Risk identification method, model training method and corresponding device

Abstract

Embodiments of the present specification provide a risk identification method, a model training method and corresponding devices. The main technical solutions include: obtaining a network graph constructed using network behavior data of a user, the network graph including nodes and edges, the nodes being network behaviors, and the edges between two nodes being the same user corresponding to the two network behaviors; extracting a sub-network corresponding to a target node from the network graph using a sub-network extraction model; determining a first feature representation of the target node in the sub-network and a second feature representation of the target node in the network graph using a risk identification model; and identifying risk information of the target node using the first feature representation and the second feature representation, the risk information including whether the network behavior corresponding to the target node is a risk behavior or risk level information of the network behavior corresponding to the target node. Through the embodiments of the present specification, the accuracy and interpretability of risk identification of user network behavior can be improved.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of network security technology, and in particular, to risk identification methods, model training methods, and corresponding devices. Background Art

[0002] With the rapid development of internet technology, users are facing various risks in their internet activities. In practical risk control scenarios, graph neural network models are currently a widely used deep neural network model. Graph neural networks demonstrate powerful learning and representation capabilities for modeling the relationships between nodes in graph structures. Risk identification models based on graph neural networks can reduce risk control costs and reduce reliance on experts in risk control decisions, thereby improving risk control efficiency.

[0003] Currently, risk identification using graph neural networks mostly relies on network behavior characteristics to determine whether a particular online behavior constitutes risk. However, for risks such as money laundering, the risk is realized through relationships with other users that span more than one hop, and these relationships may have temporal characteristics. For example, one account transfers funds to another account through an investment relationship, and the other account then transfers the funds to another account through a transaction relationship. Therefore, for this type of risk identification, relying solely on network behavior characteristics is inaccurate. Summary of the Invention

[0004] In view of this, one or more embodiments of this specification provide a risk identification method, a model training method, and a corresponding device, so as to improve the accuracy of risk identification of user network behavior.

[0005] According to a first aspect, an embodiment of this specification provides a risk identification method, the method comprising:

[0006] Obtaining a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors;

[0007] Extracting a subnetwork corresponding to a target node from the network graph using a subnetwork extraction model;

[0008] A risk identification model is used to determine the first feature representation of the target node in the subnetwork and the second feature representation in the network graph, and the first feature representation and the second feature representation are used to identify the risk information of the target node. The risk information includes whether the network behavior corresponding to the target node is a risky behavior, or the risk level information of the network behavior corresponding to the target node.

[0009] According to an implementable manner in the embodiments of the present application, the step of extracting the subnetwork corresponding to the target node from the network graph by using the subnetwork extraction model comprises: performing the following steps in each iteration by using the subnetwork extraction model until a preset number of iterations is reached:

[0010] determining a feature representation of the currently selected subnetwork;

[0011] determining a second feature representation of the current node in the network graph in the first iteration by taking the target node as the current node and in other iterations by taking the node added to the subnetwork in the last iteration as the current node;

[0012] obtaining a first feature representation of the current node by using the feature representation of the currently selected subnetwork and the second feature representation of the current node;

[0013] determining a first similarity between the first feature representation of the current node and a feature representation of each next-hop neighbor node of the current node in the network graph, and determining a neighbor node corresponding to the first similarity that meets a preset similarity requirement to be added to the subnetwork as the subnetwork selected in the current iteration.

[0014] According to an implementable manner in the embodiments of the present application, the step of determining a neighbor node that meets the preset similarity requirement to be added to the subnetwork comprises:

[0015] determining a neighbor node corresponding to a first similarity greater than or equal to a preset similarity threshold to be added to the subnetwork; or

[0016] determining a neighbor node corresponding to a first similarity greater than a second similarity to be added to the subnetwork, wherein the second similarity is a similarity between the first feature representation of the current node and a feature representation of a virtual node in the network graph, and information of the virtual node is learned in a training process of the risk identification model.

[0017] According to an implementable manner in the embodiments of the present application, the step of obtaining a first feature representation of the current node by using the feature representation of the currently selected subnetwork and the second feature representation of the current node comprises:

[0018] performing weighted summation on the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain the first feature representation of the current node.

[0019] According to an implementable manner in the embodiments of the present application, the step of identifying the risk information of the target node by using the first feature representation and the second feature representation comprises:

[0020] performing self-attention processing on the first feature representation of the target node to obtain a third feature representation of the target node;

[0021] Use the second feature representation of the target node to perform self-attention processing to obtain the fourth feature representation of the target node;

[0022] Integrating the third feature representation and the fourth feature representation of the target node to obtain a fifth feature representation of the target node;

[0023] Classification is performed using the fifth characteristic representation of the target node to obtain risk information of the target node.

[0024] According to an achievable method in an embodiment of the present application, the method is applied to money laundering risk identification, and the network behavior includes payment behavior, transfer behavior, deposit and withdrawal behavior, contract binding behavior, sending and receiving red envelope behavior, commodity trading behavior, capital trading behavior, stock trading behavior, service trading behavior or fund custody behavior;

[0025] The risk information includes: whether the network behavior corresponding to the target node has money laundering risk, or the level of money laundering risk.

[0026] According to a second aspect, a method for training a risk identification model is provided, the method comprising:

[0027] Obtain a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors. Some nodes in the network graph are labeled with risk information as sample nodes;

[0028] Extracting the subnetwork corresponding to the sample node from the network graph using a subnetwork extraction model;

[0029] A risk identification model is trained using the network graph and the sub-network corresponding to the sample node. The risk identification model determines a first feature representation of the sample node in the corresponding sub-network and a second feature representation in the network graph, and uses the first feature representation and the second feature representation to identify the risk information of the sample node. The training objectives include: minimizing the difference between the identified risk information of the sample node and the risk information label annotated with the sample node. The risk information includes whether the network behavior corresponding to the target node is a risky behavior, or the risk level information of the network behavior corresponding to the target node.

[0030] According to an achievable method in an embodiment of the present application, identifying the risk information of the sample node by using the first feature representation and the second feature representation includes:

[0031] Perform self-attention processing on the first feature representation of the sample node to obtain the third feature representation of the sample node;

[0032] Use the second feature representation of the sample node to perform self-attention processing to obtain the fourth feature representation of the sample node;

[0033] Integrating the third feature representation and the fourth feature representation of the sample node to obtain a fifth feature representation of the sample node;

[0034] Classification is performed using the fifth characteristic representation of the sample node to obtain risk information of the sample node.

