Abnormal behavior detection method and device based on graph data, equipment and storage medium

Abstract

The application relates to an abnormal behavior detection method and device based on graph data, a computer device, a storage medium and a computer program product, and is applied to the medical insurance field. The method comprises the following steps: acquiring a plurality of to-be-detected behaviors, the to-be-detected behaviors being used for describing medical insurance transaction behaviors initiated by beneficiaries to service providers; constructing heterogeneous entity graph data according to the plurality of to-be-detected behaviors; performing graph feature extraction on the heterogeneous entity graph data to acquire heterogeneous entity features; wherein the beneficiary features at least comprise node attribute features of a beneficiary node and node attribute features of a node having a to-be-detected behavior edge with the beneficiary node; and performing behavior category detection on the to-be-detected behaviors corresponding to each to-be-detected behavior edge through the heterogeneous entity features to acquire abnormal behavior detection results corresponding to each to-be-detected behavior. The method can improve the accuracy of abnormal behavior detection.

Description

Technical Field

[0001] This application relates to the field of medical insurance detection, and in particular to a method, apparatus, device, and storage medium for detecting abnormal behavior based on graph data. Background Technology

[0002] Medical insurance is an integral part of the social security system, playing a vital role in modern life. However, as the medical insurance system continues to expand, the difficulty of its supervision also increases. Abnormal medical insurance behavior can lead to significant economic losses for medical insurance institutions and the government, and may prevent patients who genuinely need medical insurance compensation from receiving timely and effective treatment. Therefore, how to detect abnormal medical insurance behavior is a crucial issue in the context of medical insurance.

[0003] Currently, abnormal medical insurance behavior can be detected using a medical knowledge rule base, or manually by relying on the existing experience and rules of regulatory personnel. However, in real-world scenarios, abnormal medical insurance behavior is quite complex. Therefore, judging complex medical insurance behaviors using methods based on medical knowledge rule bases and manual detection may differ from the actual situation, thus reducing the accuracy of abnormal behavior detection. Therefore, improving the accuracy of abnormal behavior detection is an urgent problem to be solved. Summary of the Invention

[0004] Therefore, it is necessary to provide a graph-based method, apparatus, device, and storage medium for abnormal behavior detection that can improve the accuracy of abnormal behavior detection, addressing the aforementioned technical problems.

[0005] Firstly, this application provides an abnormal behavior detection method based on graph data. The method includes:

[0006] Multiple behaviors to be detected are obtained, which describe the medical insurance transaction behavior initiated by the beneficiary to the service provider;

[0007] Based on multiple behaviors to be detected, a heterogeneous entity graph data is constructed. The heterogeneous entity graph data includes at least: the beneficiary node corresponding to the beneficiary, the service provider node corresponding to the service provider, and the edge of the behavior to be detected used to connect the beneficiary node and the service provider node.

[0008] Graph feature extraction is performed on heterogeneous entity graph data to obtain heterogeneous entity features. The heterogeneous entity features include at least: the beneficiary features corresponding to each beneficiary node, the service provider features corresponding to each service provider node, and the behavior features corresponding to each edge of the behavior to be detected.

[0009] By using heterogeneous entity features, behavior category detection is performed on the behavior to be detected corresponding to each behavior edge, so as to obtain the abnormal behavior detection results corresponding to each behavior to be detected.

[0010] Secondly, this application also provides an abnormal behavior detection device based on graph data. The device includes:

[0011] The behavior acquisition module acquires multiple behaviors to be detected, which describe the medical insurance transaction behavior initiated by the beneficiary to the service provider.

[0012] The graph data construction module is used to construct heterogeneous entity graph data based on multiple behaviors to be detected. The heterogeneous entity graph data includes at least: beneficiary nodes corresponding to beneficiaries, service provider nodes corresponding to service providers, and edges of behaviors to be detected connecting beneficiary nodes and service provider nodes.

[0013] The feature extraction module is used to extract graph features from heterogeneous entity graph data and obtain heterogeneous entity features. The heterogeneous entity features include at least: the beneficiary features corresponding to each beneficiary node, the service provider features corresponding to each service provider node, and the behavior features corresponding to each edge of the behavior to be detected.

[0014] The abnormal behavior detection module is used to perform behavior category detection on the behavior to be detected corresponding to each behavior edge through heterogeneous entity features, so as to obtain the abnormal behavior detection results corresponding to each behavior to be detected.

[0015] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0016] Multiple behaviors to be detected are obtained, which describe the medical insurance transaction behavior initiated by the beneficiary to the service provider;

[0017] Based on multiple behaviors to be detected, a heterogeneous entity graph data is constructed. The heterogeneous entity graph data includes at least: the beneficiary node corresponding to the beneficiary, the service provider node corresponding to the service provider, and the edge of the behavior to be detected used to connect the beneficiary node and the service provider node.

[0018] Graph feature extraction is performed on heterogeneous entity graph data to obtain heterogeneous entity features. The heterogeneous entity features include at least: the beneficiary features corresponding to each beneficiary node, the service provider features corresponding to each service provider node, and the behavior features corresponding to each edge of the behavior to be detected.

[0019] By using heterogeneous entity features, behavior category detection is performed on the behavior to be detected corresponding to each behavior edge, so as to obtain the abnormal behavior detection results corresponding to each behavior to be detected.

[0020] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0021] Multiple behaviors to be detected are obtained, which describe the medical insurance transaction behavior initiated by the beneficiary to the service provider;

[0022] Based on multiple behaviors to be detected, a heterogeneous entity graph data is constructed. The heterogeneous entity graph data includes at least: the beneficiary node corresponding to the beneficiary, the service provider node corresponding to the service provider, and the edge of the behavior to be detected used to connect the beneficiary node and the service provider node.

[0023] Graph feature extraction is performed on heterogeneous entity graph data to obtain heterogeneous entity features. The heterogeneous entity features include at least: the beneficiary features corresponding to each beneficiary node, the service provider features corresponding to each service provider node, and the behavior features corresponding to each edge of the behavior to be detected.

[0024] By using heterogeneous entity features, behavior category detection is performed on the behavior to be detected corresponding to each behavior edge, so as to obtain the abnormal behavior detection results corresponding to each behavior to be detected.

[0025] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0026] Multiple behaviors to be detected are obtained, which describe the medical insurance transaction behavior initiated by the beneficiary to the service provider;

[0027] Based on multiple behaviors to be detected, a heterogeneous entity graph data is constructed. The heterogeneous entity graph data includes at least: the beneficiary node corresponding to the beneficiary, the service provider node corresponding to the service provider, and the edge of the behavior to be detected used to connect the beneficiary node and the service provider node.

[0028] Graph feature extraction is performed on heterogeneous entity graph data to obtain heterogeneous entity features. The heterogeneous entity features include at least: the beneficiary features corresponding to each beneficiary node, the service provider features corresponding to each service provider node, and the behavior features corresponding to each edge of the behavior to be detected.

[0029] By using heterogeneous entity features, behavior category detection is performed on the behavior to be detected corresponding to each behavior edge, so as to obtain the abnormal behavior detection results corresponding to each behavior to be detected.

[0030] The aforementioned abnormal behavior detection method, apparatus, computer equipment, storage medium, and computer program product based on graph data acquire multiple behaviors to be detected. These behaviors describe medical insurance transactions initiated by beneficiaries to service providers. Based on these behaviors, a heterogeneous entity graph is constructed. This graph includes at least: beneficiary nodes corresponding to the beneficiaries, service provider nodes corresponding to the service providers, and edges connecting the beneficiary nodes and service provider nodes. Graph features are extracted from the heterogeneous entity graph to obtain heterogeneous entity features. These features include at least: beneficiary features corresponding to each beneficiary node, service provider features corresponding to each service provider node, and behavior features corresponding to each edge of the behavior to be detected. Finally, using the heterogeneous entity features, behavior category detection is performed on the behaviors corresponding to each edge of the behavior to be detected to obtain abnormal behavior detection results for each behavior. By employing the aforementioned method, since heterogeneous entity graph data includes nodes with different node attributes and edges connecting each node, when extracting graph features, each node can obtain its own node attribute features and the node attribute features of other nodes with edges. Similarly, each edge can obtain its own edge attribute features and the edge attribute features of other edges that are adjacent to it. This allows the obtained heterogeneous entity features to include multi-dimensional features after aggregating information from each node and edge. Consequently, when performing abnormal behavior detection, more dimensional feature information can be considered, thereby improving the accuracy of abnormal behavior detection. Attached Figure Description

[0031] Figure 1 This is an application environment diagram of an abnormal behavior detection method based on graph data in one embodiment;

[0032] Figure 2 This is a flowchart illustrating an abnormal behavior detection method based on graph data in one embodiment;

[0033] Figure 3 This is a schematic diagram of graph data for heterogeneous entity graph data in one embodiment;

[0034] Figure 4 This is a flowchart illustrating an abnormal behavior detection method based on graph data in another embodiment;

[0035] Figure 5 This is a schematic diagram of graph data for homogeneous behavior graph data in one embodiment;

[0036] Figure 6 This is a flowchart illustrating the process of obtaining behavioral characteristics of each team in one embodiment;

[0037] Figure 7 This is a flowchart illustrating a method for obtaining a feature extraction model in one embodiment;

[0038] Figure 8 This is a flowchart illustrating the method for obtaining the feature extraction model in another embodiment;

[0039] Figure 9 This is a flowchart illustrating the process of determining team behavioral sample characteristics through risk expansion calculation in one embodiment.

[0040] Figure 10 This is a partial flowchart illustrating the process of obtaining features of heterogeneous entities in one embodiment.

[0041] Figure 11 This is a flowchart illustrating the process of obtaining beneficiary features from heterogeneous entity features in one embodiment.

[0042] Figure 12 This is a flowchart illustrating the process of obtaining service provider features from heterogeneous entity features in one embodiment.

[0043] Figure 13 This is a flowchart illustrating the process of obtaining behavioral features from heterogeneous entity features in one embodiment.

[0044] Figure 14 This is a flowchart illustrating the process of obtaining abnormal behavior detection results in one embodiment;

[0045] Figure 15 This is a flowchart illustrating the probability that an edge of behavior to be detected belongs to an abnormal behavior edge in one embodiment.

[0046] Figure 16 This is a schematic diagram of the complete process of an abnormal behavior detection method based on graph data in one embodiment;

[0047] Figure 17 This is a structural block diagram of an abnormal behavior detection device based on graph data in one embodiment;

[0048] Figure 18 This is a structural block diagram of an abnormal behavior detection device based on graph data in another embodiment;

[0049] Figure 19 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying platform, a platform product and service layer, and an application service layer.

[0052] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operational monitoring. The user management module is responsible for managing the identity information of all blockchain participants, including maintaining public and private key generation (account management), key management, and maintaining the correspondence between user real identities and blockchain addresses (access management). Furthermore, under authorization, it monitors and audits transactions of certain real identities and provides risk control rule configuration (risk control audit). The basic services module is deployed on all blockchain node devices to verify the validity of business requests. After consensus is reached on valid requests, they are recorded in storage. For a new business request, the basic services first perform interface adaptation parsing and authentication (interface adaptation), and then encrypt the business information using a consensus algorithm (consensus management). After encryption, the data is transmitted completely and consistently to the shared ledger (network communication) and recorded and stored. The smart contract module is responsible for contract registration, issuance, triggering, and execution. Developers can define contract logic using a programming language and publish it to the blockchain (contract registration). According to the contract terms, the key or other events are invoked to trigger execution and complete the contract logic. It also provides functions for contract upgrades and cancellations. The operation monitoring module is mainly responsible for deployment, configuration modification, contract settings, cloud adaptation, and real-time status visualization output during product release, such as alarms, network monitoring, and monitoring of node device health status.

[0053] The platform's product service layer provides basic capabilities and implementation frameworks for typical applications. Developers can leverage these basic capabilities, along with the characteristics of their business operations, to implement blockchain-based business logic. The application service layer provides blockchain-based application services to business stakeholders. Therefore, the graph-based abnormal behavior detection method provided in this application, when authorized, uses blockchain to detect abnormal behavior in each target behavior and then provides corresponding risk control rule configurations based on the abnormal behavior detection results.

