource transfer path to the terminal 102, so that the user corresponding to the terminal 102 can perform manual confirmation based on the target resource transfer path.

[0049] Identifiers include, but are not limited to, personal identifiers, merchant identifiers, and bank card identifiers. Identifier A and Identifier B can be owned by the same user; that is, a single user can own multiple identifiers. For example, Alice may own multiple personal identifiers, or Alice may own both personal and merchant identifiers. Users can perform resource transfer operations through terminals, which can be personal computers, laptops, smartphones, tablets, and portable wearable devices. Servers can be implemented using independent servers or server clusters composed of multiple servers.

[0050] In some embodiments, such as Figure 2 As shown, a method for detecting resource transfer information is provided, which can be applied to... Figure 1 Taking the server in the example, the following steps are included:

[0051] Step S202: Obtain the set of resource transfer identifiers to be detected for malicious activity.

[0052] The resource transfer identifier set includes multiple resource transfer identifiers; resource transfer identifiers can also be referred to as accounts, such as personal accounts. Identifiers can be divided into personal identifiers, merchant identifiers, and bank card identifiers, etc. The resource transfer identifier set can include at least one type of identifier, that is, the resource transfer identifier set includes at least one type of identifier among personal identifiers, merchant identifiers, and bank card identifiers; a user can have multiple identifiers, and these identifiers can be of the same or different types.

[0053] Malicious detection mainly refers to searching for the transfer paths of resources with unverified sources, such as illicit funds. For example, it can be used to detect money laundering paths of accounts. In the target resource transfer paths obtained by malicious detection, for nodes at different positions on the target resource transfer path, the target resource transfer path has characteristics that correspond to the position of the node: for example, from the perspective of the starting node in the target resource transfer path, the target resource transfer path can be called the transfer-out path of resources with unverified sources; and from the perspective of the ending node in the target resource transfer path, the target resource transfer path can be called the transfer-in path of resources with unverified sources.

[0054] In this step, the server can obtain multiple resource transfer identifiers and form a resource transfer identifier set to perform malicious detection and search for transfer paths of resources with uncertified origins.

[0055] Step S204: Obtain the resource transfer identifier pairs corresponding to the resource transfer identifier set, and determine the resource transfer direction corresponding to the resource transfer identifier pairs.

[0056] Among them, a resource transfer identifier pair is composed of resource transfer identifiers that have a resource transfer relationship in the resource transfer identifier set. A resource transfer identifier pair includes two identifiers. For example, if identifier a has transferred resources to identifier b, then it can be considered that there is a resource transfer relationship between identifier a and identifier b, and identifier a and identifier b are combined into a resource identifier pair.

[0057] In some scenarios, resource transfer identifier pairs can also consist of resource identifiers that have a resource transfer relationship within a preset time period. For example, if the preset time period is from February 1, 2021 to July 10, 2021, and identifier a transferred resources to identifier b on March 10, 2021, since the time when identifier a transferred resources to identifier b was March 10, 2021, which is within the preset time period, then identifier a and identifier b can be combined into a resource identifier pair.

[0058] The direction of resource transfer refers to the flow of resources between the two identifiers that make up a resource transfer identifier pair. It can be a net resource transfer direction. From the perspective of different identifiers, this net resource transfer direction can be called a net resource outflow direction or a net resource inflow direction. For example, if identifier a transfers a total of 30,000 resources to identifier b, and identifier b transfers a total of 20,000 resources to identifier a, then the net resource transfer direction between these two identifiers is from identifier a to identifier b, and the net resource transfer amount is 30,000 - 20,000 = 10,000. From the perspective of identifier a, this net resource transfer direction can be called a net resource outflow direction, and from the perspective of identifier b, this net resource transfer direction can be called a net resource inflow direction.

[0059] The net resource transfer direction is determined based on multiple actual resource transfers that occur between the two identifiers that make up the resource transfer identifier pair. For example, if identifier a transfers 5 resources to identifier b with a total resource quantity of 30,000, and identifier b transfers 2 resources to identifier a with a total resource quantity of 20,000, then based on these 7 resource transfers that occur between identifier a and identifier b, the net resource transfer direction between these two identifiers can be determined to be from identifier a to identifier b.

[0060] In this step, after the server obtains identifiers a to k, it can retrieve resource transfer records between these identifiers. Each resource transfer record refers to the record of each actual resource transfer, and each resource transfer record includes at least the resource amount corresponding to each actual resource transfer. Based on multiple resource transfer records between identifiers, the server determines the net direction of resource transfer between identifiers; for example... Figure 4 As shown, there are 5 resource transfers between identifier b and identifier d. These 5 resource transfers are as follows: the amount of resources transferred from identifier b to identifier d is m. v1 The amount of resources transferred from identifier b to identifier d is m. v2 The amount of resources transferred from identifier d to identifier b is m. v3The amount of resources transferred from identifier b to identifier d is m. v4 The amount of resources transferred from identifier d to identifier b is m. v5 The server determines the resource transfer direction between identifier b and identifier d by offsetting and adding the corresponding resource amounts of these five resource transfers. The net resource transfer amount from identifier b to identifier d is denoted as M(b,d). Similarly, as... Figure 5 As shown, the server can determine that the resource transfer direction between identifiers d and f is from identifier d to identifier f, and the net amount of resources transferred from identifier d to identifier f is denoted as M(d,f).

[0061] Step S206: Use the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer relationship graph, and connect the nodes corresponding to the resource transfer identifiers with directed edges according to the resource transfer direction to obtain the resource transfer relationship graph.

[0062] Among them, the directed edges are unidirectional edges, and the corresponding resource transfer relationship graph can be called a net resource transfer unidirectional graph.

[0063] In this step, after the server determines the net resource transfer direction between two identifiers a to k that have a resource transfer relationship, it can use the identifier as a node and connect the nodes with a one-way edge according to the resource transfer direction. For example, if the resource transfer direction between identifier b and identifier d is from identifier b to identifier d, then a one-way edge pointing from identifier b to identifier d can be used to connect these two identifiers. Similarly, for other two identifiers that have a resource transfer relationship, a one-way edge can be connected in the same way to obtain the one-way graph of net resource transfer shown in Figure 3(a).

[0064] Step S208: During the process of searching for resource transfer paths in the resource transfer relationship graph, determine the current search node in the current resource transfer path, take the node in the current resource transfer path that points to the current search node as the reference node, and take the node in the resource transfer relationship graph that the current search node points to as the candidate node.

[0065] The resource transfer path search can be a depth-first search rather than a breadth-first search; Figure 3(a) illustrates the depth-first search rather than the breadth-first search:

[0066] (1) In a path depth-first search over a path breadth-first search, if the currently found node is identifier f, and the identifiers pointed to by identifier f include identifier c and identifier h, then select one of identifiers c and h as the found node; if the selected identifier is identifier c, then determine one of the identifiers pointed to by identifier c as the found identifier, that is, find identifier j; then, determine one of the identifiers pointed to by identifier j as the found identifier, that is, find identifier k; in this search method, if the currently found node f points to node c, and node c points to node j, then continue to determine the node k pointed to by node j, until the end condition of the path depth search is reached. It can be seen that before reaching this end condition, the level depth of the found node shows an increasing trend. This path search can be called a path depth-first search over a path breadth-first search.