[0035] According to a third aspect, a method for training a subnetwork extraction model is provided, the method comprising:

[0036] Obtain a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors, and each node in the network graph is labeled with a risk information label;

[0037] Sampling nodes from the network graph as node samples to train a subnetwork extraction model, the subnetwork extraction model performs the following steps in each round of iteration until a preset number of iterations is reached to obtain a subnetwork corresponding to the node sample: determining a feature representation of the currently selected subnetwork; using the node sample as the current node in the first round of iteration, and using the node added to the subnetwork in the previous round of iteration as the current node in other rounds of iteration, and determining a second feature representation of the current node in the network graph; using the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain a first feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determining that the neighbor nodes whose corresponding first similarities meet the preset similarity requirements are added to the subnetwork as the subnetwork selected in this round of iteration;

[0038] The training objectives include: in each round of iteration, maximizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph, and minimizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph.

[0039] According to a fourth aspect, a method for training a subnetwork extraction model is provided, the method comprising:

[0040] Obtain a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors, and each node in the network graph is labeled with a risk information label;

[0041] Sampling nodes from the network graph as node samples to train a subnetwork extraction model, the subnetwork extraction model performs the following steps in each round of iteration until a preset number of iterations is reached to obtain a subnetwork corresponding to the node sample: determining a feature representation of the currently selected subnetwork; using the node sample as the current node in the first round of iteration, and using the node added to the subnetwork in the previous round of iteration as the current node in other rounds of iteration, and determining a second feature representation of the current node in the network graph; using the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain a first feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determining that the neighbor nodes whose corresponding first similarities meet the preset similarity requirements are added to the subnetwork as the subnetwork selected in this round of iteration;

[0042] The training objectives include: in each round of iteration, maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph is greater than the second similarity, and maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph is less than the second similarity, where the second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph.

[0043] According to a fifth aspect, a risk identification device is provided, the device comprising:

[0044] a network graph acquisition unit configured to acquire a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors;

[0045] a subnetwork extraction unit, configured to extract a subnetwork corresponding to a target node from the network graph using a subnetwork extraction model;

[0046] A risk identification unit is configured to use a risk identification model to determine a first feature representation of the target node in the sub-network and a second feature representation in the network graph, and use the first feature representation and the second feature representation to identify risk information of the target node, wherein the risk information includes whether the network behavior corresponding to the target node is a risky behavior, or risk level information of the network behavior corresponding to the target node.

[0047] According to a sixth aspect, a device for training a risk identification model is provided, the device comprising:

[0048] a network graph obtaining unit configured to obtain a network graph constructed by using network behavior data of a user, the network graph comprising nodes and edges, the nodes being network behaviors, and the edges between two nodes being the same user corresponding to the two network behaviors, and part of the nodes in the network graph being labeled with a risk information label as sample nodes;

[0049] a sub-network extracting unit configured to extract a sub-network corresponding to the sample nodes from the network graph by using a sub-network extracting model;

[0050] a first model training unit configured to train a risk identification model by using the network graph and the sub-network corresponding to the sample nodes, the risk identification model determining a first feature representation of the sample nodes in the corresponding sub-network and a second feature representation of the sample nodes in the network graph, and identifying the risk information of the sample nodes by using the first feature representation and the second feature representation; a target of the training comprises minimizing the difference between the identified risk information of the sample nodes and the risk information label labeled on the sample nodes; the risk information comprises whether the network behavior corresponding to the target node is a risk behavior or risk level information of the network behavior corresponding to the target node.

[0051] According to a seventh aspect, a device for training a sub-network extracting model is provided, the device comprising:

[0052] a network graph obtaining unit configured to obtain a network graph constructed by using network behavior data of a user, the network graph comprising nodes and edges, the nodes being network behaviors, and the edges between two nodes being the same user corresponding to the two network behaviors, and each node in the network graph being labeled with a risk information label;

[0053] a second model training unit configured to train a sub-network extracting model by sampling nodes from the network graph as node samples, the sub-network extracting model performing the following steps in each iteration until a preset number of iterations is reached to obtain a sub-network corresponding to the node samples: determining a feature representation of the sub-network selected in the current iteration; in the first iteration, taking the node sample as the current node, and in other iterations, taking the node added to the sub-network in the last iteration as the current node, and determining a second feature representation of the current node in the network graph; obtaining a first feature representation of the current node by using the feature representation of the sub-network selected in the current iteration and the second feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representation of each next-hop neighbor node of the current node in the network graph, and determining a neighbor node corresponding to the first similarity satisfying a preset similarity requirement to be added to the sub-network as the sub-network selected in the current iteration;

[0054] The training objectives include: in each round of iteration, maximizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph, and minimizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph.

[0055] According to an eighth aspect, a device for training a subnet extraction model is provided, the device comprising:

[0056] a network graph acquisition unit configured to acquire a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors, and wherein each node in the network graph is labeled with a risk information label;

[0057] The second model training unit is configured to sample nodes from the network graph as node samples to train a subnetwork extraction model, wherein the subnetwork extraction model performs the following steps in each round of iteration until a preset number of iterations is reached to obtain a subnetwork corresponding to the node sample: determining a feature representation of the currently selected subnetwork; using the node sample as the current node in the first round of iteration, and using the node added to the subnetwork in the previous round of iteration as the current node in other rounds of iteration, and determining a second feature representation of the current node in the network graph; using the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain a first feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determining that the neighbor nodes whose corresponding first similarities meet the preset similarity requirements are added to the subnetwork as the subnetwork selected in this round of iteration;

[0058] The training objectives include: in each round of iteration, maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph is greater than the second similarity, and maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph is less than the second similarity, where the second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph.

[0059] According to a ninth aspect, an embodiment of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described above.

[0060] According to a tenth aspect, an embodiment of the present specification provides a computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method as described above.

[0061] From the above technical solutions, the embodiments of the present specification can have the following advantages:

[0062] 1) The embodiments of the present specification take network behavior as a target node, introduce the extraction of a subnetwork corresponding to the target node in the risk identification process, enhance the target node features through the first feature representation of the target node in the subnetwork for risk identification, better capture the influence of the subnetwork structure on risk identification, and thus improve the accuracy of risk identification.

[0063] 2) The embodiments of the present specification can obtain a subnetwork corresponding to the target node, which largely reflects the “flow relationship” related to the target node and can well reflect the features of the target node, on the one hand, improving the explainability of risk identification and facilitating understanding of the underlying mechanism of risk behavior; on the other hand, providing a good reference for risk identification of the target node.

[0064] 3) The embodiments of the present specification learn the neighbor nodes added to the subnetwork in each round by using the contrast learning method when training the subnetwork extraction model, without prior rules, and thus avoid the difficulty brought by labeling the subnetwork.