[0054] Based on this, the abnormal behavior detection method based on graph data provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on another server.

[0055] Specifically, taking server 104 as an example, server 104 first acquires multiple behaviors to be detected. These behaviors describe the medical insurance transactions initiated by beneficiaries to service providers. Then, based on these behaviors, it constructs heterogeneous entity graph data. This heterogeneous entity graph data includes at least: beneficiary nodes corresponding to the beneficiaries, service provider nodes corresponding to the service providers, and edges connecting the beneficiary nodes and service provider nodes. Based on this, the server extracts graph features from the heterogeneous entity graph data to obtain heterogeneous entity features. These features include at least: beneficiary features corresponding to each beneficiary node, service provider features corresponding to each service provider node, and behavior features corresponding to each edge of the behavior to be detected.

[0056] Finally, the server uses heterogeneous entity features to perform behavior category detection on the behaviors corresponding to each edge of the behavior to be detected, in order to obtain the abnormal behavior detection results for each behavior. Since graph feature extraction yields node attribute features for each node and node attribute features of other nodes with edges, and edge attribute features for each edge and edge attribute features of other adjacent edges, the resulting heterogeneous entity features can include multi-dimensional features after aggregating information from each node and edge. This allows for the consideration of more dimensional feature information during abnormal behavior detection, thereby improving the accuracy of abnormal behavior detection.

[0057] The terminal 102 can be, but is not limited to, various desktop computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle systems. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0058] Furthermore, the abnormal behavior detection method based on graph data provided in this application embodiment specifically requires a model obtained through machine learning, which leads to a further introduction of artificial intelligence-related technologies:

[0059] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0060] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0061] This application specifically utilizes machine learning (ML) technologies. ML is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning. With the research and advancement of artificial intelligence technology, it is being researched and applied in multiple fields, such as smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, autonomous driving, drones, robots, smart healthcare, and smart customer service. It is believed that with technological development, artificial intelligence will be applied in more fields and play an increasingly important role.

[0062] The solutions provided in this application relate to machine learning technology in artificial intelligence, and are specifically illustrated through the following embodiments:

[0063] In one embodiment, such as Figure 2 As shown, an abnormal behavior detection method based on graph data is provided, which can be applied to... Figure 1The method is illustrated using server 104 as an example. It is understood that this method can also be applied to terminal 102, and to a system including terminal 102 and server 104, and is implemented through the interaction between terminal 102 and server 104. In this embodiment, the method includes the following steps:

[0064] Step 202: Obtain multiple behaviors to be detected. These behaviors describe the medical insurance transactions initiated by the beneficiary to the service provider.

[0065] The "benefit to be detected" describes the medical insurance transaction initiated by the beneficiary to the service provider. In actual medical insurance scenarios, the beneficiary specifically refers to the medical insurance recipient, which can be the insured or the patient, etc. The service provider specifically refers to the medical insurance service provider, which can be a medical insurance service provider institution or company, etc., without limitation. Generally speaking, a medical insurance transaction is a transaction in which the beneficiary initiates a payment transaction request to the service provider, requesting the service provider to provide the beneficiary with medical insurance-related fees.

[0066] Specifically, when a beneficiary incurs medical expenses due to illness, injury, or other reasons, they can initiate a medical insurance transaction with a service provider. To determine whether this transaction is normal and to ensure accurate and reliable reimbursement from the service provider, the server identifies the aforementioned medical insurance transaction initiated by the beneficiary as a transaction to be detected. This means the transaction is designed to determine if it is an abnormal transaction. For example, transaction A1 describes a medical insurance transaction initiated by beneficiary B1 to service provider C1, transaction A2 describes a medical insurance transaction initiated by beneficiary B2 to service provider C1, and transaction A3 describes a medical insurance transaction initiated by beneficiary B3 to service provider C2. The above examples are for understanding this solution only and should not be construed as specific limitations.

[0067] Step 204: Construct heterogeneous entity graph data based on multiple behaviors to be detected. The heterogeneous entity graph data includes at least: beneficiary nodes corresponding to beneficiaries, service provider nodes corresponding to service providers, and edges for connecting beneficiary nodes and service provider nodes to be detected.

[0068] The heterogeneous entity graph data includes at least: beneficiary nodes corresponding to beneficiaries, service provider nodes corresponding to service providers, and edges for connecting beneficiary nodes and service provider nodes to be detected, wherein the aforementioned edges for the behavior to be detected correspond to the behavior to be detected.

[0069] Secondly, the beneficiary node and the service provider node have different node attributes. The beneficiary node describes the relevant attribute information corresponding to the beneficiary, which includes at least: the beneficiary's personal information and medical records. Similarly, the service provider node describes the relevant attribute information corresponding to the service provider.

[0070] Specifically, the service area constructs heterogeneous entity graph data based on multiple behaviors to be detected. That is, the server constructs beneficiary nodes based on the beneficiaries described in each behavior to be detected, and similarly, the server constructs service provider nodes based on the service providers described in each behavior to be detected. Then, each behavior to be detected is identified as an edge connecting the beneficiary nodes and the service provider nodes, thereby constructing the heterogeneous entity graph data.

[0071] To facilitate understanding, let's further explain using the aforementioned example. Detectable behavior A1 describes the medical insurance transaction initiated by beneficiary B1 to service provider C1; detectable behavior A2 describes the medical insurance transaction initiated by beneficiary B2 to service provider C1; and detectable behavior A3 describes the medical insurance transaction initiated by beneficiary B3 to service provider C2. Based on this, as... Figure 3 As shown, beneficiary B1 corresponds to beneficiary node 301, beneficiary B2 corresponds to beneficiary node 302, and beneficiary B3 corresponds to beneficiary node 303. Service provider C1 corresponds to service provider node 304, and service provider C2 corresponds to service provider node 305.

[0072] Furthermore, after completing the corresponding construction of the beneficiary nodes and service provider nodes, edge 306, edge 307, and edge 308 of the behavior to be detected can be constructed based on the aforementioned behavior to be detected. Edge 306 specifically corresponds to behavior A1, edge 307 specifically corresponds to behavior A2, and edge 308 specifically corresponds to behavior A3. That is, edge 306 connects beneficiary node 301 corresponding to beneficiary B1 and service provider node 304 corresponding to service provider C1. Similarly, edge 307 connects beneficiary node 302 corresponding to beneficiary B2 and service provider node 304 corresponding to service provider C1. And edge 308 connects beneficiary node 303 corresponding to beneficiary B3 and service provider node 305 corresponding to service provider C2. Through the aforementioned operations, heterogeneous entity graph data can be obtained. It is understood that the foregoing examples are only for understanding this solution and should not be construed as specific limitations.

[0073] Step 206: Extract graph features from the heterogeneous entity graph data to obtain heterogeneous entity features. The heterogeneous entity features include at least: beneficiary features corresponding to each beneficiary node, service provider features corresponding to each service provider node, and behavior features corresponding to each edge of the behavior to be detected.

[0074] The beneficiary features include at least: the node attribute features of the beneficiary node, and the node attribute features of nodes that have edges with the beneficiary node that are to be detected. These nodes can be either nodes adjacent to the beneficiary node by one edge or nodes adjacent to multiple edges. In practical applications, the beneficiary features may also include the behavioral features of edges intersecting with the beneficiary node; this is not specifically limited here.

[0075] Similarly, service provider features include at least: the node attribute features of the service provider node, and the node attribute features of nodes that have edges with the service provider node that are to be detected. These nodes can be either nodes adjacent to the service provider node by one edge or nodes adjacent to multiple edges. In practical applications, service provider features may also include the behavioral features of edges that intersect with the service provider node; this is not specifically limited here.

[0076] The behavioral features include at least: the edge attribute features of the edge of the behavior to be detected, and the edge attribute features of the edges that are adjacent to the edge of the behavior to be detected. The edges that are adjacent to the edge of the behavior to be detected can be either edges intersecting the edge of the behavior to be detected, or the next intersecting edge of the edge that intersects the edge of the behavior to be detected. In practical applications, the behavioral features may also include the beneficiary features of the beneficiary nodes connected to the edge of the behavior to be detected, and the service provider features of the service provider nodes connected to the service provider nodes; this is not specifically limited here.

[0077] Specifically, the server performs graph feature extraction on the heterogeneous entity graph data to obtain heterogeneous entity features. That is, the server extracts features from the beneficiary nodes, service provider nodes, and edges of the behavior to be detected in the heterogeneous entity graph data. First, it extracts the node attribute features of each beneficiary node, the node attribute features of each service provider node, and the edge attribute features of each edge of the behavior to be detected. Then, it performs feature information aggregation processing on the node attribute features, the edge attribute features, and the feature information to obtain the heterogeneous entity features.

[0078] Step 208: Using heterogeneous entity features, perform behavior category detection on the behavior to be detected corresponding to each behavior edge to obtain the abnormal behavior detection results corresponding to each behavior to be detected.

[0079] Specifically, abnormal behavior detection is used to identify the type of behavior to be detected. These types include abnormal behavior types and normal behavior types. Abnormal behavior types describe abnormal medical insurance transactions, indicating potential transaction risks. Conversely, normal behavior types describe normal medical insurance transactions, indicating that the transaction is a legitimate medical insurance transaction with low risk. Therefore, the abnormal behavior detection result is used to describe either the detected behavior as abnormal or as normal.

[0080] Specifically, the server uses heterogeneous entity features to perform behavior category detection on the behavior to be detected corresponding to each behavior to be detected, in order to determine the abnormal behavior detection result corresponding to each behavior to be detected. That is, the server uses heterogeneous entity features to detect the behavior type of each behavior to be detected and determines the behavior type corresponding to each behavior to be detected. By determining whether the behavior to be detected is an abnormal behavior based on the behavior type corresponding to the behavior to be detected, the abnormal behavior detection of the behavior to be detected is completed.

[0081] In the above-mentioned abnormal behavior detection method based on graph data, since the heterogeneous entity graph data includes nodes with different node attributes and edges connecting each node, when extracting graph features, each node can obtain its own node attribute features and the node attribute features of other nodes with edges, and each edge can obtain its own edge attribute features and the edge attribute features of other edges that are adjacent to it. This allows the obtained heterogeneous entity features to include multi-dimensional features after aggregating information from each node and edge, thus taking into account more dimensional feature information when performing abnormal behavior detection, thereby improving the accuracy of abnormal behavior detection.

[0082] Since in practical applications there may be a possibility of abnormal behavior being detected from a team perspective, meaning that detecting and evaluating behavior solely from the perspective of an individual beneficiary may not be accurate enough, this application further considers team-level behavioral information for abnormal behavior detection: In one embodiment, such as Figure 4 As shown, after obtaining multiple behaviors to be detected through step 202, the abnormal behavior detection method based on graph data further includes:

[0083] Step 402: Construct homogeneous behavior graph data based on multiple behaviors to be detected. The homogeneous behavior graph data includes at least behavior nodes and behavior relationship edges.

[0084] The homogeneous behavior graph data includes at least behavior nodes and behavior relationship edges. Each behavior node corresponds to a specific behavior to be detected. Therefore, the node attributes of a behavior node must include at least the relevant attribute information of the beneficiary who initiated the behavior and the relevant attribute information of the service provider. Based on this, behavior relationship edges are used to describe that there is at least one common node attribute among the connected behavior nodes.

[0085] Specifically, a homogeneous behavior graph is constructed based on multiple behaviors to be detected. That is, the server constructs the behaviors to be detected as behavior nodes. Since each behavior to be detected describes the medical insurance transaction initiated by the beneficiary to the service provider, when there are the same beneficiary or the same service provider between two behaviors to be detected, behavior relationship edges are constructed between the behavior nodes corresponding to the aforementioned behaviors to construct the homogeneous behavior graph data.