[0067] (2) In a path breadth-first search over path depth search, if the currently found node is identifier f, and the identifiers pointed to by identifier f include identifier c and identifier h, then select one of identifiers c and h as the found node; if the selected identifier is identifier c, then determine one of the identifiers pointed to by identifier c as the found identifier, that is, find identifier j; then, take the other identifier h pointed to by identifier f as the found node, and determine one of the identifiers pointed to by identifier h as the found identifier, that is, find identifier g; in this search method, first determine the nodes pointed to by all nodes at the same level, then enter the next level, and determine the nodes pointed to by all nodes at the next level. The path breadth is the main factor, and this path search is called a path breadth-first search over path depth search.

[0068] The current resource transfer path is the path formed by connecting nodes through unidirectional edges based on a depth-first search, and it is the resource transfer path currently being searched. The currently searched node can be called the current search node or the current node. The reference node is the node in the current resource transfer path that points to the current node; the candidate node is the node in the current resource transfer path that the current node points to.

[0069] For example, after the server obtains the net resource transfer unidirectional graph shown in Figure 3(a), it can perform a resource transfer path search on the net resource transfer unidirectional graph in a path depth-first manner. If the currently searched resource transfer path is a->b->d and the currently searched node is d, then the node b that points to node d on the current resource transfer path a->b->d can be taken as a reference node, and the node f that node d points to can be taken as a candidate node. The following steps are used to determine whether node f can be added to the current resource transfer path, as shown in Figure 3(b).

[0070] Step S210: Determine the first resource transfer time between the current search node and the reference node, and the second resource transfer time between the current search node and the candidate node.

[0071] The first resource transfer time is determined by considering the occurrence times of multiple actual resource transfers between the current search node and the reference node, and is used to characterize the time corresponding to the net resource transfer amount between the current search node and the reference node. The second resource transfer time is determined by considering the occurrence times of multiple actual resource transfers between the current search node and the candidate node, and is used to characterize the time corresponding to the net resource transfer amount between the current search node and the candidate node.

[0072] Taking the determination of the first resource transfer time as an example, we will introduce some possible methods:

[0073] If the identifier corresponding to the current search node is d, and the identifier corresponding to the reference node is b, then... Figure 4 As shown, there are 5 resource transfers between identifier b and identifier d. These 5 resource transfers are as follows: in t v1 At time t, the amount of resources transferred from identifier b to identifier d is m. v1 、 in t v2 At time t, the amount of resources transferred from identifier b to identifier d is m. v2 、 in t v3 At time t, the amount of resources transferred from identifier d to identifier b is m. v3 、 in t v4 At time t, the amount of resources transferred from identifier b to identifier d is m. v4 and in t v5 At time t, the amount of resources transferred from identifier d to identifier b is m. v5 The server can t v1 t v2 t v3 t v4 and t v5 The average value is taken as the first resource transfer time, which can be denoted as T(b,d).

[0074] Similarly, the second resource transfer time can be determined in the same way as described above, which will not be repeated here.

[0075] Step S212: Determine the resource transfer time difference between the first resource transfer time and the second resource transfer time. When the resource transfer time difference meets the time difference condition, add the candidate node to the current resource transfer path to obtain the target resource transfer path.

[0076] The resource transfer time difference refers to the difference between the transfer times of two resources, which can be represented by a difference or a ratio. The time difference condition is the time difference between the target resource flowing sequentially from the reference node to the current search node and then to the candidate node; the target resource can be a resource with an unauthenticated source. The greater the difference between the first and second resource transfer times, the more obvious the time sequence of the net resource transfer between the current search node and the reference node, and the more likely the target resource is to flow sequentially from the reference node to the current search node and then to the candidate node. That is, the reference node may be the source node of the target resource for the current search node, and the candidate node may be the destination node of the target resource for the current search node. It can be understood that there can be multiple target resource transfer paths, and each target resource transfer path is a path obtained by searching based on the current resource transfer path. The target resource transfer path is used for malicious resource transfer detection. By executing the method of this application embodiment, one or more target resource transfer paths can be obtained from the resource transfer relationship graph.

[0077] For example, if the current search node is d, the reference node is b, and the candidate node is f, after the server obtains the first resource transfer time T(b,d) between the current search node and the reference node, and the second resource transfer time T(d,f) between the current search node and the candidate node, if the first resource transfer time T(b,d) is earlier than the second resource transfer time T(d,f), it can be determined that the resource transfer time difference between the first and second resource transfer times meets the time difference condition, and node f is added to the current resource transfer path a->b->d, the current resource transfer path is updated, and the resulting resource transfer path is a->b->d->f; then, the server can use node f as the currently searched node, node d as the reference node, and node c or h pointed to by node f as the candidate node, and execute steps S210 to S212 to determine whether to add node c or h pointed to by node f to the resource transfer path a->b->d->f; wherein, the above path depth-first search can continue, and the path depth-first search can be stopped when any of the following termination conditions are met:

[0078] ① The length of the resource transfer path obtained from the current search has reached the preset maximum length;

[0079] ②The out-degree of the current node is 0;

[0080] ③ The current node points to no node that can be added to the resource transfer path obtained in the current search.

[0081] In the aforementioned resource transfer information detection method, by determining the nodes connected by directed edges based on whether there is a resource transfer relationship between resource transfer identifiers, the obtained resource transfer relationship graph accurately reflects the resource transfer situation between resource transfer identifiers. This is beneficial for accurately identifying the transfer path of unauthenticated resources from massive user resource transfers, thus improving path identification efficiency. In addition, during the resource transfer path search process in the resource transfer relationship graph, if the time difference between the first resource transfer time between the current search node and the reference node and the second resource transfer time between the current search node and the candidate node meets the time difference condition, the candidate node is added to the current resource transfer path. This indicates that the target resource flows from the reference node to the current node and the candidate node in chronological order. Therefore, the target resource transfer path obtained based on the current resource transfer path improves the path identification accuracy.

[0082] In some embodiments, during the resource transfer path search, the starting node can be used as an identifier to record whether a certain node in the path search from that starting node has been visited. If it has been visited, it indicates that a node cycle has been encountered, and the search can be terminated. Referring to Figure 3(c), nodes y3, y5, and y4 in Figure 3(c) encounter a node cycle and terminate when the resource transfer path y1->y2->y3->y5->y4 is obtained. Similarly, when the resource transfer path y1->y2->y5->y4->y3 is obtained, a node cycle is encountered and terminated, thus avoiding infinite loop access and wasting computational resources.

[0083] In some embodiments, the first resource transfer time between the current search node and the reference node can also be determined by: obtaining a set of resource transfer records between the current search node and the reference node; obtaining the resource transfer time and resource transfer value in each resource transfer record; determining the time weight corresponding to the resource transfer time based on the resource transfer value; the time weight is positively correlated with the resource transfer value; and performing a weighted calculation on the resource transfer times in the set of resource transfer records based on the time weight corresponding to the resource transfer time to obtain the first resource transfer time between the current search node and the reference node.

[0084] The resource transfer record set includes multiple resource transfer records. Each resource transfer record corresponds to an actual resource transfer between the current search node and the reference node. Each resource transfer record can include the resource transfer value and the resource transfer time of each actual resource transfer. The resource transfer value of each actual resource transfer refers to the actual amount of resource transferred, also known as the resource transfer quantity. The resource transfer time corresponding to each actual resource transfer refers to the time when each actual resource transfer occurred, such as the occurrence time t of the actual resource transfer between identifiers b and d.v1 t v2 t v3 t v4 and t v5 .