[0065] Of course, implementing any product of the present application does not necessarily need to achieve all the advantages described above at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0067] Figure 1 An exemplary system architecture diagram to which the embodiments of the present specification can be applied is shown;

[0068] Figure 2 A flowchart of the risk identification method provided by the embodiments of the present specification is shown;

[0069] Figure 3 A processing flowchart of the subnetwork extraction model provided by the embodiments of the present specification in each round of iteration is shown;

[0070] Figure 4The structural principle diagram of the risk identification model provided in the embodiment of this specification; subnet extraction model

[0071] Figure 5 A flow chart of a method for training a risk identification model provided in an embodiment of this specification;

[0072] Figure 6 A flow chart of a method for training a subnet extraction model provided in an embodiment of this specification;

[0073] Figure 7 A structural diagram of a risk identification device provided in an embodiment of this specification;

[0074] Figure 8 A structural diagram of a device for training a risk identification model according to an embodiment of this specification;

[0075] Figure 9 This is a structural diagram of the device for training the subnet extraction model provided in the embodiments of this specification. DETAILED DESCRIPTION

[0076] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0077] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "an", "the" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise.

[0078] It should be understood that the term "and / or" as used herein is merely a description of the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0079] The word "if," as used herein, may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to the determination" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)," depending on the context.

[0080] In order to facilitate the understanding of this application, the system architecture on which this application is based is first introduced. Figure 1The following illustrates an exemplary system architecture that can be applied to the embodiments of this specification. The system primarily includes a model training device and a risk identification device. The model training device obtains batches of user network behavior data from a data warehouse, analyzes the user network behavior data, and trains a risk identification model.

[0081] The risk identification device uses the trained risk identification model to identify the risk of the user's network behavior to determine the risk identification result of the user's network behavior. The risk identification result can be whether there is a risk or a specific risk level.

[0082] The model training device and risk identification device in the above-mentioned system can be implemented on the server side. This server side can be a single server, a server group consisting of multiple servers, or a cloud server. A cloud server, also known as a cloud computing server or cloud host, is a host product within the cloud computing service system. It addresses the management difficulties and poor business scalability of traditional physical hosts and virtual private servers (VPs). In addition to being implemented on the server side, it can also be implemented on a computer terminal with powerful computing capabilities.

[0083] It should be understood that Figure 1 The number of model training devices, risk identification devices, risk identification models, and data warehouses is merely illustrative. Depending on the implementation requirements, any number of risk identification model establishment devices, risk identification devices, risk identification models, and data warehouses may be provided.

[0084] Figure 2 This is a flow chart of the risk identification method provided in the embodiment of this specification. It can be understood that the method can be Figure 1 The risk identification device in the system shown is implemented. Figure 2 , the method may include the following steps:

[0085] Step 201: Obtain a network graph constructed using the user's network behavior data. The network graph includes nodes and edges. A node represents a network behavior, and an edge between two nodes represents the same user corresponding to the two network behaviors.

[0086] Step 203: Extract the subnetwork corresponding to the target node from the network graph using the subnetwork extraction model.

[0087] Step 205: Use the risk identification model to determine the first feature representation of the target node in the sub-network and the second feature representation in the network graph, and use the first feature representation and the second feature representation to identify the risk information of the target node. The risk information includes whether the network behavior corresponding to the target node is a risky behavior, or the risk level information of the network behavior corresponding to the target node.

[0088] It can be seen from the technical content provided by the above embodiments that the embodiments of this specification take network behavior as the target node, introduce the sub-network extraction corresponding to the target node in the risk identification process, and enhance the target node characteristics for risk identification through the first feature representation of the target node in the sub-network, so as to better capture the impact of the sub-network structure on risk identification, thereby improving the accuracy of risk identification.

[0089] It should be noted that the terms "first," "second," "third," and "fourth" used in the embodiments of this specification do not restrict size, order, or quantity, but are merely used to distinguish between them in terms of name. For example, "first feature representation," "second feature representation," and "third feature representation" are used to distinguish different feature representations in terms of name. For another example, "first similarity," "second similarity," and so on are used to distinguish different similarities in terms of name.

[0090] Below Figure 2 Each step shown is explained.

[0091] First, the above step 201, namely "obtaining a network graph constructed using the user's network behavior data", is described in detail with reference to an embodiment.

[0092] When users use the internet, servers record a large amount of online behavior data. This data is usually stored in data warehouses, reflecting the connections between a large number of users. Most of these behaviors are generally risk-free, but some are risky.

[0093] Risk identification is typically conducted for specific scenarios, and the types of users and network behaviors to be analyzed within those scenarios are also specific. Therefore, data related to user types and network behaviors corresponding to the target scenarios can be obtained from the data warehouse to construct a network graph. This scenario-based approach to network graph construction can significantly reduce the size of the graph data.

[0094] A network graph consists of nodes and edges. However, unlike conventional network graphs, the nodes in the network graph constructed in the embodiments of this specification are network behaviors, and the edges are users. The edge between two adjacent network behaviors can represent the same user corresponding to these two network behaviors. For example, suppose user 1 transfers money to user 2, and user 2 invests in user 3. The transfer and investment actions can then be represented as two nodes, respectively, with the edge between these two nodes representing user 2.

[0095] Taking the money laundering risk scenario as an example, the aforementioned users can include financial accounts, stock accounts, social network accounts, instant messaging accounts, bank cards, customer IDs, host addresses, etc. The aforementioned online behaviors can include payment, transfer, deposit and withdrawal, contract binding, sending and receiving red envelopes, commodity transactions, fund transactions, stock transactions, service transactions, or fund custody.

[0096] The above step 203, namely "extracting the subnetwork corresponding to the target node from the network graph using the subnetwork extraction model", is described in detail below with reference to an embodiment.

[0097] In the embodiment of the present application, the input of the subnet extraction model is mainly the above-mentioned network diagram and the specified target node, which is the node with the risk to be identified.

[0098] The subnetwork extraction model uses multiple rounds of iterations to gradually select nodes from the next-hop neighbor nodes to join the subnetwork, starting from the target node, and finally obtains the extracted subnetwork. Figure 3 As shown in , the subnetwork extraction model can perform the following steps in each iteration:

[0099] Step 301: Determine the feature representation of the currently selected sub-network.

[0100] The initially selected sub-network only contains the target node v, and in each subsequent iteration, nodes are added to the sub-network of the target node.

[0101] The subnetwork extraction model may include an encoding module that can encode the selected subnetwork to obtain the feature representation of the subnetwork. For the kth iteration, the subnetwork obtained from the k-1th iteration is Encode and get the sub-network Feature representation

[0102] Among them, when determining the feature representation of the sub-network, existing methods such as GAT (Graph Attention Networks) and GIN (Graph Isomorphism Network) can be used to encode the sub-network to obtain the feature representation of the sub-network.

[0103] Step 303: In the first iteration, the target node is used as the current node. In other iterations, the node added to the sub-network in the previous iteration is used as the current node, and the second feature representation of the current node in the network graph is determined.

[0104] If this iteration is the first, the target node is used as the current node u. If this iteration is not the first, the node that joined the subnetwork in the previous iteration is used as the current node u. The determination of the current node is used to select the next hop node to join the subnetwork in subsequent steps S13 and S14.