[0086] For example, if behavior A1 describes a medical insurance transaction initiated by beneficiary B1 to service provider C1, and behavior A2 describes a medical insurance transaction initiated by beneficiary B2 to service provider C1, then there is a common service provider C1 between behaviors A1 and A2. Therefore, when constructing homogeneous behavior graph data, behavioral relationship edges can be constructed between the behavior node corresponding to behavior A1 and the behavior node corresponding to behavior A2. Alternatively, if there exists behavior A3 describing a medical insurance transaction initiated by beneficiary B3 to service provider C2, and behavior A4 describing a medical insurance transaction initiated by beneficiary B3 to service provider C3, then there is a common beneficiary B3 between behaviors A3 and A4. Therefore, when constructing homogeneous behavior graph data, behavioral relationship edges can be constructed between the behavior node corresponding to behavior A3 and the behavior node corresponding to behavior A4.

[0087] To facilitate understanding, further explanation will be provided based on the aforementioned examples, such as... Figure 5As shown, first, behavior node 501 corresponding to behavior A1, behavior node 502 corresponding to behavior A2, behavior node 503 corresponding to behavior A3, and behavior node 504 corresponding to behavior A4 are constructed. Further, after completing the construction of the behavior nodes, as shown in the previous example, behavior A1 and behavior A2 share the same node attribute (i.e., service provider C1), and behavior A3 and behavior A4 share the same node attribute (i.e., beneficiary B3). Therefore, behavior relationship edges 505 and 506 are constructed. Behavior relationship edge 505 describes the shared node attribute between behavior A1 and behavior A2, and behavior relationship edge 506 describes the shared node attribute between behavior A3 and behavior A4, thus obtaining homogeneous behavior graph data. It is understood that the above example is only for understanding this scheme and should not be construed as a specific limitation.

[0088] Step 404: Extract graph features from the homogeneous behavior graph data to obtain the team behavior features corresponding to each behavior node. The team behavior features are the evaluation parameter features for team-dimensional behavior.

[0089] Among them, team behavior characteristics are the evaluation parameters for team-level behavior. That is, team behavior characteristics are specifically used to describe the probability of whether the behavior to be detected belongs to team behavior, and the evaluation parameters are the probability of evaluating whether the behavior to be detected belongs to team behavior from the perspective of team-level behavior.

[0090] Specifically, the server extracts graph features from the homogeneous behavior graph data to obtain the team behavior characteristics corresponding to each behavior node. That is, the server performs team risk assessment on each behavior node in the homogeneous behavior graph data, and then aggregates information based on the team risk assessment results of each behavior node and the behavioral relationship edges between each behavior node to obtain the team behavior characteristics corresponding to each behavior node.

[0091] Based on this, behavior category detection is performed on the behavior corresponding to each edge of the behavior to be detected using heterogeneous entity features, including:

[0092] Step 406: Using the heterogeneous entity features and the behavioral features of each team, perform behavior category detection on the behavior to be detected corresponding to each behavior edge to be detected.

[0093] Specifically, the server uses heterogeneous entity features and team behavior features to jointly detect the behavior categories of each behavior to be detected from the dimensions of individual abnormal behavior and team abnormal behavior, so as to obtain the abnormal behavior detection results corresponding to each behavior to be detected.

[0094] In this embodiment, while ensuring that the individual-level feature information of each behavior is taken into account when performing abnormal behavior detection, the team behavior dimension is further taken into account. That is, the abnormal behavior detection is performed on the corresponding behavior of each behavior to be detected by combining the individual abnormal behavior dimension and the team abnormal behavior dimension, thereby ensuring that the abnormal behavior detection can be more realistic and accurate, so as to further improve the accuracy of abnormal behavior detection.

[0095] The following describes a specific method for extracting graph features from homogeneous behavioral graph data to obtain the team behavioral features corresponding to each behavioral node: In one embodiment, as follows Figure 6 As shown, team behavioral characteristics are specifically extracted using a feature extraction model.

[0096] Specifically, the server uses a pre-trained feature extraction model to extract graph features from homogeneous behavioral graph data, obtaining team behavioral features corresponding to each behavioral node. The method for obtaining the feature extraction model will be described in detail below, with an example of its application to the server. It is understood that this method can also be applied to terminals, and to systems including both terminals and servers, implemented through interaction between the terminal and server; no specific limitations are made here. In this embodiment, the method for obtaining the feature extraction model includes the following steps:

[0097] Step 602: Obtain homogeneous behavior graph samples, which include abnormal behavior node samples of abnormal behavior and sample edges connecting each behavior node sample.

[0098] Among them, the homogeneous behavior graph samples include abnormal behavior node samples of abnormal behavior, and the abnormal behavior node samples carry risk labels, as well as sample edges connecting each behavior node sample. It can be understood that the homogeneous behavior graph samples also include normal behavior node samples of normal behavior, that is, normal behavior node samples are samples that do not belong to team behavior.

[0099] Specifically, the server acquires homogeneous behavior graph samples. That is, the server first acquires multiple behavior samples that have undergone anomaly detection. Each anomaly-detected behavior sample corresponds to a specific behavior sample type, which includes both anomalous and normal behaviors. Therefore, the server can acquire homogeneous behavior graph samples based on multiple anomaly-detected behavior samples in a manner similar to the aforementioned embodiments. At this point, each behavior node sample has corresponding sample node attributes, and these attributes include the behavior sample type of the corresponding anomaly-detected behavior sample.

[0100] Step 604: Extract features from each abnormal behavior node sample in the homogeneous behavior graph sample to obtain the team behavior sample features of each abnormal behavior node sample.

[0101] Specifically, the server extracts features from each anomalous behavior node sample in the homogeneous behavior graph sample using an initial feature extraction model, thereby obtaining the team behavior sample features of each anomalous behavior node sample. In other words, the server extracts features from each anomalous behavior node sample in the homogeneous behavior graph sample using the initial feature extraction model, which involves calculating the team risk extension assessment parameters of each anomalous behavior node sample through the risk information transmission process between multiple anomalous behavior nodes, thus obtaining the team behavior sample features of each anomalous behavior node sample.

[0102] Step 606: Extract features from each abnormal behavior node sample in the homogeneous behavior graph sample to obtain the team behavior sample features of each abnormal behavior node sample.

[0103] The predicted behavior type can be either abnormal behavior or normal behavior. Specifically, the server uses the team behavior sample features of each abnormal behavior node sample to obtain the predicted behavior type of each abnormal behavior node sample through an initial feature extraction model. The initial feature extraction model specifically uses a fully connected layer to predict the predicted behavior type of each abnormal behavior node sample.

[0104] Step 608: Based on the predicted behavior type of each abnormal behavior node sample and the sample itself, update the model parameters of the initial feature extraction model to obtain the feature extraction model.

[0105] Specifically, since the purpose of the feature extraction model in this embodiment is to extract features corresponding to abnormal team behavior, the resulting feature extraction model needs to learn how to extract relevant feature information of abnormal behavior node samples. Therefore, the server updates the model parameters of the initial feature extraction model based on the predicted behavior type of each abnormal behavior node sample and the samples themselves.

[0106] Specifically, the server calculates the loss value between the predicted behavior type of each abnormal behavior node sample and the loss value between each abnormal behavior node sample. This loss value can be the mean squared error. Based on this, the server adjusts the model parameters of the initial feature extraction model using the aforementioned loss value. The server can determine whether the loss function of the initial feature extraction model has reached the convergence condition based on the loss value. If it has not reached the convergence condition, the server adjusts the model parameters of the initial feature extraction model using the loss value. This process continues until the loss function of the initial feature extraction model reaches the convergence condition. Then, the feature extraction model is obtained based on the model parameters obtained after the last adjustment. In practical applications, the pre-trained feature extraction model is used to extract features from each behavior node in a homogeneous behavior graph, obtaining the team behavior features of each behavior node.

[0107] In this embodiment, feature extraction is performed using a pre-trained feature extraction model to ensure the reliability and accuracy of the team behavior features of each behavior node. Furthermore, during the specific acquisition process of the feature extraction model, feature extraction is performed on samples of abnormal behavior nodes so that the feature extraction model can learn the risk information transmission process between multiple abnormal behavior nodes. This allows the model to learn how to extract features in the dimension of team behavior, thereby ensuring the reliability of the features obtained based on the feature extraction model and further guaranteeing the reliability and accuracy of the team behavior features of each behavior node.

[0108] The following details the process of feature extraction from anomalous behavior nodes in a homogeneous behavior graph: In one embodiment, as follows... Figure 7 As shown, feature extraction is performed on each abnormal behavior node sample in the homogeneous behavior graph sample to obtain the team behavior sample features of each abnormal behavior node sample, including:

[0109] Step 702: Construct the first sample adjacency matrix corresponding to the homogeneous behavior graph samples, and calculate the second sample adjacency matrix corresponding to each abnormal behavior node sample.

[0110] The first sample adjacency matrix describes the adjacency relationship between each behavior node sample in a homogeneous behavior graph sample pair, while the second sample adjacency matrix describes the adjacency relationship between each abnormal behavior node sample in a homogeneous behavior graph sample pair.

[0111] Specifically, the server first constructs the first sample adjacency matrix A corresponding to homogeneous behavior graph samples by using the connection relationships between the behavior node samples. C Then, the adjacency matrix of the first sample is calculated and analyzed by the connection relationship between each abnormal behavior node sample in the homogeneous behavior graph sample, so as to obtain the adjacency matrix of the second sample corresponding to each abnormal behavior node sample.

[0112] Step 704: Perform directed selection on each abnormal behavior node sample in the homogeneous behavior graph sample to obtain the abnormal node sample neighborhood set corresponding to each abnormal behavior node sample. The abnormal node sample neighborhood set includes: abnormal behavior node neighborhood samples that have sample edges with the corresponding abnormal behavior node samples.

[0113] The abnormal node sample neighborhood set includes: abnormal behavior node neighborhood samples that have sample edges with the corresponding abnormal behavior node samples. The aforementioned abnormal behavior node neighborhood samples can be: behavior node samples that have sample edges with abnormal behavior node samples, and abnormal behavior node neighborhood samples can also be: the next adjacent behavior node samples of behavior node samples that have sample edges with abnormal behavior node samples.

[0114] Specifically, the server performs directed selection on each abnormal behavior node sample in the homogeneous behavior graph to obtain the neighborhood set of each abnormal behavior node sample. The aforementioned directed selection specifically refers to the biased random walk in Node2Vec. That is, the server uses the biased random walk in Node2Vec to explore the neighborhood of each abnormal behavior node sample. In other words, the biased random walk method is used to determine the neighborhood samples of abnormal behavior nodes that are adjacent to the abnormal behavior node samples. The aforementioned adjacent relationship can be one-hop adjacent or multi-hop adjacent. One-hop adjacent describes that there is one adjacent sample edge between two behavior nodes, while multi-hop adjacent describes that there are multiple adjacent sample edges between two behavior nodes. If it is three-hop adjacent, it means that there are three adjacent sample edges between two behavior nodes.

[0115] For example, a homogeneous behavior graph sample includes behavior node sample D1, behavior node sample D2, behavior node sample D3, behavior node sample D4, and behavior node sample D5. Furthermore, there is a sample edge between behavior node sample D1 and behavior node sample D2, a sample edge between behavior node sample D2 and behavior node sample D3, and a sample edge between behavior node sample D4 and behavior node sample D5. If behavior node sample D1 is an anomalous behavior node sample, then the anomalous node sample neighborhood set corresponding to anomalous behavior node sample D1 includes at least: behavior node sample D2 that has a sample edge with anomalous behavior node sample D1, and behavior node sample D3 that has a sample edge with behavior node sample D2. It should be understood that the above examples are only for understanding this scheme and should not be construed as specific limitations.

[0116] Step 706: Expand the second sample adjacency matrix by using the neighborhood set of each abnormal node sample to obtain the third sample adjacency matrix corresponding to each abnormal behavior node sample.

[0117] The third sample adjacency matrix is ​​a matrix used to describe the adjacency relationship between each abnormal behavior node sample and its neighboring samples.

[0118] Specifically, the server can determine the adjacency relationships between samples in the neighborhood of each abnormal node that have at least one hop edge with the sample in the neighborhood of the abnormal behavior node. Therefore, the second sample adjacency matrix of each abnormal behavior node can be expanded using the neighborhood set of each abnormal node sample to obtain the third sample adjacency matrix corresponding to each abnormal behavior node sample. In other words, the server establishes direct links between an abnormal behavior node sample and its neighboring samples, and expands the second sample adjacency matrix to obtain the third sample adjacency matrix A′ corresponding to each abnormal behavior node sample. C .