[0085] The weight assigned to the occurrence time of each actual resource transfer is positively correlated with the actual amount of resource transfer corresponding to each transfer. For example, for the occurrence time t of each actual resource transfer between identifiers b and d... v1 t v2 t v3 t v4 and t v5 If the resource transfer amounts corresponding to each actual resource transfer are sorted from largest to smallest as follows: m v1 m v4 m v3 m v2 m v5 Based on the aforementioned positive correlation, let t be the time t of each actual resource transfer. v1 t v2 t v3 t v4 and t v5 The weights assigned, sorted from largest to smallest, are w. v1 w v4 w v3 w v2 w v5 .

[0086] Specifically, after obtaining the weights corresponding to the occurrence times of each actual resource transfer, the server can perform a weighted calculation on the occurrence times of each actual resource transfer, i.e., w. v1 ×t v1 +w v2 ×t v2 +w v3 ×t v3 +w v4 ×t v4 +w v5 ×t v5 The weighted calculation result is used as the first resource transfer time between the current search node and the reference node.

[0087] In the above method, based on the positive correlation between the resource transfer value of each actual resource transfer and the occurrence time of each actual resource transfer, the weight assigned to the occurrence time of each actual resource transfer is determined and weighted calculation is performed. This makes the first resource transfer time more focused on reflecting the occurrence time of the larger resource transfer among multiple resource transfers between the current search node and the reference node, thereby improving the search accuracy of the target resource transfer path.

[0088] In some embodiments, determining the time weight corresponding to the resource transfer time based on the resource transfer value includes: summing the resource transfer values ​​in the resource transfer record set to obtain the resource transfer statistics; calculating the proportion of the resource transfer value in the resource transfer statistics, and using the proportion as the time weight corresponding to the resource transfer time.

[0089] Resource statistics refer to the sum of the resource transfer amounts corresponding to each actual resource transfer between the current search node and the reference node, which can also be called the total resource transfer amount.

[0090] The above embodiment will still be described with the current search node as d and the reference node as b: Figure 4 As shown, the resource transfer amount corresponding to each actual resource transfer between identifiers b and d is m. v1 m v2 m v3 m v4 m v5 The server can m v1 +m v2 +m v3 +m v4 +m v5 The result is used as the resource statistics value. Next, the server can calculate the proportion of the resource transfer amount corresponding to each actual resource transfer in the resource statistics value: m v1 / (m v1 +m v2 +m v3 +m v4 +m v5 ), m v2 / (m v1 +m v2 +m v3 +m v4 +m v5 ), m v3 / (m v1 +m v2 +m v3 +m v4 +m v5 ), m v4 / (m v1 +m v2 +m v3 +m v4 +m v5 ), m v5 / (m v1 +m v2 +m v3 +m v4 +m v5 ); and these proportions are then assigned to t in sequence. v1 t v2 t v3 tv4 and t v5 weight w v1 w v2 w v3 w v4 w v5 .

[0091] In the above method, the proportion of each actual resource transfer in the total resource transfer is used as the weight assigned to the occurrence time of each actual resource transfer. This makes the first resource transfer time more focused on reflecting the occurrence time of the larger resource transfer among the multiple resource transfers between the current search node and the reference node, thereby further improving the search accuracy of the target resource transfer path.

[0092] It should be noted that the above-described method for handling the first resource transfer time between the reference node and the current search node can be applied to handling the second resource transfer time between the current search node and the candidate node, which will not be elaborated here.

[0093] In some embodiments, the step of determining that the resource transfer time difference meets the time difference condition includes: determining a time sequence indication value between the first resource transfer time and the second resource transfer time; obtaining the time difference range corresponding to the time sequence indication value; and determining that the resource transfer time difference meets the time difference condition when the resource transfer time difference is within the time difference range.

[0094] The first resource transfer time is the first tail resource transfer time from the reference node to the current search node. For example, if the current search node is d and the reference node is b, then... Figure 4 As shown, there are 5 actual resource transfers between node b and node d, and 2 of these 5 actual resource transfers are from node b to node d. The last of these 2 actual resource transfers occurs at time t. v4 At this point, t can be used v4 As the first time for resource transfer.

[0095] The second resource transfer time is the second resource transfer time from the current search node to the candidate node. For example, if the current search node is d and the candidate node is f, then... Figure 5 As shown, three actual resource transfers occur between node d and node f, and two of these transfers involve resources transferred from node d to node f. The first of these two transfers occurs at time t. v6 At this point, t can be used v6 This serves as the second resource transfer time.

[0096] The time sequence indicator value is used to characterize the order of the first resource transfer time and the second resource transfer time. The time difference range corresponding to the time sequence indicator value when the first resource transfer time is earlier than the second resource transfer time is different from the time difference range corresponding to the time sequence indicator value when the first resource transfer time is later than the second resource transfer time. For example, when the time sequence indicator value when the first resource transfer time is earlier than the second resource transfer time is less than 0, the time difference range corresponding to the time sequence indicator value when the first resource transfer time is later than the second resource transfer time is greater than 0 and less than 1.

[0097] Specifically, the server uses the time of the last actual resource transfer among multiple actual resource transfers from the reference node to the current search node as the first resource transfer time, and the time of the first actual resource transfer among multiple actual resource transfers from the current search node to the candidate node as the second resource transfer time. Based on the chronological order of the first and second resource transfer times, a corresponding time sequence indication value is obtained, resulting in a corresponding time difference range. The server then determines whether the resource transfer time difference between the first and second resource transfer times falls within this time difference range, thus confirming that the resource transfer time difference meets the time difference condition.

[0098] In the above method, the occurrence time of the last actual resource transfer among multiple actual resource transfers from the reference node to the current search node is taken as the first resource transfer time, and the occurrence time of the first actual resource transfer among multiple actual resource transfers from the current search node to the candidate node is taken as the second resource transfer time. The resulting difference in resource transfer times indicates whether there is an overlap between the occurrence times of multiple actual resource transfers between the reference node and the current search node and the occurrence times of multiple actual resource transfers between the current search node and the candidate node. If there is no overlap, the more obvious the order of the net resource transfers between the reference node and the current search node and the net resource transfers between the current search node and the candidate node, the more accurate the identification of the transfer path of resources from uncertified sources will be.

[0099] In some embodiments, determining the resource transfer time difference between a first resource transfer time and a second resource transfer time includes: when a time sequence indicator value indicates that the first resource transfer time is later than the second resource transfer time, obtaining a first time difference between the first resource transfer time and the second resource transfer time; obtaining a first initial resource transfer time between a reference node and the current search node, and obtaining a second final resource transfer time between the current search node and the candidate node; obtaining a second time difference between the second final resource transfer time and the first initial resource transfer time; calculating the time ratio between the first time difference and the second time difference as the resource transfer time difference between the first resource transfer time and the second resource transfer time; the time difference range is less than or equal to a time ratio threshold.

[0100] The time ratio threshold is determined based on the ratio of two time differences, for example, it can be based on (t... v4 -t v6 ) / (t v4 -t v1 The time ratio threshold is set to 0.5. The first resource transfer time is the time of the first actual resource transfer among multiple actual resource transfers from the reference node to the current search node, and the second resource transfer time is the time of the last actual resource transfer among multiple actual resource transfers from the current search node to the candidate node.