[0105] This application can use the graph neural network to perform feature encoding on the current node u in the network graph to obtain the second feature representation h of the current node in the network graph. u .

[0106] Step 305: Utilize the feature representation of the currently selected sub-network and the second feature representation of the current node to obtain the first feature representation of the current node.

[0107] As one of the feasible ways, the feature representation of the currently selected sub-network can be and the second feature representation of the current node h u Perform weighted summation to obtain the first feature representation of the current node In addition to weighted summation, other methods can also be used to and h u Integrate to obtain

[0108] Step 307: Determine a first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determine that the neighbor nodes whose corresponding first similarities meet the preset similarity requirements are added to the sub-network as the sub-network selected in this round of iteration.

[0109] The so-called next-hop neighbor node refers to the next-hop node with an edge to the current node (the direction of the subgraph diverging outward). For the next-hop neighbor node of the current node, a graph neural network can be used to determine the feature representation of each neighbor node in the network graph. Then calculate The similarity between the characteristic nodes of each neighboring node in the network graph is referred to as the first similarity.

[0110] As one possible implementation, neighbor nodes corresponding to the first similarity greater than or equal to a preset similarity threshold are determined to join the sub-network. The similarity threshold can be set to an empirical value or an experimental value.

[0111] To avoid over-sampling of some nodes and under-sampling of others during the prediction process, a virtual node is introduced as another feasible method. The virtual node is not a real node in the network graph. The information of the virtual node is learned during the training process of the risk identification model. In this step, it can be determined that the neighbor nodes corresponding to the first similarity greater than the second similarity are added to the sub-network. The second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph. In other words, the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph is used as the similarity threshold used for joining the sub-network.

[0112] Step 309: Determine whether the current number of iterations has reached the preset number of iterations K. If so, end the current process and obtain the sub-network corresponding to the target node. Otherwise, go back to step 301.

[0113] The number of iterations K is a preset value that can be an empirical value or an experimental value. For example, 3 can be selected to select a 3-hop neighbor node from the target node through 3 rounds of iterations.

[0114] The subnetwork of the target node ultimately extracted by the subnetwork extraction model is actually closely related to the target node. This subnetwork largely reflects the "flow relationship" related to the target node, effectively reflecting the characteristics of the target node and providing a good reference for subsequent risk identification of the target node. The training process of the subnetwork extraction model will be described in detail in subsequent embodiments.

[0115] Continue to see Figure 2 , the above step 205, namely "using the risk identification model to determine the first feature representation of the target node in the sub-network and the second feature representation in the network graph, and using the first feature representation and the second feature representation to identify the risk information of the target node" is described in detail in conjunction with the embodiment.

[0116] like Figure 4 As shown in , the risk identification model may include a first encoding module, a second encoding module, a fusion module and a classification module.

[0117] The first encoding module is used to encode the target node in the sub-network to obtain a first feature representation of the target node, and then perform self-attention processing on the first feature representation of the target node to obtain a third feature representation of the target node. The encoding processing performed by the first encoding module can be performed by a graph convolutional neural network.

[0118] The second encoding module is configured to encode the target node in the network graph to obtain a second feature representation of the target node, and then perform self-attention processing on the second feature representation of the target node to obtain a fourth feature representation of the target node. The encoding processing performed by the first encoding module can be performed by a graph convolutional neural network.

[0119] The fusion module is configured to integrate the third feature representation and the fourth feature representation of the target node to obtain a fifth feature representation of the target node.

[0120] Suppose the first feature representation of the target node is The second feature representation is The fifth feature representation z of the target node is v The following formula can be used to determine:

[0121]

[0122]

[0123]

[0124]

[0125]

[0126] wherein q is a shared weight vector, the superscript T represents transposition, and are attention coefficients learned in the model training process. W a and b are model parameters.

[0127] The classification module performs classification processing using the fifth feature representation of the target node, i.e., maps the fifth feature representation to specific risk information. The classification module can be a binary classification module, and the result obtained can be, for example, whether there is a risk. The classification module can also be a multi-classification module, and the result obtained can be, for example, risk level information such as high risk, medium risk, low risk, and no risk.

[0128] The predicted risk information p v may be:

[0129] p v = softmax(MLP(z v )) (6)

[0130] wherein MLP is a function used by a multi-layer perceptron in the classification module, and softmax is a function used by the classification module when mapping.

[0131] It can be seen from the above process that the embodiment of this specification can obtain the sub-network corresponding to the target node. This sub-network largely reflects the "flow relationship" related to the target node and can well reflect the characteristics of the target node. On the one hand, it improves the interpretability of risk identification and facilitates understanding the underlying mechanism of risk behavior; on the other hand, it provides a good reference basis for risk identification of the target node.

[0132] The risk identification method provided in the embodiments of the present application can be applied to a variety of application scenarios. Here, a brief description is given using the application scenario of money laundering risk identification as an example.

[0133] First, we retrieve user and financial-related online behavior data from the data warehouse to construct a network graph. Taking the money laundering risk scenario as an example, these users can include financial accounts, stock accounts, social network accounts, instant messaging accounts, bank cards, customer IDs, host addresses, and so on. These online behaviors can include payments, transfers, deposits and withdrawals, contract bindings, sending and receiving red envelopes, commodity transactions, fund transactions, stock transactions, service transactions, and fund custody transactions.

[0134] A network graph consists of nodes and edges. Nodes represent network behaviors, and edges represent users. An edge between two adjacent network behaviors can represent the same user.

[0135] Money laundering risk identification can be performed on each edge of the network graph, i.e., each edge is used as a target node for money laundering risk identification. Money laundering risk identification can also be performed on a specific node in the network graph.

[0136] When identifying money laundering risks, the subnetwork extraction model is first used to extract the subnetwork corresponding to the target node from the network graph. The risk identification model is then used to determine the target node's first feature representation in the subnetwork and its second feature representation in the network graph. These first and second feature representations are then used to identify risk information about the target node. For example, this can be used to identify whether the target node poses a money laundering risk.

[0137] If a target node is ultimately identified as a money laundering risk, the subnetwork corresponding to that target node is, in fact, the subnetwork that reveals the money laundering logic to a large extent, thus providing explainability for revealing the money laundering logic. Furthermore, this subnetwork that reveals the money laundering logic also provides an important reference for risk identification of the target node, enhancing the accuracy of money laundering risk assessment.

[0138] Figure 5 A flow chart of the method for training a risk identification model provided in an embodiment of the present application is shown in FIG. Figure 5 As shown in , the method may include the following steps:

[0139] Step 501: Obtain a network graph constructed using the user's network behavior data. The network graph includes nodes and edges. A node represents a network behavior, and an edge between two nodes represents the same user corresponding to the two network behaviors. Some nodes in the network graph are labeled with risk information as sample nodes.

[0140] Similar to the description in step 201 above, the user network behavior data stored in the data warehouse can be used to construct a network graph. For the construction of the network graph, please refer to the relevant records of step 201 in the above embodiment, which will not be repeated here.