[0119] Step 708: Perform matrix row normalization on the adjacency matrix of the third sample corresponding to each abnormal behavior node sample to obtain the risk propagation sample matrix corresponding to each abnormal behavior node sample.

[0120] Specifically, the server performs matrix row normalization on the adjacency matrix of the third sample corresponding to each abnormal behavior node sample to obtain the risk propagation sample matrix corresponding to each abnormal behavior node sample. After obtaining the neighborhood set of abnormal node samples, the server can also record the original hop distance between abnormal behavior node samples and their neighboring samples, that is, how many originally adjacent sample edges are between abnormal behavior node samples and their neighboring samples. Taking the above example, the neighborhood set of abnormal behavior node samples corresponding to abnormal behavior node sample D1 includes at least: behavior node sample D2 and behavior node sample D3. There is 1 adjacent edge between abnormal behavior node sample D1 and behavior node sample D2, so the original hop distance between abnormal behavior node sample D1 and behavior node sample D2 is 1. Similarly, there are 2 adjacent edges between abnormal behavior node sample D1 and behavior node sample D3, so the original hop distance between abnormal behavior node sample D1 and behavior node sample D2 is 2. It should be understood that the above example is only used to understand this scheme and should not be construed as a specific limitation.

[0121] Therefore, after recording the original jump distance between the abnormal behavior node sample and its neighboring samples, the server calculates the team risk expansion assessment parameters for the connected abnormal behavior node samples and their neighboring samples in the third sample adjacency matrix. Specifically, the server first calculates the cosine similarity between the abnormal behavior node sample and its neighboring samples, then multiplies the original jump distance between the abnormal behavior node sample and its neighboring samples with the first hyperparameter, and finally calculates the V between the abnormal behavior node sample and its neighboring samples. j C The cosine similarity between them and the abnormal behavior node sample V i C The ratio of the product of the original jump distance between the abnormal behavior node and the neighborhood samples to the first hyperparameter is used to calculate the team risk expansion assessment parameter. The aforementioned calculation process is illustrated in formula (1):

[0122]

[0123] Among them, V i c V is a sample of nodes exhibiting abnormal behavior. j c The adjacency matrix A′ of the third sample CSample V of abnormal behavior nodes i c Connected neighborhood samples of nodes exhibiting abnormal behavior, Risk ij For V i c and V j c Team risk expansion assessment parameters, sim(V) i C V j C ) is V i C and V j C Cosine similarity between them, hop ij For V i c and V j c The original jump distance between them, γ is the first hyperparameter, which is used to adjust the weights of the numerator and denominator.

[0124] Furthermore, the server can record the connectivity between each node sample in each third sample adjacency matrix using the calculation method exemplified in formula (1). Then, the server specifically performs matrix row normalization on the third sample adjacency matrix based on the connectivity between each node sample in the third sample adjacency matrix to obtain the risk propagation sample matrix R corresponding to each abnormal behavior node sample. C .

[0125] Step 710: Perform risk expansion calculations using each risk propagation sample matrix to determine the team behavior sample characteristics of each abnormal behavior node sample.

[0126] Specifically, the server uses each risk propagation sample matrix R C Risk expansion calculations are performed to determine the team behavior sample characteristics of each abnormal behavior node sample. In other words, the server performs risk expansion calculations through each risk propagation sample matrix to determine the risk expansion parameters corresponding to each abnormal behavior node sample. Then, information is aggregated through the risk expansion parameters corresponding to each abnormal behavior node sample to obtain the team behavior sample characteristics of each abnormal behavior node sample.

[0127] Based on this, the server denotes the risk label vector corresponding to the node type of each node sample in each risk propagation sample matrix as Y. r (k) Then, the risk label vector Y of the node samples that have been identified as abnormal behavior is... r (0)The risk propagation parameter is set to 1, and the remaining node samples that are not identified as abnormal behavior are set as hyperparameters ∈ (∈≥0) for adjustment to obtain the risk propagation parameter. Specifically, the server performs a product calculation using the risk label vector of the node sample obtained in the (k-1)th iteration, the risk propagation sample matrix, and the random jump coefficient. Then, it performs a product calculation using the random jump coefficient and the risk label vector of the node sample that has been identified as abnormal behavior. Finally, it sums the results of the aforementioned product calculation to obtain the risk label vector of the node sample obtained in the kth iteration. The aforementioned calculation process is illustrated in formula (2).

[0128] Y r (k) =(1-α)R C Y r (k-1) +α Y r (0) (2)

[0129] Among them, Y r (k) Y is the risk label vector of the node sample obtained in the k-th iteration. r (k-1) Let R be the risk label vector of the node sample obtained in the (k-1)th iteration. C Let be the risk propagation sample matrix, k be the number of iterations, and α be the random jump coefficient. Also, α ∈ (0, 1), where α is a hyperparameter.

[0130] Based on this, the server determines the risk label vector of the node sample obtained in the k-th iteration as the risk expansion parameter, and the aforementioned calculation process is specifically illustrated in formula (3):

[0131] Y Risk =Y r (k) (3)

[0132] Among them, Y Risk For risk extension parameters, Y r (k) Let be the risk label vector of the node sample obtained in the k-th iteration.

[0133] For ease of understanding, such as Figure 8 As shown, in Figure 8 First, risk propagation 802 is carried out, which means that the risk label vector Y is transmitted through the aforementioned process. r (0) In the risk propagation sample matrix R C Propagation occurs during this process, as shown in the aforementioned formula (2), which yields samples of each abnormal behavior node within the risk propagation sample matrix R. CThe risk label vector after risk propagation is then processed, and then feature merging (804) is performed on the risk label vector. Specifically, the risk propagation sample matrix R is... C The risk expansion parameter T can be obtained by multiplying and summing the risk label vectors of each abnormal behavior node sample after risk propagation. Risk .

[0134] In this embodiment, by combining abnormal behavior node samples with graph structure information, the risk label of each abnormal behavior node sample is propagated based on homogeneous behavior graph samples, thereby obtaining the risk extension parameters corresponding to each abnormal behavior node sample. Through the propagation of risk extension parameters, the risk labels of abnormal behavior node samples can be better applied to the pre-training steps of the team dimension, so that the model obtained by pre-training can accurately learn the risk feature information of the team dimension, thereby improving the reliability and accuracy of team behavior feature acquisition.

[0135] In one embodiment, such as Figure 9 As shown, risk expansion calculations are performed using each risk propagation sample matrix to determine the team behavior sample characteristics of each abnormal behavior node sample, including:

[0136] Step 902: Perform risk expansion calculations using each risk propagation sample matrix to determine the initial team behavior sample characteristics of each abnormal behavior node sample.

[0137] Specifically, the server performs risk expansion calculations using each risk propagation sample matrix to determine the risk expansion parameters corresponding to each abnormal behavior node sample. These risk expansion parameters are the initial team behavior sample features. The specific steps are similar to those in the aforementioned embodiments and will not be repeated here.

[0138] Step 904: Calculate the self-loop adjacency matrix corresponding to each abnormal behavior node sample through the risk propagation sample matrix, and calculate the diagonal node degree matrix corresponding to each abnormal behavior node sample based on their respective loop adjacency matrices.

[0139] Specifically, the server calculates the self-loop adjacency matrix corresponding to each abnormal behavior node sample through the risk propagation sample matrix, and calculates the diagonal node degree matrix corresponding to each abnormal behavior node sample based on its respective loop adjacency matrix. Specifically, the server adds a self-loop to each abnormal behavior node sample, and then calculates the first sample adjacency matrix A corresponding to the homogeneous behavior graph samples. C The second sample adjacency matrix I corresponding to each abnormal behavior node sample C Summation is performed to obtain the self-loop adjacency matrix corresponding to each abnormal behavior node sample. The specific calculation process described above is illustrated in formula (4):

[0140]

[0141] in, Let A be a self-loop adjacency matrix. C Let I be the adjacency matrix of the first sample. C This is the adjacency matrix of the second sample.

[0142] Therefore, the server then performs degree matrix calculation on the self-loop adjacency matrix to obtain the degree matrix of the diagonal nodes corresponding to each abnormal behavior node sample.

[0143] Step 906: Perform layer-by-layer normalization aggregation based on the initial team behavior sample features of each ring adjacency matrix, each diagonal node degree matrix, and each abnormal behavior node sample to obtain team behavior sample features.

[0144] Specifically, the team behavior sample features are obtained by performing layer-by-layer normalization aggregation based on the respective ring adjacency matrices, the degree matrices of each diagonal node, and the initial team behavior sample features of each anomalous behavior node sample. Since each node sample in the ring adjacency matrix is ​​adjacent to its own neighboring node samples, each node sample will also include its own features in the process of summing the features of its neighboring nodes. Furthermore, in order to incorporate the inductive bias of team-dimensional risk into the specific behavior detection task, the server uses a Global Graph Attention (GAT) network to learn the gang risk feature representation (i.e., team behavior sample features) of each anomalous behavior node sample.

[0145] Based on this, the server performs layer-by-layer normalization and aggregation on the self-loop adjacency matrix, the diagonal node degree matrix, and the initial team behavior sample features to obtain the team behavior sample features. The aforementioned calculation process is illustrated in formula (5):

[0146]

[0147] Among them, H c (l+1) For team behavior sample features, It is a self-loop adjacency matrix. W is the degree matrix of the diagonal nodes. c (l) Features of the initial team behavior samples.

[0148] In this embodiment, by using a self-loop adjacency matrix and a diagonal node degree matrix, each node sample will include its own features when summing the features of its neighboring nodes during the risk propagation process. This ensures the integrity and reliability of the information in the team behavior sample features. Furthermore, it can incorporate the inductive bias of team-dimensional risk into specific behavior detection tasks, thereby improving the evaluation of multi-dimensional information for abnormal behavior detection in practical applications and further enhancing the reliability and accuracy of abnormal behavior detection.

[0149] The following section details a method for extracting graph features from heterogeneous entity graph data: In one embodiment, such as... Figure 10 As shown, graph feature extraction is performed on heterogeneous entity graph data to obtain heterogeneous entity features, including:

[0150] Step 1002: Extract node features from each beneficiary node and each service provider node in the heterogeneous entity graph data to obtain the attribute features of each node.

[0151] Specifically, the server encodes the node attributes of each beneficiary node in the heterogeneous entity graph data to obtain the node attribute features corresponding to each beneficiary node. Similarly, the server encodes the node attributes of each service provider node in the heterogeneous entity graph data to obtain the node attribute features of each service provider node.

[0152] Furthermore, the server needs to consider the importance of the node-to-node attribute features of each node's neighboring nodes, as well as the importance of the edge-to-edge attribute features of each behavior's adjacent edges. Therefore, the server can employ a multi-head self-attention mechanism to encode the hidden feature information of each beneficiary node, each service provider node, and each edge of the behavior to be detected, in order to obtain the attribute features of each node and each edge. That is, each behavior node can be determined from the heterogeneous entity graph data. neighboring nodes Neighbor nodes Is it behavior with neighbors? There are nodes connected by behavioral edges, which can be either one-hop nodes or multi-hop nodes. The definitions of one-hop and multi-hop are similar to those in the previous embodiments and are not limited here.

[0153] Based on this, for any behavior node In other words, the server first processes the behavior nodes. Weight matrix, behavior nodes neighboring nodes The weight matrix is ​​concatenated, and the result of the concatenation operation is then subjected to exponential operation to obtain the first exponential result. Specifically, the exponential operation is a Leakyrelu nonlinear function operation. Next, the server again performs operations on the first pair of row nodes. The weight matrix, another neighbor node of the behavior node The weight matrices are concatenated, and the results of the concatenation are then subjected to exponential operations to obtain a second exponential result. The ratio between the first and second exponential results is calculated to obtain the behavior nodes. The node attribute characteristics, the calculation process described above is illustrated in formula (6):

[0154]

[0155] in, For behavior nodes Node attribute characteristics, W b For behavior nodes The weight matrix, and and W p The neighboring nodes of the behavior node The weight matrix, and u is the attention parameter, σ represents the Leakyrelu nonlinear function, and || represents the cascade operation.