[0101] Taking reference node b, current search node d, and candidate node f as an example, the above steps are explained as follows:

[0102] The first resource transfer time is the time t of the last actual resource transfer among the multiple actual resource transfers from the reference node to the current search node. v4 The first resource transfer time is t. v1 The second resource transfer time is the time t of the first actual resource transfer among multiple actual resource transfers from the current search node to the candidate node. v6 The second tail resource transfer time is t. v8 When t v4 >t v6 When t can be determined v4 Later than t v6 That is, the time sequence indicator value represents t v4 Later than t v6 and t v4 -t v6 As the first time difference; then, the server can use t v8 -t v1 As the second time difference, the time ratio (t) between the first time difference and the second time difference is obtained. v4 -t v6 ) / (t v8-t v1 This time ratio is used as the resource transfer time difference; as shown in Figure 6(a), the time ratio (t) v4 -t v6 ) / (t v8 -t v1 The larger the value of ), the more it indicates the time interval (i.e., t) during which multiple actual resource transfers from the reference node to the current search node occur. v1 To t v4 The time interval (t) between the current search node and the multiple actual resource transfers from the current search node to the candidate node. v6 To t v8 The overlapping time periods between ) (i.e., t) v6 To t v4 ), during the total occurrence period (i.e., t) v1 To t v8 The larger the proportion in the time ratio (t), the lower the significance of the time sequence of net resource transfer from the reference node to the current search node and net resource transfer from the current search node to the candidate node; v4 -t v6 ) / (t v8 -t v1 The smaller the value, the more it indicates the time interval (i.e., t) during which multiple actual resource transfers from the reference node to the current search node occur. v1 To t v4 The time interval (t) between the current search node and the multiple actual resource transfers from the current search node to the candidate node. v6 To t v8 The overlapping time periods between ) (i.e., t) v6 To t v4 ), during the total occurrence period (i.e., t) v1 To t v8 The smaller the proportion in the time ratio (t), the higher the significance of the time sequence of net resource transfer from the reference node to the current search node and net resource transfer from the current search node to the candidate node. If the time ratio threshold is 0.5, then the time difference range is less than or equal to 0.5; if the time ratio (t) v4 -t v6 ) / (t v8 -t v1 If the time ratio is less than or equal to 0.5, it can be determined that the time ratio is within the time difference range and the resource transfer time difference meets the time difference condition, and the candidate node f is added to the current resource transfer path a->b->d.

[0103] In the above method, when the last actual resource transfer in the multiple actual resource transfers from the reference node to the current search node occurs later than the first actual resource transfer in the multiple actual resource transfers from the current search node to the candidate node, the significance of the time sequence of the net resource transfers between node pairs is determined based on the proportion of the overlapping period in the total occurrence period, thereby improving the identification accuracy of the target resource path search.

[0104] In some embodiments, determining the resource transfer time difference between the first resource transfer time and the second resource transfer time includes: when a time sequence indicator value indicates that the first resource transfer time is earlier than the second resource transfer time, obtaining a first time difference between the first resource transfer time and the second resource transfer time; using the first time difference as the resource transfer time difference between the first resource transfer time and the second resource transfer time; the time difference range is less than or equal to a time difference threshold.

[0105] The time difference threshold can be determined based on the difference between the first resource transfer time and the second resource transfer time, and can be set to 0.

[0106] Taking the current search node as d, the reference node as b, and the candidate node as f as an example, the above steps are explained as follows: The first resource transfer time is the time t of the last actual resource transfer among the multiple actual resource transfers from the reference node to the current search node. v4 The second resource transfer time is the time t of the first actual resource transfer among multiple actual resource transfers from the current search node to the candidate node. v6 As shown in Figure 6(b), when t v4 <t v6 When t can be determined v4 Earlier than t v6 That is, the time sequence indicator value represents t v4 Earlier than t v6 and t v4 -t v6 As the first time difference; if the time difference range corresponding to this time sequence indicator value is less than 0, then t v4 -t v6If the first time difference is less than 0, it indicates that there is no overlap between the time periods of the multiple actual resource transfers from reference node b to current search node d (i.e., tv1 to tv4) and the time periods of the multiple actual resource transfers from current search node d to candidate node f (i.e., tv6 to tv8). It also indicates that the higher the significance of the time sequence of the net resource transfer from reference node b to current search node d and the net resource transfer from current search node d to candidate node f, the more certain it is that the resource transfer time difference meets the time difference condition, and candidate node f is added to the current resource transfer path a->b->d.

[0107] In the above method, if the last actual resource transfer in the multiple actual resource transfers from the reference node to the current search node occurs earlier than the first actual resource transfer in the multiple actual resource transfers from the current search node to the candidate node, then the time order of the net resource transfers between the node pairs is more obvious, thus improving the accuracy of identifying transfer paths from uncertified sources.

[0108] In some embodiments, when the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path to obtain the target resource transfer path, including: obtaining the first transfer resource amount transferred from the reference node to the current search node, and the second transfer resource amount transferred from the current search node to the candidate node; when the resource transfer time difference meets the time difference condition, and it is determined that the resource amount between the first transfer resource amount and the second transfer resource amount is less than the difference amount, the candidate node is added to the current resource transfer path to obtain the target resource transfer path.

[0109] Here, the first transferred resource amount refers to the net resource transfer amount from the reference node to the current search node, and the second transferred resource amount refers to the net resource transfer amount from the current search node to the candidate node. The resource amount between the first transferred resource amount and the second transferred resource amount refers to the relative size of the first transferred resource amount and the second transferred resource amount, and the difference can be a preset range.

[0110] The above steps are described with reference node b, current search node d, and candidate node f: the first transfer resource amount is M(b,d), the second transfer resource amount is M(d,f), and when determining that the resource transfer time difference meets the time difference condition using any method described in other embodiments, if the sizes of M(b,d) and M(d,f) are similar, it is considered that the resource amounts of M(b,d) and M(d,f) are less than the difference amount, and candidate node f is added to the current resource transfer path a->b->d.

[0111] In the above method, the difference in resource transfer time and the similarity in the net transfer amount of resources are considered to determine whether to add the candidate node to the current resource transfer path, ensuring that the candidate node is the resource destination node of the current search node, thereby improving the recognition accuracy of the target resource transfer path search.

[0112] In some embodiments, determining that the amount of resources transferred between the first transferred resource amount and the second transferred resource amount is less than the difference includes: calculating the resource ratio between the first transferred resource amount and the second transferred resource amount; when the resource ratio is determined to be greater than a first threshold and less than a second threshold, determining that the amount of resources transferred between the first transferred resource amount and the second transferred resource amount is less than the difference.

[0113] The first threshold and the second threshold are used to measure whether the first transferred resource amount and the second transferred resource amount are similar in size. The first threshold and the second threshold can be values ​​that are close to 1, such as the first threshold being 1.1 and the second threshold being 1.3. The first threshold can be a value that is less than 1 and close to 1, such as 0.8, and the second threshold can be a value that is greater than 1 and close to 1, such as 1.1.

[0114] The degree to which the resource quantity ratio is close to 1 is positively correlated with the degree to which the first and second transferred resource quantities are similar. In other words, the closer the resource quantity ratio is to 1, the closer the first and second transferred resource quantities are.