[0141] The user network behavior data in the data warehouse is historical data. Some user network behavior data is clearly known to be risky or safe. For example, messages can be obtained from official databases indicating that some user behavior violates laws and regulations, or the resulting behavior violates laws and regulations. The network behavior indicated by these messages can be identified as known risky behavior, and the corresponding nodes can be identified and labeled in the network diagram. For another example, if some network behavior is complained about, it can be considered known risky behavior, and the corresponding network can be identified and labeled in the network diagram. For another example, some network behavior can be detected as risky using existing high-accuracy detection tools, or some risky behavior can be identified through manual identification, and the corresponding network can be identified and labeled in the network diagram.

[0142] Similarly, some online behaviors are clearly safe. For example, official sources may indicate that certain online behaviors are highly recommended or praised, such as charitable acts or investments that promote urban development. These behaviors are identified as known safe behaviors, and the corresponding networks are identified in the network diagram. For another example, existing high-accuracy detection tools can detect some online behaviors as safe, or they can be identified manually, with the corresponding nodes identified and labeled in the network diagram.

[0143] Step 503: Extract the subnetwork corresponding to the sample node from the network graph using the subnetwork extraction model.

[0144] This step is to use the trained subnetwork extraction model to extract the subnetwork corresponding to the sample node from the network graph. The specific process can be found in the relevant description of step 203 in the above embodiment, which will not be repeated here.

[0145] Step 505: A risk identification model is trained using the network graph and the sub-network corresponding to the sample node. The risk identification model determines a first feature representation of the sample node in the corresponding sub-network and a second feature representation in the network graph, and uses the first feature representation and the second feature representation to identify the risk information of the sample node. The training objectives include minimizing the difference between the risk information of the identified sample node and the risk information label of the sample node. The risk information includes whether the network behavior corresponding to the target node is a risky behavior, or the risk level information of the network behavior corresponding to the target node.

[0146] The structure of the risk identification model can be found in Figure 4 .

[0147] The first encoding module is used to encode the sample node in the sub-network to obtain a first feature representation of the sample node, and then perform self-attention processing on the first feature representation of the sample node to obtain a third feature representation of the sample node. The encoding processing performed by the first encoding module can be performed by a graph convolutional neural network.

[0148] The second encoding module is used to encode the sample node in the network graph to obtain a second feature representation of the sample node, and then perform self-attention processing on the second feature representation of the sample node to obtain a fourth feature representation of the sample node. The encoding processing performed by the first encoding module can be performed by a graph convolutional neural network.

[0149] The fusion module is used to integrate the third feature representation and the fourth feature representation of the sample node to obtain the fifth feature representation of the sample node.

[0150] Assume that the first feature of the sample node is represented as The second feature is expressed as Then the fifth feature of the sample node represents z v It can be determined using the following formulas (1) to (5).

[0151] The classification module uses the fifth feature representation of the sample node to perform classification processing, mapping the fifth feature representation to specific risk information. The classification module can be a binary classification module, and the results can be, for example, whether there is a risk. The classification module can also be a multi-classification module, and the results can be risk level information such as high risk, medium risk, low risk, and no risk.

[0152] The training objectives include: minimizing the difference between the risk information of the sample nodes obtained by identification and the risk information labels of the sample nodes. In the embodiments of this specification, a loss function can be constructed based on the above-mentioned training objectives, for example, a cross-entropy loss function is used. In each round of iteration, the value of the loss function is used to update the model parameters using methods such as gradient descent until the preset training end conditions are met. The training end conditions may include, for example, the value of the loss function is less than or equal to a preset loss function threshold, the number of iterations reaches a preset number threshold, etc.

[0153] For example, the loss function L cls You can use:

[0154]

[0155] Among them, V is the sample node set, y v is the label of the sample node v.

[0156] Figure 6 The flowchart of the method for training the subnet extraction model provided in the embodiment of the present application is as follows: Figure 6 As shown in , the method may include the following steps:

[0157] Step 601: Obtain a network graph constructed using the user's network behavior data. The network graph includes nodes and edges. A node represents a network behavior, and an edge between two nodes represents the same user corresponding to the two network behaviors. Each node in the network graph is marked with a risk information label.

[0158] This embodiment is a network graph constructed using network behavior data in which the risk information of all network behaviors is known. The construction method can adopt the relevant records in the previous embodiments and will not be repeated here.

[0159] Step 603: Sample nodes from the network graph as node samples to train the subnetwork extraction model. The subnetwork extraction model performs the following steps in each iteration until a preset number of iterations is reached to obtain the subnetwork corresponding to the node sample: determining the feature representation of the currently selected subnetwork; using the node sample as the current node in the first iteration and the node added to the subnetwork in the previous iteration as the current node in subsequent iterations, determining the second feature representation of the current node in the network graph; utilizing the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain the first feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representations of each of the current node's next-hop neighboring nodes in the network graph, and determining that neighboring nodes whose corresponding first similarities meet a preset similarity requirement are added to the subnetwork as the subnetwork selected in the current iteration. This training utilizes a comparative learning approach.

[0160] The specific processing method in each iteration of the subnet extraction model can be found in the above embodiment. Figure 3 The relevant records of each step are not repeated here.

[0161] For the training of the subnetwork extraction model, if supervised learning is used, a large amount of subnetwork annotated data needs to be obtained, but such annotated data is difficult to obtain. Therefore, the embodiment of the present application adopts contrastive learning to train the subnetwork extraction model.

[0162] As one of the ways to implement contrastive learning, the training objectives include: in each round of iteration, maximizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph, and minimizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph.

[0163] In the embodiments of this specification, a loss function can be constructed based on the above-mentioned training objectives. In each iteration, the value of the loss function is used to update the model parameters using methods such as gradient descent until a preset training termination condition is met. The training termination condition may include, for example, the value of the loss function being less than or equal to a preset loss function threshold, or the number of iterations reaching a preset threshold.

[0164] Loss Function

[0165] Among them, E represents the expectation, n + ~N + (n) represents n + Taken from the neighboring nodes of the current node u that are marked as risky. - ~N - (n) represents n - The node u is taken from the neighboring nodes of the current node u that are labeled as risk-free. S() is used to calculate the similarity between the feature representations of two nodes. σ() is the activation function, which can be used, such as Sigmoid.

[0166] As another implementation method of contrastive learning, the training objectives include: in each round of iteration, maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph is greater than the second similarity, and maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph is less than the second similarity, and the second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph.

[0167] In the embodiments of this specification, a loss function can be constructed based on the above-mentioned training objectives. In each iteration, the value of the loss function is used to update the model parameters using methods such as gradient descent until a preset training termination condition is met. The training termination condition may include, for example, the value of the loss function being less than or equal to a preset loss function threshold, or the number of iterations reaching a preset threshold.