[0156] Based on this, taking the beneficiary node as an example, the server generates the attention coefficients between the beneficiary node and its neighboring nodes using formula (6). Finally, the node attribute features corresponding to the beneficiary node are obtained by weighted summation of the obtained attention coefficients. It is understood that the server can also use a single-head attention mechanism to encode the hidden feature information of each beneficiary node and each service provider node, and this application does not specifically limit this.

[0157] Step 1004: Extract edge features from each edge of the behavior to be detected in the heterogeneous entity graph data to obtain the attribute features of each edge.

[0158] Specifically, the server encodes the edge attributes of each edge to be detected in the heterogeneous entity graph data to obtain the edge attribute features corresponding to each edge to be detected. Furthermore, the server needs to consider the importance of the edge attribute features of edges adjacent to each edge. Therefore, the server can employ a multi-head self-attention mechanism to encode the hidden layer feature information of each edge to be detected to obtain the edge attribute features.

[0159] It is understandable that the specific method for encoding the hidden feature information of each behavior edge to be detected is similar to the method for encoding nodes in step 1002, and will not be elaborated here. Furthermore, the server can also use a single-head attention mechanism to encode the hidden feature information of each behavior edge to be detected; this application does not specifically limit this approach.

[0160] Step 1006: Aggregate information based on the heterogeneous entity graph data, the attribute features of each node, and the attribute features of each edge to obtain the heterogeneous entity features.

[0161] Specifically, the server aggregates information based on the heterogeneous entity graph data, the attribute features of each node, and the attribute features of each edge to obtain the heterogeneous entity features. In other words, after obtaining the attribute features of each node and each edge, the server performs feature message passing based on the heterogeneous entity graph data to obtain the heterogeneous entity features.

[0162] In this embodiment, feature extraction is performed through a self-attention mechanism. The obtained node attribute features and edge attribute features can also include attribute information between the node and its neighboring nodes and the edge and its neighboring edges. This allows the node attribute features and edge attribute features to include more complete feature information. Information aggregation is then performed to ensure the integrity of multidimensional feature information in heterogeneous entity features, thereby further improving the reliability and accuracy of subsequent abnormal behavior detection.

[0163] The following sections will describe methods for information aggregation to obtain beneficiary characteristics, service provider characteristics, and behavioral characteristics from heterogeneous entity features: In one embodiment, as follows... Figure 11 As shown, information is aggregated based on heterogeneous entity graph data, node attribute features, and edge attribute features to obtain heterogeneous entity features, including:

[0164] Step 1102: Construct an adjacency matrix based on the heterogeneous entity graph data. The adjacency matrix is ​​used to describe the adjacency relationship between each node.

[0165] The adjacency matrix describes the adjacency relationships between each node. Specifically, the server constructs the adjacency matrix based on the heterogeneous entity graph data. That is, after constructing the heterogeneous entity graph data, the server can determine the adjacency matrix corresponding to the heterogeneous entity graph data based on the beneficiary nodes, service provider nodes, and edges of the behavior to be detected in the heterogeneous entity graph data, and label the adjacency matrix corresponding to the heterogeneous entity graph data as A1.

[0166] The server determines the adjacency matrix as follows: If there is an edge indicating a behavior to be detected between a beneficiary node and a service provider node, it indicates an adjacency relationship between them. Therefore, the value at the corresponding position in adjacency matrix A1 is 1. If there is no edge indicating a behavior to be detected between two nodes in the heterogeneous entity graph data, meaning there is no adjacency relationship between them, the value at the corresponding position in adjacency matrix A1 is 0. Based on this, adjacency matrix A1 can be obtained by recognizing that all nodes in the heterogeneous entity graph data have adjacency relationships. It can be understood that the nodes without an edge indicating a behavior to be detected can be either a beneficiary node and a service provider node, or a beneficiary node and another beneficiary node, or a service provider node and another service provider node; this is not limited here.

[0167] Step 1104: Perform matrix calculation on the adjacency matrix to obtain the first adjacency matrix corresponding to each beneficiary node.

[0168] The first adjacency matrix describes the adjacency relationships between beneficiary nodes. Specifically, the server can also obtain the first mask matrix corresponding to each beneficiary node. The first mask matrix corresponds to the type of the beneficiary node, and its size is the same as the adjacency matrix. The first mask matrix is ​​also composed of "0"s and "1"s, but the distribution of "0"s and "1"s in the first mask matrix varies depending on the type of information required for aggregation. Therefore, based on the characteristics corresponding to the beneficiary nodes, the values ​​at positions in the first mask matrix corresponding to beneficiary nodes can be set to 1, and the values ​​at positions corresponding to service provider nodes can be set to 0. This yields the first mask matrix corresponding to the beneficiary nodes. By multiplying the first mask matrix corresponding to each beneficiary node with the adjacency matrix, the first adjacency matrix corresponding to the beneficiary node can be obtained.

[0169] Step 1106: Based on each first adjacency matrix and the Lth layer node attribute features of each beneficiary node, the L+1th layer node attribute features of each beneficiary node are obtained by feature merging, where L is a positive integer.

[0170] When L=1, the first-level node attribute characteristics of the beneficiary node are the node attribute characteristics of the beneficiary node.

[0171] Specifically, based on the first adjacency matrices and the Lth-level node attribute features of each beneficiary node, the server calculates the (L+1)th-level node attribute features of each beneficiary node, where L is a positive integer. That is, the server first... This is represented as a connection to the beneficiary node. Service Provider Node The edge set between them Represents the beneficiary node Service Provider Node The number of edges representing the behaviors to be detected is concentrated in the edge set between them. Therefore, through the beneficiary nodes... The beneficiary node can be obtained by multiplying the hidden state of the node in layer (L-1) with the first transformation parameter matrix. The hidden state of a node in layer L is calculated as illustrated in formula (7):

[0172]

[0173] in, beneficiary nodes The hidden states of nodes in layer L (i.e., the attribute features of nodes in layer L). beneficiary nodes In the hidden state of a node at layer (L-1), W1 is the first transformation parameter matrix.

[0174] Furthermore, the server can also perform transformations on the beneficiary nodes based on the second transformation parameter matrix. The hidden states of nodes in each layer are aggregated to obtain the beneficiary nodes. The neighbor node aggregation feature, the calculation process described above is illustrated in formula (8):

[0175]

[0176] in, for The neighbor node aggregation features are defined, and W2 is the second transformation parameter matrix. Wherein,

[0177] Similarly, the server can also perform transformations on beneficiary nodes based on the third transformation parameter matrix. The hidden states of the neighboring nodes are aggregated to obtain the beneficiary nodes. The adjacent edge aggregation feature, the calculation process described above is illustrated in formula (9):

[0178]

[0179] in, for The neighbor-edge aggregation feature is the third transformation parameter matrix. Wherein,

[0180] Based on this, the server then merges the features passed in formulas (7) to (9) to obtain the node attribute features of the beneficiary node at layer L+1, which is the server's attribute features of the beneficiary node. The hidden state of the node in layer L, the aggregation features of neighboring nodes, and the aggregation features of adjacent edges are summed to obtain the node attribute features of the beneficiary node in layer L+1. The aforementioned calculation process is illustrated in formula (10).

[0181]

[0182] in, For the attribute features of the L+1th layer node, for The aggregation characteristics of neighboring nodes for The neighboring edge aggregation feature, for The hidden state of a node in the Lth layer.

[0183] Step 1108: When L is the number of layers in the heterogeneous entity graph data, the node attribute features of each beneficiary node in the (L+1)th layer are determined as the beneficiary features in the heterogeneous entity features. The number of layers in the heterogeneous entity graph data is determined by the number of edges of the behavior to be detected in the heterogeneous entity graph data.

[0184] The number of layers in the heterogeneous entity graph data is determined by the number of edges representing behaviors to be detected in the heterogeneous entity graph data. Specifically, the server performs a similar step to step 1106 on the node attribute features of each layer of the beneficiary node. When L is the number of layers in the heterogeneous entity graph data, the node attribute features of the (L+1)th layer of each beneficiary node are respectively determined as the beneficiary features in the heterogeneous entity features.

[0185] In this embodiment, by re-aggregating the message passing of the attribute features of each layer of nodes, the input features of the nodes are mapped to the high-level representation and the deep structural relationships are captured. This results in the beneficiary features having deeper and more complete information, providing more in-depth and complete feature information for subsequent behavior detection, and further improving the accuracy of abnormal behavior detection.

[0186] In one embodiment, such as Figure 12 As shown, information aggregation is performed based on heterogeneous entity graph data, the attribute features of each node, and the attribute features of each edge to obtain heterogeneous entity features. This also includes:

[0187] Step 1202: Perform matrix calculation on the adjacency matrix to obtain the second adjacency matrix corresponding to each service provider node.

[0188] The second adjacency matrix describes the adjacency relationships between service provider nodes. Specifically, the server can also obtain the second mask matrix corresponding to each service provider node. The second mask matrix corresponds to the type of the service provider node, and its size is the same as the adjacency matrix. The second mask matrix is ​​also composed of "0"s and "1"s, but the distribution of "0"s and "1"s in the second mask matrix varies depending on the type of information required for aggregation. Therefore, based on the characteristics corresponding to the service provider nodes, the values ​​at positions in the second mask matrix corresponding to the service provider node type can be set to 1, and the values ​​at positions corresponding to the service provider node type can be set to 0. This yields the second mask matrix corresponding to the service provider node. By multiplying the second mask matrix corresponding to each service provider node with the adjacency matrix, the second adjacency matrix corresponding to the service provider node can be obtained.

[0189] Step 1204: Based on each second adjacency matrix and the Lth layer node attribute features of each service provider node, the L+1th layer node attribute features of each service provider node are obtained through feature merging.

[0190] When L=1, the first-level node attribute characteristics of the service provider node are the same as the node attribute characteristics of the service provider node.

[0191] Specifically, the server uses a similar method to step 1106 to obtain the L+1 level node attribute features of each service provider node by merging features based on each second adjacency matrix and the L-th level node attribute features of each service provider node, which will not be elaborated here.

[0192] Step 1206: When L is the number of layers in the heterogeneous entity graph data, the attribute features of the L+1th layer nodes of each service provider node are respectively determined as the service provider features in the heterogeneous entity features.

[0193] Specifically, when L is the number of layers in the heterogeneous entity graph data, the server uses a method similar to step 1108 to determine the L+1 layer node attribute features of each service provider node as the service provider features in the heterogeneous entity features. The details will not be elaborated here.

[0194] In this embodiment, the input features of the service provider nodes are further mapped to the high-level representation and the deep structural relationships are captured by re-aggregating the message passing of the layer node attribute features of each service provider node. This results in the service provider features having deeper and more complete information, providing more in-depth and complete feature information for subsequent behavior detection, and further improving the accuracy of abnormal behavior detection.

[0195] In one embodiment, such as Figure 13 As shown, information aggregation is performed based on heterogeneous entity graph data, the attribute features of each node, and the attribute features of each edge to obtain heterogeneous entity features. This also includes:

[0196] Step 1302: Perform matrix calculation on the adjacency matrix to obtain the third adjacency matrix corresponding to each edge of the behavior to be detected.

[0197] The third adjacency matrix describes the adjacency relationships between edges of the detected behaviors. Specifically, the server can also obtain the third mask matrix corresponding to each edge of the detected behavior. The third mask matrix corresponds to the type of the edge being detected, and its size is the same as the adjacency matrix. The third mask matrix is ​​also composed of "0"s and "1"s, but the distribution of "0"s and "1"s in the third mask matrix varies depending on the type of information required for aggregation. Therefore, based on the features corresponding to the edges of the detected behaviors, the values ​​at the positions corresponding to the edges of the detected behaviors in the third mask matrix can be set to 1, and the values ​​at the positions corresponding to the edges of the detected behaviors that do not exist can be set to 0. This yields the third mask matrix corresponding to the edges of the detected behaviors. By multiplying the third mask matrix corresponding to each edge of the detected behavior with the adjacency matrix, the third adjacency matrix corresponding to the edge of the detected behavior can be obtained.