[0115] The above steps are described with reference node b, current search node d, and candidate node f, and a first threshold of 0.8 and a second threshold of 1.1: The first transfer resource amount is M(b,d), and the second transfer resource amount is M(d,f). When determining that the resource transfer time difference meets the time difference condition using any method described in other embodiments, if the resource amount ratio M(b,d) / M(d,f) is greater than 0.8 and less than 1.1, then M(b,d) and M(d,f) are considered to be similar in size, and the resource amount of M(b,d) and M(d,f) is less than the difference amount. The candidate node f is then added to the current resource transfer path a->b->d.

[0116] In the above method, based on a first threshold less than 1 and a second threshold greater than 1, the similarity of the net transfer amount of resources is determined, and it is determined whether to add the candidate node to the current resource transfer path, so as to ensure that the candidate node is the resource destination node of the current search node and improve the recognition accuracy of the target resource transfer path search.

[0117] In some embodiments, when the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path, including: when the resource transfer time difference meets the time difference condition, obtaining the path attribute identifier corresponding to the stored candidate node; obtaining the sub-path based on the path attribute identifier; and sequentially concatenating the candidate node and the sub-path to the current resource transfer path to obtain the target resource transfer path.

[0118] Path attribute identifiers are added when candidate nodes have sub-paths, based on resource transfer paths obtained from searching the resource transfer relationship graph. A sub-path starts from a candidate node, and the temporal order of the net resource transfer between any intermediate node on the sub-path and its preceding node, and between the intermediate node and its next node, is significantly higher than a threshold (the relevant processing method can refer to the processing between reference nodes, the current search node, and candidate nodes); more specifically, the net resource transfer amounts between the intermediate node and its preceding node, and between the intermediate node and its next node, are similar in magnitude.

[0119] Specifically, the path attribute identifier is added during the historical path search after performing path searches on most or all of the nodes pointed to by the candidate node. Taking node f shown in Figure 3(a) as an example, the nodes pointed to by node f include c and h. If, during the historical path search, it is determined that nodes c, j, and k can also be added to the resource transfer path, and it is determined that nodes h and g cannot be added to the resource transfer path, and the path search on all the nodes pointed to by node f is completed, f->c->j->k can be used as a sub-path, and c->j->k can be stored as the path attribute of node f. Furthermore, an identifier can be assigned to this path attribute, which can be called a path attribute identifier, for subsequent retrieval of the path attribute.

[0120] The starting node of the historical path search can be the same as or different from the starting node of the current path search. The following example illustrates this using a different starting node for the historical path search: When the starting node of the historical path search is 'e', ​​after completing the path search with node 'e' as the starting node, the path to the target resource transfer is determined to include: e->i->f->c->j->k. Since this path search is complete, it indicates that all nodes pointed to by node 'f' have been searched. Therefore, c->j->k can be stored as a path attribute of node 'f' and assigned a corresponding identifier. Next, when the starting node of the current path search is 'a', if the currently searched node is 'f', c->j->k can be obtained based on the path attribute identifier. Nodes 'f' and 'c->j->k' are then concatenated sequentially into the current resource transfer path a->b->d, resulting in a->b->d->f->c->j->k.

[0121] In the above method, since any node may become a key node in multiple resource transfer paths, after traversing the nodes pointed to by any node, the sub-paths starting from that node can be stored as the path attributes of that node. When searching for that node again, there is no need to traverse further; the path attributes can be read directly, thus improving the efficiency of path search.

[0122] In some embodiments, determining the current search node in the current resource transfer path includes: among the nodes included in the resource transfer relationship graph, selecting the node that meets the preset starting node condition as the starting node of the current resource transfer path; if the resource transfer amount from the starting node to the node pointed to by the starting node is greater than or equal to the resource transfer amount threshold, then forming the current resource transfer path based on the starting node and the node pointed to by the starting node, and selecting the node pointed to by the starting node as the current search node.

[0123] The preset starting node conditions include at least one of the following conditions:

[0124] (1) The in-degree of a node is less than or equal to the in-degree threshold, which can be set to 0. If the in-degree threshold is 0, then the in-degree of nodes a and e in Figure 3(a) is 0, which satisfies the condition and can be used as the starting node.

[0125] (2) The ratio of the total amount of resources transferred into a node to the total amount of resources transferred out of the node is less than a preset ratio; the total amount of resources transferred in refers to the total amount of resources that all the nodes pointing to this node transfer to this node, which can be called the total net amount of resources transferred in; the total amount of resources transferred out is the total amount of resources that this node transfers to all the nodes it points to, which can be called the total net amount of resources transferred out; the ratio of the total amount of resources transferred in to the total amount of resources transferred out being less than the preset ratio indicates that: the total net amount of resources transferred into this node and the total net amount of resources transferred out of this node are not close in magnitude and the total net amount of resources transferred in is less than the total net amount of resources transferred out, that is, the total net amount of resources transferred into this node is much less than the total net amount of resources transferred out. As Figure 7 shown, when determining whether the total net amount of resources transferred into node o is much less than the total net amount of resources transferred out of this node, since all the nodes pointing to this node o are q, n, r, and m, therefore, the sum of the net amounts of resources transferred into node o by nodes q, n, r, and m respectively can be used as the total net amount of resources transferred into node o, that is, the total net amount of resources transferred in is M(q, o) + M(n, o) + M(r, o) + M(m, o); since all the nodes this node points to are p and s, therefore, the sum of the net amounts of resources transferred out by this node to nodes p and s can be used as the total net amount of resources transferred out of node o, that is, the total net amount of resources transferred out is M(o, p) + M(o, s); if the total net amount of resources transferred in M(q, o) + M(n, o) + M(r, o) + M(m, o) is much less than the total net amount of resources transferred out M(o, p) + M(o, s), then node o can be used as the starting node for path search. More specifically, if M(q, o) + M(n, o) + M(r, o) + M(m, o) < k × [M(o, p) + M(o, s)], where k can be any value from 0.1 to 0.3, then it can be determined that the total net amount of resources transferred in is much less than the total net amount of resources transferred out.

[0126] Specifically, taking node e as an example to introduce the above steps:

[0127] If the in-degree of node e is less than the in-degree threshold, then node e can be used as the starting point for path search; then, for the node i pointed to by this node e, if the net amount of resources transferred out M(e, i) from node e to node i is greater than or equal to the resource transfer amount threshold M0, then based on node e and node i, form the current resource transfer path e->i, and use node i as the current search node, use node e as the reference node, and use node f as the candidate node. According to the obviousness of the chronological order of the net resource transfer from node e to node i and the net resource transfer from node i to node f, as well as the proximity of the magnitudes of M(e, i) and M(i, f), determine whether to add node f to the current resource transfer path e->i.

[0128] In the above method, the node that meets the preset starting node condition in the resource transfer relationship graph is taken as the starting node of the current path search. The current resource transfer path and the current search node are obtained according to the relative size of the net resource transfer amount from the starting node to the node pointed to by the starting node and the resource transfer amount threshold, so as to ensure the normal progress of the transfer path search for resources with uncertified sources.

[0129] To better understand the above methods, the following will combine... Figure 8 This paper details an application example of the resource transfer information detection method of this application, in which the resource transfer identifier is referred to as the identifier.