[0168] Loss Function

[0169]

[0170]

[0171] Among them, n VTN It is a virtual node, and its information is learned during the model training process.

[0172] The above is a detailed description of the method provided in the embodiments of this specification. The following is a detailed description of the device provided in the embodiments of this specification.

[0173] Figure 7 The structure diagram of the risk identification device according to the embodiment of this specification is shown as follows: Figure 7 As shown, the apparatus 700 may include: a network diagram acquisition unit 701, a subnetwork extraction unit 702, and a risk identification unit 703. The main functions of each component unit are as follows:

[0174] The network graph acquisition unit 701 is configured to acquire a network graph constructed using the user's network behavior data. The network graph includes nodes and edges. A node is a network behavior, and an edge between two nodes is the same user corresponding to the two network behaviors.

[0175] The network graph acquisition unit 701 may acquire relevant data on user types and network behavior types corresponding to the target scenario from a data warehouse to construct a network graph.

[0176] The subnetwork extraction unit 702 is configured to extract the subnetwork corresponding to the target node from the network graph using a subnetwork extraction model.

[0177] The risk identification unit 703 is configured to use the risk identification model to determine the first feature representation of the target node in the sub-network and the second feature representation in the network graph, and use the first feature representation and the second feature representation to identify the risk information of the target node. The risk information includes whether the network behavior corresponding to the target node is a risky behavior, or the risk level information of the network behavior corresponding to the target node.

[0178] As one possible implementation, the sub-network extraction unit 702 is specifically configured to perform the following steps in each iteration until a preset number of iterations is reached:

[0179] Determine the feature representation of the currently selected sub-network;

[0180] In the first iteration, the target node is used as the current node. In other iterations, the node added to the sub-network in the previous iteration is used as the current node to determine the second feature representation of the current node in the network graph.

[0181] Using the feature representation of the currently selected sub-network and the second feature representation of the current node, the first feature representation of the current node is obtained;

[0182] Determine the first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determine the neighbor nodes whose corresponding first similarities meet the preset similarity requirements to join the sub-network as the sub-network selected in this round of iteration.

[0183] As one possible implementation, when determining that a neighboring node whose first similarity satisfies a preset similarity requirement is to be added to the subnetwork, the subnetwork extraction unit 702 may be specifically configured as follows:

[0184] Determine that neighbor nodes corresponding to the first similarity greater than or equal to a preset similarity threshold are added to the sub-network; or,

[0185] Determine to add neighbor nodes whose corresponding first similarity is greater than the second similarity to the sub-network. The second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph. The information of the virtual node is learned during the training process of the risk identification model.

[0186] As one of the feasible ways, when the sub-network extraction unit 702 obtains the first feature representation of the current node by using the feature representation of the currently selected sub-network and the second feature representation of the current node, it can be specifically configured as follows: performing a weighted summation on the feature representation of the currently selected sub-network and the second feature representation of the current node to obtain the first feature representation of the current node.

[0187] As one of the feasible ways, the risk identification unit 703 can be specifically configured as follows: performing self-attention processing on the first feature representation of the target node to obtain the third feature representation of the target node; performing self-attention processing on the second feature representation of the target node to obtain the fourth feature representation of the target node; integrating the third feature representation and the fourth feature representation of the target node to obtain the fifth feature representation of the target node; and performing classification using the fifth feature representation of the target node to obtain the risk information of the target node.

[0188] Figure 8 A diagram showing the structure of a device for training a risk identification model according to an embodiment of this specification is shown as follows: Figure 8 As shown, the apparatus 800 may include: a network graph acquisition unit 801, a subnetwork extraction unit 802, and a first model training unit 803. The main functions of each component unit are as follows:

[0189] The network graph acquisition unit 801 is configured to obtain a network graph constructed using the user's network behavior data. The network graph includes nodes and edges. The nodes are network behaviors, and the edges between two nodes are the same users corresponding to the two network behaviors. Some nodes in the network graph are marked with risk information labels as sample nodes.

[0190] The network diagram acquisition unit 801 may acquire relevant data on user types and network behavior types corresponding to the target scenario from a data warehouse to construct a network diagram.

[0191] The sub-network extraction unit 802 is configured to extract the sub-network corresponding to the sample node from the network graph using the sub-network extraction model.

[0192] The first model training unit 803 is configured to train a risk identification model using a network diagram and a sub-network corresponding to a sample node. The risk identification model determines a first feature representation of the sample node in the corresponding sub-network and a second feature representation in the network diagram, and identifies risk information of the sample node using the first feature representation and the second feature representation. The training objectives include minimizing the difference between the risk information of the identified sample node and the risk information label annotated with the sample node. The risk information includes whether the network behavior corresponding to the target node is a risky behavior, or risk level information of the network behavior corresponding to the target node.

[0193] As one achievable approach, when the first model training unit 803 uses the first feature representation and the second feature representation to identify the risk information of the sample node, it can be specifically configured as follows:

[0194] Perform self-attention processing on the first feature representation of the sample node to obtain the third feature representation of the sample node;

[0195] Use the second feature representation of the sample node to perform self-attention processing to obtain the fourth feature representation of the sample node;

[0196] Integrate the third feature representation and the fourth feature representation of the sample node to obtain the fifth feature representation of the sample node;

[0197] The fifth feature representation of the sample node is used for classification to obtain the risk information of the sample node.

[0198] Figure 9A structural diagram of a device for training a subnet extraction model according to an embodiment of this specification is shown, Figure 9 As shown, the apparatus 900 may include: a network graph acquisition unit 901 and a second model training unit 902. The main functions of each component unit are as follows:

[0199] The network graph acquisition unit 901 is configured to obtain a network graph constructed using the user's network behavior data. The network graph includes nodes and edges. The nodes are network behaviors, and the edges between two nodes are the same users corresponding to the two network behaviors. Each node in the network graph is marked with a risk information label.

[0200] The network diagram acquisition unit 901 may acquire relevant data on user types and network behavior types corresponding to the target scenario from a data warehouse to construct a network diagram.

[0201] The second model training unit 902 is configured to sample nodes from the network graph as node samples to train a subnetwork extraction model. The subnetwork extraction model performs the following steps in each round of iteration until a preset number of iterations is reached to obtain the subnetwork corresponding to the node sample: determining the feature representation of the currently selected subnetwork; using the node sample as the current node in the first round of iteration, and using the node added to the subnetwork in the previous round of iteration as the current node in other rounds of iteration, and determining the second feature representation of the current node in the network graph; using the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain the first feature representation of the current node; determining the first similarity between the first feature representation of the current node and the feature representation of each next-hop neighbor node of the current node in the network graph, and determining the neighbor nodes whose corresponding first similarity meets the preset similarity requirement to join the subnetwork as the subnetwork selected in this round of iteration.

[0202] As one of the possible implementation methods, the training objectives adopted by the second model training unit 902 may include: in each round of iteration, maximizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph, and minimizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph.