[0198] Step 1304: Based on each third adjacency matrix and the Lth layer edge attribute features of each edge to be detected, the L+1th layer edge attribute features of each edge to be detected are obtained by feature merging.

[0199] When L=1, the first layer of edge attribute features of the behavior edge to be detected are the edge attribute features of the behavior edge to be detected.

[0200] Specifically, the server obtains the (L+1)th layer edge attribute features of each detected behavior edge by feature merging based on the third adjacency matrix and the Lth layer edge attribute features of each detected behavior edge, where L is a positive integer. That is, this scheme also needs to construct an update function based on edge attributes to generate edge attribute features containing higher-order information of node entities. Specifically, the server performs concatenation operations on each third adjacency matrix and the Lth layer edge attribute features of each detected behavior edge based on the learnable parameter matrix during edge feature embedding update to obtain the (L+1)th layer edge attribute features. The aforementioned calculation process is specifically illustrated in formula (11):

[0201]

[0202] in, For the edge attribute features of the (L+1)th layer, For the edge attribute features of the Lth layer, Characteristics of beneficiaries at level L. For the characteristics of the Lth layer service provider, We This is the learnable parameter matrix used for edge feature embedding updates.

[0203] Step 1306: When L is the number of layers in the heterogeneous entity graph data, the L+1th layer edge attribute features of each behavior edge to be detected are respectively determined as each behavior feature in the heterogeneous entity features.

[0204] Specifically, the server performs similar steps as in step 1304 for each layer of edge attribute features of the behavior to be detected. When L is the number of layers in the heterogeneous entity graph data, the L+1th layer edge attribute features of each behavior to be detected are respectively determined as each behavior feature in the heterogeneous entity features.

[0205] In this embodiment, cascading operations are used to aggregate messages, and more complex features can be learned from the input space through multi-layer stacking, better encoding structural information, thereby obtaining more complete and accurate behavioral features, providing more in-depth and complete feature information for subsequent behavior detection, and further improving the accuracy of abnormal behavior detection.

[0206] In one embodiment, such as Figure 14 As shown, by using heterogeneous entity features, behavior category detection is performed on the behavior to be detected corresponding to each behavior edge, in order to obtain the abnormal behavior detection results corresponding to each behavior to be detected, including:

[0207] Step 1402: Analyze the abnormal behavior of each edge to be detected by using the characteristics of each beneficiary, each service provider, and each behavior to obtain the probability that each edge to be detected belongs to an abnormal behavior edge.

[0208] Specifically, the server performs abnormal behavior analysis on each edge to be detected by using the characteristics of each beneficiary, each service provider, and each behavior. In other words, it classifies the edges to be detected by using the characteristics of each beneficiary, each service provider, and each behavior to determine the probability that an edge to be detected belongs to an abnormal behavior edge.

[0209] Furthermore, as can be seen from the aforementioned embodiments, abnormal behavior prediction can also be considered by considering team behavioral characteristics. Therefore, the server specifically performs feature concatenation calculation on the characteristics of each beneficiary, each service provider, each behavioral characteristic, and each team behavioral characteristic to obtain the probability that each detected behavior edge belongs to an abnormal behavior edge. The aforementioned calculation process is specifically illustrated in formula (12):

[0210]

[0211] in, Z represents the probability of an edge belonging to abnormal behavior. B As a beneficiary characteristic, Z CZ is a service provider characteristic. P For behavioral characteristics, and Z R These are characteristics of team behavior.

[0212] For ease of understanding, the specifics are as follows: Figure 15 As shown, firstly, heterogeneous entity graph data 1501 and homogeneous behavior graph data 1502 are constructed. Then, graph feature extraction is performed on the heterogeneous entity graph data 1501 to obtain heterogeneous entity features, namely, beneficiary features 1503, service provider features 1504, and behavior features 1505. Next, graph feature extraction is performed on the homogeneous behavior graph data 1502 to obtain team behavior features 1506. Then, beneficiary features 1503, service provider features 1504, behavior features 1505, and team behavior features 1506 are concatenated. The concatenated feature information is then used to calculate the probability 1507 of each detected behavior edge belonging to an abnormal behavior edge through a multilayer perceptron (MLP). The above example is only for understanding this scheme and should not be construed as a limitation of this scheme.

[0213] Step 1404: Classify the behavior by the probability that each behavior edge to be detected belongs to an abnormal behavior edge, so as to determine the abnormal behavior classification result of each behavior edge to be detected.

[0214] Specifically, the server classifies behaviors based on the probability that each detected behavior edge belongs to an abnormal behavior edge, thus determining the abnormal behavior classification result for each detected behavior edge. That is, the server classifies detected behavior edges whose probability of belonging to an abnormal behavior edge is greater than an abnormal behavior threshold as abnormal behavior edges. Conversely, it classifies detected behavior edges whose probability of belonging to an abnormal behavior edge is less than an abnormal behavior threshold as normal behavior edges.

[0215] Step 1406: Determine the detection results of each abnormal behavior based on the abnormal behavior classification results of each edge to be detected.

[0216] Specifically, the server determines whether an edge to be detected is an abnormal behavior edge or a normal behavior edge based on the abnormal behavior classification results of each edge to be detected, thereby determining the abnormal behavior detection result of the corresponding behavior. When an edge to be detected is an abnormal behavior edge, the corresponding behavior to be detected is abnormal behavior; similarly, when an edge to be detected is a normal behavior edge, the corresponding behavior to be detected is normal behavior.

[0217] In this embodiment, multi-dimensional features are aggregated through cascading operations. Since each feature is obtained by superimposing multiple layers, each feature can provide more complex and complete feature information, thereby improving the accuracy of abnormal behavior detection.

[0218] Based on the detailed description of the foregoing embodiments, the complete process of the abnormal behavior detection method based on graph data in the embodiments of this application will be described below. In one embodiment, such as Figure 16 As shown, an abnormal behavior detection method based on graph data is provided, which can be applied to... Figure 1 The method is illustrated using server 104 as an example. It is understood that this method can also be applied to terminal 102, and to a system including terminal 102 and server 104, and is implemented through the interaction between terminal 102 and server 104. In this embodiment, the method includes the following steps:

[0219] Step 1601: Obtain multiple behaviors to be detected.

[0220] The "benefit to be detected" describes the medical insurance transaction initiated by the beneficiary to the service provider. In actual medical insurance scenarios, the beneficiary specifically refers to the medical insurance recipient, which can be the insured or the patient, etc. The service provider specifically refers to the medical insurance service provider, which can be a medical insurance service provider institution or company, etc., without limitation. Generally speaking, a medical insurance transaction is a transaction in which the beneficiary initiates a payment transaction request to the service provider, requesting the service provider to provide the beneficiary with medical insurance-related fees.

[0221] Specifically, in cases where a beneficiary incurs medical expenses due to illness, injury, or other reasons, the beneficiary may initiate a medical insurance transaction with the service provider. In order to determine whether the medical insurance transaction is a normal medical insurance transaction and to ensure that the service provider can provide accurate and reliable medical insurance reimbursement, the server identifies the aforementioned medical insurance transaction initiated by the beneficiary with the service provider as a behavior to be detected, that is, a medical insurance transaction to be detected as an abnormal behavior.

[0222] Step 1602: Construct heterogeneous entity graph data based on multiple behaviors to be detected.

[0223] The heterogeneous entity graph data includes at least: beneficiary nodes corresponding to beneficiaries, service provider nodes corresponding to service providers, and edges for connecting beneficiary nodes and service provider nodes to be detected, wherein the aforementioned edges for the behavior to be detected correspond to the behavior to be detected.

[0224] Specifically, the service area constructs heterogeneous entity graph data based on multiple behaviors to be detected. That is, the server constructs beneficiary nodes based on the beneficiaries described in each behavior to be detected, and similarly, the server constructs service provider nodes based on the service providers described in each behavior to be detected. Then, each behavior to be detected is identified as an edge connecting the beneficiary nodes and the service provider nodes, thereby constructing the heterogeneous entity graph data.

[0225] Step 1603: Extract features from each beneficiary node, each service provider node, and each edge of the behavior to be detected in the heterogeneous entity graph data to obtain the attribute features of each node and the attribute features of each edge.

[0226] Specifically, the server encodes the node attributes of each beneficiary node in the heterogeneous entity graph data to obtain the node attribute features corresponding to each beneficiary node. Similarly, the server encodes the node attributes of each service provider node in the heterogeneous entity graph data to obtain the node attribute features of each service provider node. Additionally, the server encodes the edge attributes of each edge of the behavior to be detected in the heterogeneous entity graph data to obtain the edge attribute features corresponding to each edge of the behavior to be detected.

[0227] Step 1604: Aggregate information based on the heterogeneous entity graph data, the attribute features of each node, and the attribute features of each edge to obtain the heterogeneous entity features.

[0228] Specifically, the server aggregates information based on the heterogeneous entity graph data, the attribute features of each node, and the attribute features of each edge to obtain the heterogeneous entity features. In other words, after obtaining the attribute features of each node and each edge, the server performs feature message passing based on the heterogeneous entity graph data to obtain the heterogeneous entity features.

[0229] Step 1605: Construct homogeneous behavior graph data based on multiple behaviors to be detected.

[0230] The homogeneous behavior graph data includes at least behavior nodes and behavior relationship edges. Each behavior node corresponds to a specific behavior to be detected. Therefore, the node attributes of a behavior node must include at least the relevant attribute information of the beneficiary who initiated the behavior and the relevant attribute information of the service provider. Based on this, behavior relationship edges are used to describe that there is at least one common node attribute among the connected behavior nodes.

[0231] Specifically, a homogeneous behavior graph is constructed based on multiple behaviors to be detected. That is, the server constructs the behaviors to be detected as behavior nodes. Since each behavior to be detected describes the medical insurance transaction initiated by the beneficiary to the service provider, when there are the same beneficiary or the same service provider between two behaviors to be detected, behavior relationship edges are constructed between the behavior nodes corresponding to the aforementioned behaviors to construct the homogeneous behavior graph data.

[0232] Step 1606: Extract graph features from homogeneous behavioral graph data using a pre-trained feature extraction model to obtain the behavioral features of each team.

[0233] Specifically, the server uses a pre-trained feature extraction model to extract graph features from the homogeneous behavioral graph data, obtaining the team behavioral features corresponding to each behavioral node. The aforementioned embodiments have already described in detail how to obtain the feature extraction model, and will not be repeated here.

[0234] Step 1607: Analyze the abnormal behavior of each edge to be detected by considering the characteristics of each beneficiary, service provider, behavior, and team, in order to obtain the probability that each edge to be detected belongs to an abnormal behavior edge.

[0235] Specifically, the server considers team behavioral characteristics to predict abnormal behavior. That is, the service network concatenates the characteristics of each beneficiary, each service provider, each behavioral characteristic, and each team behavioral characteristic. Then, the classifier analyzes the abnormal behavior of each edge to be detected by the concatenated features to determine the probability that each edge to be detected belongs to an abnormal behavior edge.

[0236] Step 1608: Classify the behavior by the probability that each behavior edge to be detected belongs to an abnormal behavior edge, so as to determine the abnormal behavior classification result of each behavior edge to be detected.

[0237] Specifically, the server classifies behaviors based on the probability that each detected behavior edge belongs to an abnormal behavior edge, thus determining the abnormal behavior classification result for each detected behavior edge. That is, the server classifies detected behavior edges whose probability of belonging to an abnormal behavior edge is greater than an abnormal behavior threshold as abnormal behavior edges. Conversely, it classifies detected behavior edges whose probability of belonging to an abnormal behavior edge is less than an abnormal behavior threshold as normal behavior edges.

[0238] Step 1609: Determine the detection results of each abnormal behavior based on the abnormal behavior classification results of each edge to be detected.

[0239] Specifically, the server determines whether an edge to be detected is an abnormal behavior edge or a normal behavior edge based on the abnormal behavior classification results of each edge to be detected, thereby determining the abnormal behavior detection result of the corresponding behavior. When an edge to be detected is an abnormal behavior edge, the corresponding behavior to be detected is abnormal behavior; similarly, when an edge to be detected is a normal behavior edge, the corresponding behavior to be detected is normal behavior.