[0130] Step S802: Obtain the identifier set;

[0131] Step S804: The identifier is used as a node, and nodes with resource transfer relationships are connected by unidirectional edges to obtain a unidirectional graph with net resource transfer. The direction of the unidirectional edge is determined based on the net resource transfer direction between the two nodes connected by the unidirectional edge. This net resource transfer direction is determined based on multiple actual resource transfers between the two nodes. For example, if node a transfers 5 resources to node b with a total resource amount of 30,000, and node b transfers 2 resources to node a with a total resource amount of 20,000, then based on these 7 resource transfers between node a and node b, the net resource transfer direction between these two nodes can be determined to be from node a to node b, and the direction of the unidirectional edge used to connect node a and node b can be obtained.

[0132] Each unidirectional edge has two attributes: net resource transfer amount and the time corresponding to the net resource transfer amount. The net resource transfer amount can be obtained by canceling and adding the resource transfer amounts of multiple actual resource transfers between nodes, for example, M(b,d) = (+m) / (b+d ... v1 )+(-m v2 )+(-m v3 )+(+m v4 )+(-m v5 The + and - symbols represent the direction of resource transfer. The time corresponding to the net resource transfer amount can be obtained by combining the occurrence times of multiple actual resource transfers between nodes. Specifically, the combination method can be a weighted sum of the resource transfer amounts of each actual resource transfer. For example, the time T(b,d) corresponding to the net resource transfer amount between nodes b and d is t. v1 ×mv1 / (mv1+mv2+mv3+mv4+mv5)+t v2 ×mv2 / (mv1+mv2+mv3+mv4+mv5)+t v3 ×mv3 / (mv1+mv2+mv3+mv4+mv5)+t v4×mv4 / (mv1+mv2+mv3+mv4+mv5)+t v5 ×mv5 / (mv1+mv2+mv3+mv4+mv5), for details please refer to the description of other embodiments.

[0133] Step S806: Among the nodes included in the resource net transfer unidirectional graph, the node that meets the preset starting node condition is taken as the starting node for the current path search.

[0134] Among them, the preset starting node conditions include any one of the following: (1) the in-degree of the node is less than or equal to the in-degree threshold; (2) the total net resource transfer in of the node is much less than the total net resource transfer out of the node.

[0135] Step S808: The net amount of resources transferred from the starting node to the node pointed to by the starting node is denoted as M(starting point, child node). If M(starting point, child node) ≥ resource transfer threshold M0, then the current resource transfer path is formed based on the starting node and the node pointed to by the starting node, and the node pointed to by the starting node is taken as the current node.

[0136] Step S810: Take the starting node as the reference node and the node pointed to by the current node as the candidate node.

[0137] Step S812: The time corresponding to the net resource transfer amount between the reference node and the current node is taken as the first resource transfer time and recorded as T(i-1,i); the time corresponding to the net resource transfer amount between the current node and the candidate node is taken as the second resource transfer time and recorded as T(i,i+1); where i-1 represents the reference node pointing to the current node, i represents the current node, and i+1 represents the candidate node pointed to by the current node.

[0138] Step S814: If the first resource transfer time is earlier than the second resource transfer time, i.e., T(i-1,i)≤T(i,i+1), then obtain the net resource transfer amount M(i-1,i) between the reference node and the current node and the net resource transfer amount M(i,i+1) between the current node and the candidate node. If M(i-1,i) and M(i,i+1) are similar in size, then add the candidate node to the current resource transfer path, and use the current node as the reference node, the candidate node as the current node, and the node pointed to by the candidate node as the candidate node to continue the path search until the termination condition is met, and the target resource transfer path is obtained.

[0139] The method to determine whether M(i-1,i) and M(i,i+1) are similar in size is: when M(i-1,i) / M(i,i+1)∈(1-p loss ,1+p lossWhen p is equal to 1, we can determine that M(i-1,i) and M(i,i+1) are similar in size; where p loss ∈(0.1~0.2).

[0140] Termination conditions include any of the following:

[0141] ① The length of the resource transfer path obtained from the current search has reached the preset maximum length;

[0142] ②The out-degree of the current node is 0;

[0143] ③ The current node points to no node that can be added to the resource transfer path obtained in the current search.

[0144] It should be noted that the time corresponding to the net resource transfer amount can be obtained by combining the occurrence times of multiple actual resource transfers between nodes, or by comparing the chronological order of the occurrence times of multiple actual resource transfers. For example, the time of the first resource transfer in the multiple actual resource transfers from node b to node d is t. v1 The time t of the last actual resource transfer v4 These two t can be v1 and t v4 The time corresponding to M(b,d) is t; similarly, the time corresponding to the net resource transfer M(d,f) between node d and node f is t. v6 and t v8 In this case, the comparison between the time corresponding to the net resource transfer between the reference node and the current node, and the time corresponding to the net resource transfer between the current node and the candidate node, can be found in the relevant descriptions in Figures 6(a) and 6(b), which will not be repeated here.

[0145] Step S816: After completing this path search, store the path attributes of each node corresponding to each node on the target resource transfer path under the resource transfer amount threshold M0.

[0146] Step S818: Determine the next node in the net resource transfer unidirectional graph that meets the preset starting node conditions, and perform resource transfer path search under the resource transfer amount threshold M0 in the manner of steps S808 to S816. If one of the searched nodes has a path attribute, directly read the path attribute and concatenate it into the currently searched resource transfer path until the path search ends.

[0147] In step S820, if there are nodes in the resource net outflow unidirectional graph that meet the preset starting node conditions but have not been visited, then return to step S808 to continue the path search.

[0148] During path search, the starting node can be used as an identifier to record whether a node in the path search from that starting node has been visited. If it has been visited, it means that a node cycle has been encountered, and the visit can be terminated. For example, as shown in Figure 3(a), the nodes f->c->j->f form a node cycle. After visiting nodes f, c, and j in sequence, if node f is visited again, it means that a node cycle has been encountered, and the visit to node f can be terminated to avoid infinite looping and wasting computing resources.

[0149] In this application embodiment, by determining the nodes connected by directed edges based on whether there is a resource transfer relationship between the identifiers, the resulting net resource transfer graph accurately reflects the net resource transfer situation between the identifiers. This is beneficial for accurately identifying the transfer path of uncertified resources from massive resource transfers, thus improving path identification efficiency. Furthermore, during the resource transfer path search in the net resource transfer graph, if the temporal order between the current node and the reference node corresponding to the net resource transfer, and between the current node and the candidate node corresponding to the net resource transfer, is significantly higher than a threshold, and the net resource transfer amounts between the current node and the reference node are similar to those between the current node and the candidate node, then the candidate node is added to the current resource transfer path. This indicates that uncertified resources are likely flowing from the reference node to the current node and the candidate node sequentially in chronological order. Therefore, the resource transfer path obtained based on the current resource transfer path is highly likely to be a transfer path of uncertified resources, improving path identification accuracy.

[0150] It should be understood that, although Figures 1 to 8 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 1 to 8 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0151] In some embodiments, such as Figure 9 As shown, a resource transfer information detection device is provided, comprising:

[0152] The identifier set acquisition module 902 is used to acquire a set of resource transfer identifiers to be maliciously detected; the resource transfer identifier set includes multiple resource transfer identifiers.