[0203] As another achievable method, the training objectives adopted by the second model training unit 902 may include: in each round of iteration, maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph is greater than the second similarity, and maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph is less than the second similarity, and the second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph.

[0204] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences from other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0205] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described herein may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0206] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the methods described in the aforementioned method embodiments.

[0207] And an electronic device comprising:

[0208] one or more processors; and

[0209] A memory associated with the one or more processors, the memory being used to store program instructions, wherein the program instructions, when read and executed by the one or more processors, execute the steps of the method described in any one of the aforementioned method embodiments.

[0210] The present application also provides a computer program product, comprising a computer program, which implements the steps of any one of the methods described in the aforementioned method embodiments when executed by a processor.

[0211] The memory may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc.

[0212] Through the description of the above embodiments, it can be seen that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer program product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments of the present application or certain parts of the embodiments.

[0213] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the present invention should be included in the scope of protection of the present invention.

Claims

1. A risk identification method, wherein: The method comprises: Obtaining a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors; Extracting a subnetwork corresponding to a target node from the network graph using a subnetwork extraction model; Determine, using a risk identification model, a first feature representation of the target node in the subnetwork and a second feature representation in the network graph, and identify risk information of the target node using the first feature representation and the second feature representation, the risk information including whether a network behavior corresponding to the target node is a risky behavior or risk level information of the network behavior corresponding to the target node; The extracting the subnetwork corresponding to the target node from the network graph using the subnetwork extraction model includes: performing the following steps in each iteration using the subnetwork extraction model until a preset number of iterations is reached: Determine the feature representation of the currently selected sub-network; In the first iteration, the target node is used as the current node, and in other iterations, the node added to the sub-network in the previous iteration is used as the current node, and a second feature representation of the current node in the network graph is determined; Obtaining a first feature representation of the current node using the feature representation of the currently selected subnetwork and the second feature representation of the current node; Determine a first similarity between a first feature representation of the current node and feature representations of each next-hop neighbor node of the current node in the network graph, and determine neighbor nodes whose corresponding first similarities meet a preset similarity requirement to be added to the subnetwork as the subnetwork selected in this iteration; The step of identifying the risk information of the target node by using the first feature representation and the second feature representation includes: Perform self-attention processing on the first feature representation of the target node to obtain the third feature representation of the target node; Use the second feature representation of the target node to perform self-attention processing to obtain the fourth feature representation of the target node; Integrating the third feature representation and the fourth feature representation of the target node to obtain a fifth feature representation of the target node; Classification is performed using the fifth characteristic representation of the target node to obtain risk information of the target node.

2. The method according to claim 1, wherein Determining that a neighbor node whose first similarity meets a preset similarity requirement is added to the subnetwork includes: Determine that neighbor nodes corresponding to the first similarity greater than or equal to a preset similarity threshold are added to the sub-network; or, Determine to join the sub-network the neighbor nodes corresponding to the first similarity greater than the second similarity, where the second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph, and the information of the virtual node is learned during the training process of the risk identification model.

3. The method according to claim 1, wherein The obtaining the first feature representation of the current node by using the feature representation of the currently selected sub-network and the second feature representation of the current node includes: The feature representation of the currently selected sub-network and the second feature representation of the current node are weightedly summed to obtain the first feature representation of the current node.

4. The method according to any one of claims 1 to 3, wherein The method is applied to money laundering risk identification, and the network behavior includes payment behavior, transfer behavior, deposit and withdrawal behavior, contract binding behavior, sending and receiving red envelope behavior, commodity trading behavior, capital trading behavior, stock trading behavior, service trading behavior or fund custody behavior; The risk information includes: whether the network behavior corresponding to the target node has money laundering risk, or the level of money laundering risk.

5. A method for training a risk identification model, wherein: The method comprises: Obtain a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors. Some nodes in the network graph are labeled with risk information as sample nodes; Extracting the subnetwork corresponding to the sample node from the network graph using a subnetwork extraction model; A risk identification model is trained using the network graph and the sub-network corresponding to the sample node. The risk identification model determines a first feature representation of the sample node in the corresponding sub-network and a second feature representation in the network graph, and uses the first feature representation and the second feature representation to identify risk information of the sample node. The training objectives include minimizing the difference between the identified risk information of the sample node and the risk information label annotated with the sample node. The risk information includes whether the network behavior corresponding to the sample node is a risky behavior, or risk level information of the network behavior corresponding to the sample node. The step of extracting the subnetwork corresponding to the sample node from the network graph using the subnetwork extraction model includes: performing the following steps in each iteration using the subnetwork extraction model until a preset number of iterations is reached: Determine the feature representation of the currently selected sub-network; In the first iteration, the sample node is used as the current node, and in other iterations, the node added to the sub-network in the previous iteration is used as the current node, and a second feature representation of the current node in the network graph is determined; Obtaining a first feature representation of the current node using the feature representation of the currently selected subnetwork and the second feature representation of the current node; Determine a first similarity between a first feature representation of the current node and feature representations of each next-hop neighbor node of the current node in the network graph, and determine neighbor nodes whose corresponding first similarities meet a preset similarity requirement to be added to the subnetwork as the subnetwork selected in this iteration; The step of identifying the risk information of the sample node by using the first feature representation and the second feature representation includes: Perform self-attention processing on the first feature representation of the sample node to obtain the third feature representation of the sample node; Use the second feature representation of the sample node to perform self-attention processing to obtain the fourth feature representation of the sample node; Integrating the third feature representation and the fourth feature representation of the sample node to obtain a fifth feature representation of the sample node; Classification is performed using the fifth characteristic representation of the sample node to obtain risk information of the sample node.

6. A method for training a subnetwork extraction model, wherein: The method comprises: Obtain a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors, and each node in the network graph is labeled with a risk information label; A subnetwork extraction model is trained by sampling nodes from the network graph as sample nodes. The subnetwork extraction model performs the following steps in each round of iteration until a preset number of iterations is reached to obtain a subnetwork corresponding to the sample node: determining a feature representation of the currently selected subnetwork; using the sample node as the current node in the first round of iteration and using the node added to the subnetwork in the previous round of iteration as the current node in other rounds of iteration to determine a second feature representation of the current node in the network graph; using the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain a first feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determining that neighbor nodes whose corresponding first similarities meet a preset similarity requirement are added to the subnetwork as the subnetwork selected in this round of iteration; The training objectives include: in each round of iteration, maximizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph, and minimizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph.