[0240] It should be understood that the specific implementation methods of steps 1601 to 1609 are similar to those of the aforementioned embodiments, and will not be repeated here.

[0241] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0242] Based on the same inventive concept, this application also provides a graph-based abnormal behavior detection device for implementing the graph-based abnormal behavior detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more graph-based abnormal behavior detection device embodiments provided below can be found in the limitations of the graph-based abnormal behavior detection method described above, and will not be repeated here.

[0243] In one embodiment, such as Figure 17 As shown, an abnormal behavior detection device based on graph data is provided, including: a behavior acquisition module 1702, a graph data construction module 1704, a feature extraction module 1706, and an abnormal behavior detection module 1708, wherein:

[0244] The behavior acquisition module 1702 is used to acquire multiple behaviors to be detected, which describe the medical insurance transaction behavior initiated by the beneficiary to the service provider.

[0245] The graph data construction module 1704 is used to construct heterogeneous entity graph data based on multiple behaviors to be detected. The heterogeneous entity graph data includes at least: beneficiary nodes corresponding to beneficiaries, service provider nodes corresponding to service providers, and edges of behaviors to be detected used to connect beneficiary nodes and service provider nodes.

[0246] The feature extraction module 1706 is used to extract graph features from heterogeneous entity graph data and obtain heterogeneous entity features. The heterogeneous entity features include at least: the beneficiary features corresponding to each beneficiary node, the service provider features corresponding to each service provider node, and the behavior features corresponding to each behavior edge to be detected.

[0247] The abnormal behavior detection module 1708 is used to perform behavior category detection on the behavior to be detected corresponding to each behavior edge through heterogeneous entity features, so as to obtain the abnormal behavior detection results corresponding to each behavior to be detected.

[0248] In one embodiment, the graph data construction module 1704 is further configured to construct homogeneous behavior graph data based on the multiple behaviors to be detected after the behavior acquisition module 1702 acquires multiple behaviors to be detected. The homogeneous behavior graph data includes at least behavior nodes and behavior relationship edges.

[0249] The feature extraction module 1706 is also used to extract graph features from homogeneous behavior graph data to obtain team behavior features corresponding to each behavior node. The team behavior features are the evaluation parameter features for team-dimensional behavior.

[0250] The abnormal behavior detection module 1708 is specifically used to detect the behavior category of each behavior edge to be detected by using the features of heterogeneous entities and the behavioral features of each team.

[0251] In one embodiment, such as Figure 18 As shown, team behavioral characteristics are specifically extracted using a feature extraction model;

[0252] The abnormal behavior detection device based on graph data also includes a model training module 1802;

[0253] Model training module 1802 is used for:

[0254] Obtain homogeneous behavior graph samples, which include abnormal behavior node samples of abnormal behavior, as well as sample edges connecting each behavior node sample;

[0255] Feature extraction is performed on each abnormal behavior node sample in the homogeneous behavior graph sample to obtain the team behavior sample features of each abnormal behavior node sample.

[0256] Based on the team behavior sample characteristics of each abnormal behavior node sample, the predicted behavior type of each abnormal behavior node sample is obtained through the initial feature extraction model.

[0257] Based on the predicted behavior type of each abnormal behavior node sample and the model parameters of each abnormal behavior node sample, the initial feature extraction model is updated to obtain the feature extraction model.

[0258] In one embodiment, the model training module 1802 is further configured to:

[0259] Construct the first sample adjacency matrix corresponding to homogeneous behavior graph samples, and calculate the second sample adjacency matrix corresponding to each abnormal behavior node sample;

[0260] Directed selection is performed on each abnormal behavior node sample in the homogeneous behavior graph sample to obtain the abnormal node sample neighborhood set corresponding to each abnormal behavior node sample. The abnormal node sample neighborhood set includes: abnormal behavior node neighborhood samples that have sample edges with the corresponding abnormal behavior node sample.

[0261] The second sample adjacency matrix is ​​expanded by using the neighborhood set of each abnormal node sample to obtain the third sample adjacency matrix corresponding to each abnormal behavior node sample.

[0262] Perform matrix row normalization on the adjacency matrix of the third sample corresponding to each abnormal behavior node sample to obtain the risk propagation sample matrix corresponding to each abnormal behavior node sample.

[0263] Risk expansion calculations are performed using each risk propagation sample matrix to determine the team behavior sample characteristics of each abnormal behavior node sample.

[0264] In one embodiment, the model training module 1802 is further configured to:

[0265] Risk expansion calculations are performed using each risk propagation sample matrix to determine the initial team behavior sample characteristics of each abnormal behavior node sample.

[0266] The self-loop adjacency matrix corresponding to each abnormal behavior node sample is calculated by the risk propagation sample matrix, and the diagonal node degree matrix corresponding to each abnormal behavior node sample is calculated based on their respective loop adjacency matrices.

[0267] Based on their respective ring adjacency matrices, the degree matrices of each diagonal node, and the initial team behavior sample features of each abnormal behavior node sample, the team behavior sample features are obtained by performing layer-by-layer normalization aggregation.

[0268] In one embodiment, the feature extraction module 1706 is further configured to extract node features from each beneficiary node and each service provider node in the heterogeneous entity graph data to obtain the attribute features of each node; extract edge features from each edge of the behavior to be detected in the heterogeneous entity graph data to obtain the attribute features of each edge; and aggregate information based on the heterogeneous entity graph data, the attribute features of each node and the attribute features of each edge to obtain the heterogeneous entity features.

[0269] In one embodiment, the feature extraction module 1706 is further configured to construct an adjacency matrix based on the heterogeneous entity graph data, the adjacency matrix being used to describe the adjacency relationship between each node; perform matrix calculation on the adjacency matrix to obtain the first adjacency matrix corresponding to each beneficiary node; based on each first adjacency matrix and the Lth layer node attribute features of each beneficiary node, obtain the L+1th layer node attribute features of each beneficiary node through feature merging, where L is a positive integer; when L is the layer number of the heterogeneous entity graph data, the L+1th layer node attribute features of each beneficiary node are respectively determined as the beneficiary features in the heterogeneous entity features, the layer number of the heterogeneous entity graph data being determined by the number of edges of the behavior to be detected in the heterogeneous entity graph data; wherein, when L=1, the first layer node attribute features of the beneficiary node are the node attribute features of the beneficiary node.

[0270] In one embodiment, the feature extraction module 1706 is further configured to perform matrix calculation on the adjacency matrix to obtain the second adjacency matrix corresponding to each service provider node; based on each second adjacency matrix and the Lth layer node attribute features of each service provider node, the L+1th layer node attribute features of each service provider node are obtained by feature merging; when L is the layer number of the heterogeneous entity graph data, the L+1th layer node attribute features of each service provider node are respectively determined as the service provider features in the heterogeneous entity features; wherein, when L=1, the first layer node attribute features of the service provider node are the node attribute features of the service provider node.

[0271] In one embodiment, the feature extraction module 1706 is further configured to perform matrix calculation on the adjacency matrix to obtain the third adjacency matrix corresponding to each edge of the behavior to be detected; based on each third adjacency matrix and the Lth layer edge attribute features of each edge of the behavior to be detected, the L+1th layer edge attribute features of each edge of the behavior to be detected are obtained by feature merging; when L is the number of layers of the heterogeneous entity graph data, the L+1th layer edge attribute features of each edge of the behavior to be detected are respectively determined as each behavior feature in the heterogeneous entity features; wherein, when L=1, the first layer edge attribute features of the edge of the behavior to be detected are the edge attribute features of the edge of the behavior to be detected.

[0272] In one embodiment, the abnormal behavior detection module 1708 is further configured to perform abnormal behavior analysis on each edge to be detected based on the characteristics of each beneficiary, the characteristics of each service provider, and the characteristics of each behavior, so as to obtain the probability that each edge to be detected belongs to an abnormal behavior edge; classify the behavior based on the probability that each edge to be detected belongs to an abnormal behavior edge, so as to determine the abnormal behavior classification result of each edge to be detected; and determine the abnormal behavior detection result based on the abnormal behavior classification result of each edge to be detected.

[0273] Each module in the aforementioned graph-based abnormal behavior detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0274] In one embodiment, a computer device is provided, which can be a terminal or a server. Taking a server as an example, its internal structure diagram can be as follows. Figure 19 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores data such as the behavior to be detected, heterogeneous entity graph data, and homogeneous behavior graph data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a graph-based abnormal behavior detection method.

[0275] Those skilled in the art in this field can understand. Figure 19 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0276] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0277] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0278] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0279] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0280] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0281] The technical features in the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0282] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for anomaly behavior detection based on graph data, characterized in that, The method comprises: acquiring a plurality of to-be-detected behaviors, the to-be-detected behaviors being used to describe medical insurance transaction behaviors initiated by a beneficiary to a service provider; constructing heterogeneous entity graph data according to the plurality of to-be-detected behaviors, the heterogeneous entity graph data at least comprising a beneficiary node corresponding to the beneficiary, a service provider node corresponding to the service provider, and a to-be-detected behavior edge used to connect the beneficiary node and the service provider node; performing graph feature extraction on the heterogeneous entity graph data to acquire heterogeneous entity features, the heterogeneous entity features at least comprising a beneficiary feature corresponding to each of the beneficiary nodes, a service provider feature corresponding to each of the service provider nodes, and a behavior feature corresponding to each of the to-be-detected behavior edges; constructing homogeneous behavior graph data according to the plurality of to-be-detected behaviors, the homogeneous behavior graph data at least comprising a behavior node and a behavior relationship edge, the behavior node corresponding to a to-be-detected behavior, and the behavior relationship edge being used to describe that at least one same node attribute exists between connected behavior nodes; performing graph feature extraction on the homogeneous behavior graph data to acquire a team behavior feature corresponding to each of the behavior nodes, the team behavior feature being an evaluation parameter feature of a team dimension behavior; detecting a behavior category of each of the to-be-detected behavior edges by using the heterogeneous entity features to acquire an abnormal behavior detection result corresponding to each of the to-be-detected behaviors; wherein the detecting the behavior category of each of the to-be-detected behavior edges comprises detecting the behavior category of each of the to-be-detected behavior edges by using the heterogeneous entity features and the team behavior features.

2. The method of claim 1, wherein, The team behavior feature is acquired by using a feature extraction model; The method for acquiring the feature extraction model comprises: acquiring a homogeneous behavior graph sample, the homogeneous behavior graph sample comprising an abnormal behavior node sample of an abnormal behavior and a sample edge connecting each of the behavior node samples; performing feature extraction on each of the abnormal behavior node samples in the homogeneous behavior graph sample to acquire a team behavior sample feature of each of the abnormal behavior node samples; acquiring a predicted behavior type of each of the abnormal behavior node samples by using an initial feature extraction model based on the team behavior sample feature of each of the abnormal behavior node samples; updating model parameters of the initial feature extraction model according to the predicted behavior type of each of the abnormal behavior node samples and each of the abnormal behavior node samples to obtain the feature extraction model.

3. The method of claim 2, wherein, The performing the feature extraction on each of the abnormal behavior node samples in the homogeneous behavior graph sample to acquire the team behavior sample feature of each of the abnormal behavior node samples comprises: constructing a first sample adjacency matrix corresponding to the homogeneous behavior graph sample and calculating a second sample adjacency matrix corresponding to each of the abnormal behavior node samples; performing directed selection on each of the abnormal behavior node samples in the homogeneous behavior pattern sample to obtain an abnormal node sample neighborhood set corresponding to each of the abnormal behavior node samples, the abnormal node sample neighborhood set comprising abnormal behavior node neighborhood samples having the sample edges with the corresponding abnormal behavior node sample; performing matrix expansion on the second sample adjacency matrix through each of the abnormal node sample neighborhood sets to obtain a third sample adjacency matrix corresponding to each of the abnormal behavior node samples; performing matrix row normalization on the third sample adjacency matrix corresponding to each of the abnormal behavior node samples to obtain a risk propagation sample matrix corresponding to each of the abnormal behavior node samples; performing risk expansion calculation through each of the risk propagation sample matrices to determine team behavior sample features of each of the abnormal behavior node samples.