[0153] The transfer direction determination module 904 is used to obtain resource transfer identifier pairs corresponding to the resource transfer identifier set and determine the resource transfer direction corresponding to the resource transfer identifier pairs; the resource transfer identifier pairs are composed of resource transfer identifiers in the resource transfer identifier set that have resource transfer relationships.

[0154] The relationship graph acquisition module 906 is used to take the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer relationship graph, and connect the nodes corresponding to the resource transfer identifiers with directed edges according to the resource transfer direction to obtain the resource transfer relationship graph.

[0155] The node determination module 908 is used to determine the current search node in the current resource transfer path during the process of searching the resource transfer relationship graph, take the node pointing to the current search node in the current resource transfer path as the reference node, and take the node pointed to by the current search node in the resource transfer relationship graph as the candidate node.

[0156] The time determination module 910 is used to determine the first resource transfer time between the current search node and the reference node, and the second resource transfer time between the current search node and the candidate node;

[0157] The node adding module 912 is used to determine the resource transfer time difference between the first resource transfer time and the second resource transfer time. When the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path to obtain the target resource transfer path. The time difference condition is the time difference condition of the target resource flowing from the reference node to the current search node and the candidate node in sequence.

[0158] In some embodiments, the time determination module 910 is further configured to: obtain a set of resource transfer records between the current search node and the reference node; the set of resource transfer records includes multiple resource transfer records; obtain the resource transfer time and resource transfer value in each of the resource transfer records; determine the time weight corresponding to the resource transfer time based on the resource transfer value; the time weight is positively correlated with the resource transfer value; and perform a weighted calculation on the resource transfer times in the set of resource transfer records based on the time weight corresponding to the resource transfer time to obtain a first resource transfer time between the current search node and the reference node.

[0159] In some embodiments, the time determination module 910 is further configured to: sum the resource transfer values ​​in the resource transfer record set to obtain resource transfer statistics; calculate the proportion of the resource transfer values ​​in the resource transfer statistics, and use the proportion as the time weight corresponding to the resource transfer time.

[0160] In some embodiments, the first resource transfer time is the first tail resource transfer time from the reference node to the current search node, and the second resource transfer time is the second head resource transfer time from the current search node to the candidate node; the device further includes a time difference processing module, configured to: determine a time sequence indication value between the first resource transfer time and the second resource transfer time; obtain a time difference range corresponding to the time sequence indication value; and determine that the resource transfer time difference satisfies a time difference condition when the resource transfer time difference is within the time difference range.

[0161] In some embodiments, the node adding module 912 is further configured to: when the time sequence indicator value indicates that the first resource transfer time is later than the second resource transfer time, obtain a first time difference between the first resource transfer time and the second resource transfer time; obtain a first initial resource transfer time between the reference node and the current search node, and obtain a second final resource transfer time between the current search node and the candidate node; obtain a second time difference between the second final resource transfer time and the first initial resource transfer time; calculate the time ratio between the first time difference and the second time difference as the resource transfer time difference between the first resource transfer time and the second resource transfer time; wherein the time difference range is less than or equal to a time ratio threshold.

[0162] In some embodiments, the node adding module 912 is further configured to: when the time sequence indicator value indicates that the first resource transfer time is earlier than the second resource transfer time, obtain a first time difference between the first resource transfer time and the second resource transfer time; use the first time difference as the resource transfer time difference between the first resource transfer time and the second resource transfer time; the time difference range is less than or equal to a time difference threshold.

[0163] In some embodiments, the node adding module 912 is further configured to: obtain a first amount of transferred resources from the reference node to the current search node, and a second amount of transferred resources from the current search node to the candidate node; when the resource transfer time difference meets the time difference condition, and it is determined that the amount of resources between the first amount of transferred resources and the second amount of transferred resources is less than the difference amount, add the candidate node to the current resource transfer path to obtain the target resource transfer path.

[0164] In some embodiments, the node adding module 912 is further configured to: calculate the resource ratio between the first transferred resource amount and the second transferred resource amount; when it is determined that the resource ratio is greater than a first threshold and less than a second threshold, determine that the resource amount between the first transferred resource amount and the second transferred resource amount is less than the difference amount; the first threshold is less than 1, and the second threshold is greater than 1.

[0165] In some embodiments, the node adding module 912 is further configured to: when the resource transfer time difference meets the time difference condition, obtain the path attribute identifier corresponding to the stored candidate node; the path attribute identifier is added when it is determined that the candidate node has a sub-path in the resource transfer path obtained by searching the resource transfer relationship graph; obtain the sub-path based on the path attribute identifier, and sequentially concatenate the candidate node and the sub-path to the current resource transfer path to obtain the target resource transfer path.

[0166] In some embodiments, the node determination module 908 is configured to: among the nodes included in the resource transfer relationship graph, select a node that satisfies a preset starting node condition as the starting node of the current resource transfer path; the preset starting node condition includes at least one of the following conditions: the in-degree of the node is less than or equal to an in-degree threshold, or the ratio of the total amount of resources transferred into the node to the total amount of resources transferred out of the node is less than a preset ratio; if the amount of resources transferred from the starting node to the node pointed to by the starting node is greater than or equal to a resource transfer amount threshold, then the current resource transfer path is formed based on the starting node and the node pointed to by the starting node, and the node pointed to by the starting node is selected as the current search node.

[0167] Specific limitations regarding the resource transfer information detection device can be found in the limitations of the resource transfer information detection method described above, and will not be repeated here. Each module in the aforementioned resource transfer information detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0168] In some embodiments, a computer device is provided, the internal structure of which can be shown as follows: Figure 10 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores resource transfer information detection data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a resource transfer information detection method.

[0169] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0170] In some embodiments, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the various method embodiments described above.

[0171] In some embodiments, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the various method embodiments described above.

[0172] In some embodiments, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the various method embodiments described above.

[0173] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0174] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0175] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0176] The above embodiments are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for detecting resource transfer information, characterized in that, The method includes: Obtain a set of resource transfer identifiers to be detected for malicious activity; the set of resource transfer identifiers includes multiple resource transfer identifiers. Obtain the resource transfer identifier pair corresponding to the resource transfer identifier set, and determine the resource transfer direction corresponding to the resource transfer identifier pair; the resource transfer identifier pair is composed of resource transfer identifiers in the resource transfer identifier set that have a resource transfer relationship, and the resource transfer direction is the net resource transfer direction, which is determined based on multiple actual resource transfers that occur between the two identifiers that make up the resource transfer identifier pair; Using the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer relationship graph, and connecting the nodes corresponding to the resource transfer identifiers with directed edges according to the resource transfer direction, the resource transfer relationship graph is obtained. During the process of searching for resource transfer paths in the resource transfer relationship graph, the current search node in the current searched resource transfer path is determined, the node in the current resource transfer path that points to the current search node is taken as the reference node, and the node in the resource transfer relationship graph that the current search node points to is taken as the candidate node. Determine the first resource transfer time between the current search node and the reference node, and the second resource transfer time between the current search node and the candidate node; The resource transfer time difference between the first resource transfer time and the second resource transfer time is determined. When the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path. The time difference condition is the time difference condition of the target resource flowing from the reference node to the current search node and the candidate node in sequence. The current search node is used as the reference node, the candidate node is used as the current search node, and the node pointed to by the candidate node is used as the candidate node to continue path search until the termination condition is met to obtain the target resource transfer path. The termination condition includes any of the following: the length of the resource transfer path obtained by the current search reaches the preset maximum length; the out-degree of the current search node is equal to 0; there are no nodes pointed to by the current search node that can be added to the resource transfer path obtained by the current search.