7. A method for training a subnet extraction model, wherein: The method comprises: Obtain a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors, and each node in the network graph is labeled with a risk information label; A subnetwork extraction model is trained by sampling nodes from the network graph as sample nodes, and the subnetwork extraction model performs the following steps in each round of iteration until a preset number of iterations is reached to obtain a subnetwork corresponding to the sample node: determining a feature representation of the currently selected subnetwork; using the sample node as the current node in the first round of iteration, and using the node added to the subnetwork in the previous round of iteration as the current node in other rounds of iteration, and determining a second feature representation of the current node in the network graph; using the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain a first feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determining that the neighbor nodes whose corresponding first similarities meet the preset similarity requirements are added to the subnetwork as the subnetwork selected in this round of iteration; The training objectives include: in each round of iteration, maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph is greater than the second similarity, and maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph is less than the second similarity, where the second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph.

8. A risk identification device, wherein: The device comprises: a network graph acquisition unit configured to acquire a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors; a subnetwork extraction unit, configured to extract a subnetwork corresponding to a target node from the network graph using a subnetwork extraction model; a risk identification unit configured to determine, using a risk identification model, a first feature representation of the target node in the subnetwork and a second feature representation in the network graph, and identify risk information of the target node using the first feature representation and the second feature representation, the risk information including whether a network behavior corresponding to the target node is a risky behavior or risk level information of the network behavior corresponding to the target node; The sub-network extraction unit is specifically configured to perform the following steps in each iteration until a preset number of iterations is reached: Determine the feature representation of the currently selected sub-network; In the first iteration, the target node is used as the current node. In other iterations, the node added to the sub-network in the previous iteration is used as the current node to determine the second feature representation of the current node in the network graph. Using the feature representation of the currently selected sub-network and the second feature representation of the current node, the first feature representation of the current node is obtained; Determine a first similarity between a first feature representation of the current node and feature representations of each next-hop neighbor node of the current node in the network graph, and determine that the neighbor nodes whose corresponding first similarities meet a preset similarity requirement are added to the subnetwork as the subnetwork selected in this iteration; The risk identification unit is specifically configured to: perform self-attention processing on the first feature representation of the target node to obtain the third feature representation of the target node; use the second feature representation of the target node to perform self-attention processing to obtain the fourth feature representation of the target node; integrate the third feature representation and the fourth feature representation of the target node to obtain the fifth feature representation of the target node; use the fifth feature representation of the target node to perform classification to obtain the risk information of the target node.

9. A device for training a risk identification model, wherein: The device comprises: a network graph acquisition unit configured to acquire a network graph constructed using user network behavior data, wherein the network graph includes nodes and edges, wherein a node represents a network behavior, and an edge between two nodes represents the same user corresponding to the two network behaviors, and wherein some nodes in the network graph are labeled with risk information labels as sample nodes; a subnetwork extraction unit, configured to extract the subnetwork corresponding to the sample node from the network graph using a subnetwork extraction model; The first model training unit is configured to train a risk identification model using the network graph and the sub-network corresponding to the sample node, the risk identification model determining a first feature representation of the sample node in the corresponding sub-network and a second feature representation in the network graph, and identifying risk information of the sample node using the first feature representation and the second feature representation; the training objectives include minimizing the difference between the identified risk information of the sample node and the risk information label annotated with the sample node; the risk information includes whether the network behavior corresponding to the sample node is a risky behavior, or risk level information of the network behavior corresponding to the sample node; The step of extracting the subnetwork corresponding to the sample node from the network graph using the subnetwork extraction model includes: performing the following steps in each iteration using the subnetwork extraction model until a preset number of iterations is reached: Determine the feature representation of the currently selected sub-network; In the first iteration, the sample node is used as the current node, and in other iterations, the node added to the sub-network in the previous iteration is used as the current node, and a second feature representation of the current node in the network graph is determined; Obtaining a first feature representation of the current node using the feature representation of the currently selected subnetwork and the second feature representation of the current node; Determine a first similarity between a first feature representation of the current node and feature representations of each next-hop neighbor node of the current node in the network graph, and determine neighbor nodes whose corresponding first similarities meet a preset similarity requirement to be added to the subnetwork as the subnetwork selected in this iteration; When the first model training unit uses the first feature representation and the second feature representation to identify the risk information of the sample node, the first model training unit is specifically configured to: Perform self-attention processing on the first feature representation of the sample node to obtain the third feature representation of the sample node; Use the second feature representation of the sample node to perform self-attention processing to obtain the fourth feature representation of the sample node; Integrate the third feature representation and the fourth feature representation of the sample node to obtain the fifth feature representation of the sample node; The fifth feature representation of the sample node is used for classification to obtain the risk information of the sample node.

10. A device for training a subnet extraction model, wherein: The device comprises: a network graph acquisition unit configured to acquire a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors, and wherein each node in the network graph is labeled with a risk information label; The second model training unit is configured to sample nodes from the network graph as sample nodes to train a subnetwork extraction model, wherein the subnetwork extraction model performs the following steps in each round of iteration until a preset number of iterations is reached to obtain a subnetwork corresponding to the sample node: determining a feature representation of the currently selected subnetwork; using the sample node as the current node in the first round of iteration, and using the node added to the subnetwork in the previous round of iteration as the current node in other rounds of iteration, and determining a second feature representation of the current node in the network graph; using the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain a first feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determining that the neighbor nodes whose corresponding first similarities meet the preset similarity requirements are added to the subnetwork as the subnetwork selected in this round of iteration; The training objectives include: in each round of iteration, maximizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph, and minimizing the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph.

11. A device for training a subnet extraction model, wherein: The device comprises: a network graph acquisition unit configured to acquire a network graph constructed using the user's network behavior data, wherein the network graph includes nodes and edges, wherein the nodes represent network behaviors, and the edges between two nodes represent the same user corresponding to the two network behaviors, and wherein each node in the network graph is labeled with a risk information label; The second model training unit is configured to sample nodes from the network graph as sample nodes to train a subnetwork extraction model, wherein the subnetwork extraction model performs the following steps in each round of iteration until a preset number of iterations is reached to obtain a subnetwork corresponding to the sample node: determining a feature representation of the currently selected subnetwork; using the sample node as the current node in the first round of iteration, and using the node added to the subnetwork in the previous round of iteration as the current node in other rounds of iteration, and determining a second feature representation of the current node in the network graph; using the feature representation of the currently selected subnetwork and the second feature representation of the current node to obtain a first feature representation of the current node; determining a first similarity between the first feature representation of the current node and the feature representations of each next-hop neighbor node of the current node in the network graph, and determining that the neighbor nodes whose corresponding first similarities meet the preset similarity requirements are added to the subnetwork as the subnetwork selected in this round of iteration; The training objectives include: in each round of iteration, maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risky in the network graph is greater than the second similarity, and maximizing the degree to which the first similarity between the first feature representation of the current node and the feature representation of the node marked as risk-free in the network graph is less than the second similarity, where the second similarity is the similarity between the first feature representation of the current node and the feature representation of the virtual node in the network graph.

12. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 7.

13. A computing device comprising a memory and a processor, wherein: The memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 7 is implemented.

Images