4. The method of claim 3, wherein, The performing risk expansion calculation through each of the risk propagation sample matrices to determine team behavior sample features of each of the abnormal behavior node samples comprises: performing risk expansion calculation through each of the risk propagation sample matrices to determine initial team behavior sample features of each of the abnormal behavior node samples; calculating a self-loop adjacency matrix corresponding to each of the abnormal behavior node samples through the risk propagation sample matrix, and calculating a diagonal node degree matrix corresponding to each of the abnormal behavior node samples according to each of the self-loop adjacency matrices; performing layer-by-layer normalization aggregation according to each of the self-loop adjacency matrices, each of the diagonal node degree matrices, and the initial team behavior sample features of each of the abnormal behavior node samples to obtain the team behavior sample features.

5. The method of claim 1, wherein, The performing graph feature extraction on the heterogeneous entity graph data to obtain heterogeneous entity features comprises: performing node feature extraction on each of the beneficiary nodes and each of the service provider nodes in the heterogeneous entity graph data to obtain node attribute features; performing edge feature extraction on each of the to-be-detected behavior edges in the heterogeneous entity graph data to obtain edge attribute features; performing information aggregation according to the heterogeneous entity graph data, each of the node attribute features, and each of the edge attribute features to obtain the heterogeneous entity features.

6. The method of claim 5, wherein, The performing information aggregation according to the heterogeneous entity graph data, each of the node attribute features, and each of the edge attribute features to obtain the heterogeneous entity features comprises: constructing an adjacency matrix according to the heterogeneous entity graph data, the adjacency matrix being used to describe the adjacency relationship between each node; performing matrix calculation on the adjacency matrix to obtain a first adjacency matrix corresponding to each of the beneficiary nodes; obtaining an L+1th layer node attribute feature of each of the beneficiary nodes through feature merging according to each of the first adjacency matrices and an Lth layer node attribute feature of each of the beneficiary nodes, L being a positive integer; when L is a layer number of the heterogeneous entity graph data, determining each of the L+1th layer node attribute features of the beneficiary nodes as each of the beneficiary features in the heterogeneous entity features, the layer number of the heterogeneous entity graph data being determined by a number of the to-be-detected behavior edges in the heterogeneous entity graph data; The first layer node attribute feature of the beneficiary node is the node attribute feature of the beneficiary node when L=1.

7. The method of claim 6, wherein, The information aggregation according to the heterogeneous entity graph data, the node attribute features, and the edge attribute features to obtain the heterogeneous entity features further includes: The adjacency matrix is subjected to matrix calculation to obtain a second adjacency matrix corresponding to each of the service provider nodes; The L+1th layer node attribute features of the service provider nodes are determined as the service provider features in the heterogeneous entity features respectively when L is the number of layers of the heterogeneous entity graph data. The first layer node attribute feature of the service provider node is the node attribute feature of the service provider node when L=1. The information aggregation according to the heterogeneous entity graph data, the node attribute features, and the edge attribute features to obtain the heterogeneous entity features further includes:

8. The method of claim 6, wherein, The adjacency matrix is subjected to matrix calculation to obtain a third adjacency matrix corresponding to each of the behavior edges to be detected; The L+1th layer edge attribute features of the behavior edges to be detected are determined as the behavior features in the heterogeneous entity features respectively when L is the number of layers of the heterogeneous entity graph data. The first layer edge attribute feature of the behavior edge to be detected is the edge attribute feature of the behavior edge to be detected when L=1. The behavior category detection of the behavior edges to be detected corresponding to the heterogeneous entity features to obtain the abnormal behavior detection results corresponding to the behavior edges to be detected includes: The abnormal behavior analysis of the behavior edges to be detected according to the beneficiary features, the service provider features, and the behavior features to obtain the probabilities that the behavior edges to be detected are abnormal behavior edges; 9. The method of claim 1, wherein, The behavior classification according to the probabilities that the behavior edges to be detected are abnormal behavior edges to determine the abnormal behavior classification results of the behavior edges to be detected; The abnormal behavior detection results are determined according to the abnormal behavior classification results of the behavior edges to be detected. The device includes: The behavior acquisition module acquires a plurality of behavior edges to be detected, which are used to describe medical insurance transaction behaviors initiated by beneficiaries to service providers.

10. An abnormal behavior detection device based on graph data, characterized in that, The graph data construction module is configured to construct a heterogeneous entity graph data according to the plurality of behavior edges to be detected, the heterogeneous entity graph data at least including: a beneficiary node corresponding to the beneficiary, a service provider node corresponding to the service provider, and a behavior edge to be detected used to connect the beneficiary node and the service provider node; ​ ​ The feature extraction module is configured to perform graph feature extraction on the heterogeneous entity graph data to obtain heterogeneous entity features, the heterogeneous entity features at least including beneficiary features corresponding to each of the beneficiary nodes, service provider features corresponding to each of the service provider nodes, and behavior features corresponding to each of the to-be-detected behavior edges; The graph data construction module is further configured to construct homogeneous behavior graph data according to the plurality of to-be-detected behaviors, the homogeneous behavior graph data at least including behavior nodes and behavior relationship edges, the behavior nodes corresponding to to-be-detected behaviors, and the behavior relationship edges used to describe that there is at least one same node attribute between connected behavior nodes; The feature extraction module is further configured to perform graph feature extraction on the homogeneous behavior graph data to obtain team behavior features corresponding to each of the behavior nodes, the team behavior features being evaluation parameter features of team dimension behaviors; The abnormal behavior detection module is configured to perform behavior category detection on each of the to-be-detected behaviors corresponding to each of the to-be-detected behavior edges by using the heterogeneous entity features to obtain abnormal behavior detection results corresponding to each of the to-be-detected behaviors; wherein the behavior category detection on each of the to-be-detected behaviors corresponding to each of the to-be-detected behavior edges by using the heterogeneous entity features includes performing behavior category detection on each of the to-be-detected behaviors corresponding to each of the to-be-detected behavior edges by using the heterogeneous entity features and the team behavior features.

11. The apparatus of claim 10, wherein, The team behavior features are obtained by using a feature extraction model; The abnormal behavior detection apparatus based on graph data further includes a model training module; The model training module is configured to: obtain a homogeneous behavior graph sample, the homogeneous behavior graph sample including abnormal behavior node samples of abnormal behaviors and sample edges connecting the behavior node samples; perform feature extraction on each of the abnormal behavior node samples in the homogeneous behavior graph sample to obtain team behavior sample features of each of the abnormal behavior node samples; obtain predicted behavior types of each of the abnormal behavior node samples by using an initial feature extraction model based on the team behavior sample features of each of the abnormal behavior node samples; and update model parameters of the initial feature extraction model according to the predicted behavior types of each of the abnormal behavior node samples and each of the abnormal behavior node samples to obtain the feature extraction model.

12. The apparatus of claim 11, wherein, The model training module is further configured to: construct a first sample adjacency matrix corresponding to the homogeneous behavior graph sample and calculate a second sample adjacency matrix corresponding to each of the abnormal behavior node samples; perform directed selection on each of the abnormal behavior node samples in the homogeneous behavior graph sample to obtain an abnormal node sample neighborhood set corresponding to each of the abnormal behavior node samples, the abnormal node sample neighborhood set including abnormal behavior node neighborhood samples having the sample edges with the corresponding abnormal behavior node samples; perform matrix expansion on the second sample adjacency matrix by using each of the abnormal node sample neighborhood sets to obtain a third sample adjacency matrix corresponding to each of the abnormal behavior node samples; and perform matrix expansion on the second sample adjacency matrix by using each of the abnormal node sample neighborhood sets to obtain a third sample adjacency matrix corresponding to each of the abnormal behavior node samples; and perform matrix row normalization on the third sample adjacency matrix corresponding to each of the abnormal behavior node samples to obtain a risk propagation sample matrix corresponding to each of the abnormal behavior node samples; perform risk propagation calculation through each of the risk propagation sample matrices to determine team behavior sample features of each of the abnormal behavior node samples.

13. The apparatus of claim 12, wherein, The model training module is further configured to: perform risk propagation calculation through each of the risk propagation sample matrices to determine initial team behavior sample features of each of the abnormal behavior node samples; obtain a self-loop adjacency matrix corresponding to each of the abnormal behavior node samples through matrix calculation on the risk propagation sample matrix, and obtain a diagonal node degree matrix corresponding to each of the abnormal behavior node samples according to each of the self-loop adjacency matrices; perform layer-by-layer normalization aggregation according to each of the self-loop adjacency matrices, each of the diagonal node degree matrices, and the initial team behavior sample features of each of the abnormal behavior node samples to obtain the team behavior sample features.

14. The apparatus of claim 10, wherein, The feature extraction module is further configured to extract node features of each of the beneficiary nodes and each of the service provider nodes in the heterogeneous entity graph data to obtain node attribute features, extract edge features of each of the to-be-detected behavior edges in the heterogeneous entity graph data to obtain edge attribute features, and perform information aggregation according to the heterogeneous entity graph data, the node attribute features, and the edge attribute features to obtain the heterogeneous entity features.

15. The apparatus of claim 14, wherein, The feature extraction module is further configured to construct an adjacency matrix according to the heterogeneous entity graph data, the adjacency matrix being used to describe an adjacency relationship between each node, perform matrix calculation on the adjacency matrix to obtain a first adjacency matrix corresponding to each of the beneficiary nodes, obtain L+1-layer node attribute features of each of the beneficiary nodes through feature merging according to each of the first adjacency matrices and L-layer node attribute features of each of the beneficiary nodes, L being a positive integer, and when L is a number of layers of the heterogeneous entity graph data, determine L+1-layer node attribute features of each of the beneficiary nodes as each of the beneficiary features in the heterogeneous entity features, respectively, the number of layers of the heterogeneous entity graph data being determined according to a number of the to-be-detected behavior edges in the heterogeneous entity graph data, and when L=1, the first-layer node attribute features of the beneficiary nodes are the node attribute features of the beneficiary nodes.

16. The apparatus of claim 15, wherein, The feature extraction module is further configured to perform matrix calculation on the adjacency matrix to obtain a second adjacency matrix corresponding to each of the service provider nodes, obtain L+1-layer node attribute features of each of the service provider nodes through feature merging according to each of the second adjacency matrices and L-layer node attribute features of each of the service provider nodes, and when L is the number of layers of the heterogeneous entity graph data, determine L+1-layer node attribute features of each of the service provider nodes as each of the service provider features in the heterogeneous entity features, respectively, and when L=1, the first-layer node attribute features of the service provider nodes are the node attribute features of the service provider nodes.

17. The apparatus of claim 15, wherein, The feature extraction module is further configured to perform matrix calculation on the adjacency matrix to obtain a third adjacency matrix corresponding to each of the to-be-detected behavior edges; obtain an L+1th layer edge attribute feature of each of the to-be-detected behavior edges according to each of the third adjacency matrices and an Lth layer edge attribute feature of each of the to-be-detected behavior edges; and determine the L+1th layer edge attribute feature of each of the to-be-detected behavior edges as each of the behavior features in the heterogeneous entity features when L is a layer number of the heterogeneous entity graph data; and when L=1, the first layer edge attribute feature of the to-be-detected behavior edge is an edge attribute feature of the to-be-detected behavior edge.

18. The apparatus of claim 10, wherein, The abnormal behavior detection module is further configured to perform abnormal behavior analysis on each of the to-be-detected behavior edges according to each of the beneficiary features, each of the service provider features, and each of the behavior features to obtain a probability that each of the to-be-detected behavior edges is an abnormal behavior edge; perform behavior classification according to the probability that each of the to-be-detected behavior edges is an abnormal behavior edge to determine an abnormal behavior classification result of each of the to-be-detected behavior edges; and determine each of the abnormal behavior detection results according to the abnormal behavior classification result of each of the to-be-detected behavior edges. 19.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-18. The processor, when executing the computer program, implements the steps of the method of any one of claims 1 to 9.

20. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 9.

21. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 9. The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 9.

Images