2. The method according to claim 1, characterized in that, Determining the first resource transfer time between the current search node and the reference node includes: Obtain a set of resource transfer records between the current search node and the reference node; the set of resource transfer records includes multiple resource transfer records. Obtain the resource transfer time and resource transfer value from each of the resource transfer records; The time weight corresponding to the resource transfer time is determined based on the resource transfer value; the time weight is positively correlated with the resource transfer value. The resource transfer times in the resource transfer record set are weighted and calculated based on the time weight corresponding to the resource transfer time to obtain the first resource transfer time between the current search node and the reference node.

3. The method according to claim 2, characterized in that, The step of determining the time weight corresponding to the resource transfer time based on the resource transfer value includes: The resource transfer statistics are obtained by summing the resource transfer values ​​in the resource transfer record set. Calculate the proportion of the resource transfer value in the resource transfer statistics, and use the proportion as the time weight corresponding to the resource transfer time.

4. The method according to claim 1, characterized in that, The first resource transfer time is the first tail resource transfer time from the reference node to the current search node, and the second resource transfer time is the second head resource transfer time from the current search node to the candidate node; The steps for determining whether the resource transfer time difference meets the time difference condition include: Determine the time sequence indication value between the first resource transfer time and the second resource transfer time; Obtain the time difference range corresponding to the time sequence indication value; When the resource transfer time difference is within the time difference range, it is determined that the resource transfer time difference meets the time difference condition.

5. The method according to claim 4, characterized in that, The determination of the resource transfer time difference between the first resource transfer time and the second resource transfer time includes: When the time sequence indicator value indicates that the first resource transfer time is later than the second resource transfer time, a first time difference between the first resource transfer time and the second resource transfer time is obtained; Obtain the first resource transfer time between the reference node and the current search node, and obtain the second resource transfer time between the current search node and the candidate node; Obtain the second time difference between the second tail resource transfer time and the first head resource transfer time; Calculate the time ratio between the first time difference and the second time difference as the resource transfer time difference between the first resource transfer time and the second resource transfer time; the time difference range is less than or equal to the time ratio threshold.

6. The method according to claim 4, characterized in that, The determination of the resource transfer time difference between the first resource transfer time and the second resource transfer time includes: When the time sequence indicator value indicates that the first resource transfer time is earlier than the second resource transfer time, a first time difference between the first resource transfer time and the second resource transfer time is obtained; The first time difference is used as the resource transfer time difference between the first resource transfer time and the second resource transfer time; the time difference range is less than or equal to the time difference threshold.

7. The method according to claim 1, characterized in that, When the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path to obtain the target resource transfer path, including: Obtain the first amount of resources transferred from the reference node to the current search node, and the second amount of resources transferred from the current search node to the candidate node; When the resource transfer time difference meets the time difference condition, and it is determined that the resource amount between the first transferred resource amount and the second transferred resource amount is less than the difference amount, the candidate node is added to the current resource transfer path to obtain the target resource transfer path.

8. The method according to claim 7, characterized in that, Determining that the amount of resources transferred between the first and second transferred resources is less than the difference includes: Calculate the resource ratio between the first transferred resource amount and the second transferred resource amount; When it is determined that the resource quantity ratio is greater than a first threshold and less than a second threshold, it is determined that the resource quantity between the first transferred resource quantity and the second transferred resource quantity is less than the difference; the first threshold is less than 1, and the second threshold is greater than 1.

9. The method according to claim 1, characterized in that, When the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path, including: When the resource transfer time difference meets the time difference condition, the path attribute identifier corresponding to the stored candidate node is obtained; the path attribute identifier is added when it is determined that the candidate node has a sub-path in the resource transfer path obtained by searching the resource transfer relationship graph. The sub-path is obtained based on the path attribute identifier, and the candidate node and the sub-path are sequentially concatenated into the current resource transfer path to obtain the target resource transfer path.

10. The method according to claim 1, characterized in that, Determining the current search node in the currently searched resource transfer path includes: Among the nodes included in the resource transfer relationship graph, the node that meets the preset starting node condition is taken as the starting node of the current resource transfer path; the preset starting node condition includes at least one of the following conditions: the in-degree of the node is less than or equal to the in-degree threshold, or the ratio of the total amount of resources transferred into the node to the total amount of resources transferred out of the node is less than a preset ratio. If the amount of resource transfer from the starting node to the node pointed to by the starting node is greater than or equal to the resource transfer amount threshold, then the current resource transfer path is formed based on the starting node and the node pointed to by the starting node, and the node pointed to by the starting node is taken as the current search node.

11. A resource transfer information detection device, characterized in that, The device includes: The identifier set acquisition module is used to acquire a set of resource transfer identifiers to be maliciously detected; the resource transfer identifier set includes multiple resource transfer identifiers. The transfer direction determination module is used to obtain the resource transfer identifier pair corresponding to the resource transfer identifier set and determine the resource transfer direction corresponding to the resource transfer identifier pair; the resource transfer identifier pair is composed of resource transfer identifiers in the resource transfer identifier set that have a resource transfer relationship, and the resource transfer direction is the net resource transfer direction, which is determined based on multiple actual resource transfers that occur between the two identifiers that make up the resource transfer identifier pair; The relationship graph acquisition module is used to take the resource transfer identifiers in the resource transfer identifier set as nodes in the resource transfer relationship graph, and connect the nodes corresponding to the resource transfer identifiers with directed edges according to the resource transfer direction to obtain the resource transfer relationship graph; The node determination module is used to determine the current search node in the current resource transfer path during the process of searching the resource transfer relationship graph, and to take the node pointing to the current search node in the current resource transfer path as the reference node and the node pointed to by the current search node in the resource transfer relationship graph as the candidate node. The time determination module is used to determine the first resource transfer time between the current search node and the reference node, and the second resource transfer time between the current search node and the candidate node; The node adding module is used to determine the resource transfer time difference between the first resource transfer time and the second resource transfer time. When the resource transfer time difference meets the time difference condition, the candidate node is added to the current resource transfer path. The time difference condition is the time difference condition of the target resource flowing from the reference node to the current search node and the candidate node in sequence. The current search node is used as the reference node, the candidate node is used as the current search node, and the node pointed to by the candidate node is used as the candidate node to continue path search until the termination condition is met to obtain the target resource transfer path. The termination condition includes any of the following: the length of the resource transfer path obtained by the current search reaches the preset maximum length; the out-degree of the current search node is equal to 0; there are no nodes pointed to by the current search node that can be added to the resource transfer path obtained by the current search.

12. The apparatus according to claim 11, characterized in that, The time determination module is also used for: Obtain a set of resource transfer records between the current search node and the reference node; the set of resource transfer records includes multiple resource transfer records. Obtain the resource transfer time and resource transfer value from each of the resource transfer records; The time weight corresponding to the resource transfer time is determined based on the resource transfer value. The time weight is positively correlated with the resource transfer value; The resource transfer times in the resource transfer record set are weighted and calculated based on the time weight corresponding to the resource transfer time to obtain the first resource transfer time between the current search node and the reference node.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 10.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 10.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method according to any one of claims 1 to 10.

Images