A method and apparatus for mining risky objects based on knowledge graphs
By using multiple knowledge graph rule mining algorithms and cross-validation methods in an electronic payment platform to construct a target model, the problem of low accuracy in rule mining in existing technologies is solved, and efficient mining of risk objects is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ALIPAY (HANGZHOU) INFORMATION TECH CO LTD
- Filing Date
- 2023-04-23
- Publication Date
- 2026-05-26
AI Technical Summary
Existing rule mining methods have low accuracy and simple rule formats when used for risk analysis in electronic payment platforms, making them unable to effectively identify risk targets.
Multiple knowledge graph rule mining algorithms are used to mine rules from knowledge graphs. The target model is constructed by combining cross-validation and the probabilistic graphical model or classification model is trained using labeled data to improve the accuracy of rule mining.
It improves the accuracy and coverage of rule mining, enabling more accurate and efficient discovery of potential risk targets and reducing misjudgments.
Smart Images
Figure CN116361488B_ABST
Abstract
Description
Technical Field
[0001] This specification relates to one or more embodiments in the field of knowledge graphs, and more particularly to a method and apparatus for mining risky objects based on knowledge graphs. Background Technology
[0002] In recent years, knowledge graphs have been widely applied in various business applications such as search recommendation and financial risk control. Particularly in the scenario of transaction risk assessment on electronic payment platforms, information from a single user or transaction is often insufficient for accurate risk assessment. Therefore, the interconnected information covered by knowledge graphs is frequently used to identify risky users and transactions on electronic payment platforms. Although commonly used graph deep learning models have good performance, their lack of intuitive interpretability means that specific risk analysis rules are still needed as an aid in risk analysis scenarios. Currently, risk rules are often derived from expert experience, which is inefficient. To address this, researchers have proposed many risk rule mining methods to automatically extract usable risk rules from existing data. However, existing rule mining methods generally suffer from low accuracy and simple rule formats, failing to effectively identify risky targets. Summary of the Invention
[0003] This specification describes one or more embodiments of a method and apparatus for mining risk objects based on knowledge graphs, aiming to improve the accuracy and coverage of rule mining, so as to discover potential risk objects in electronic payments more accurately and efficiently.
[0004] Firstly, a method for mining risky objects based on knowledge graphs is provided, including:
[0005] A pre-formed knowledge graph is obtained, which contains several knowledge points related to users and transactions; some users and / or some transactions in the knowledge graph are identified as risk objects.
[0006] Several knowledge graph rule mining algorithms are used to mine the knowledge graph with the goal of obtaining the risk object, resulting in N risk rules. Any one of the risk rules is used to deduce the knowledge points related to the risk object.
[0007] By using the N risk rules respectively, reasoning is performed on the knowledge graph to obtain multiple hypothetical knowledge points that are assumed to involve risk objects;
[0008] For any first assumed knowledge point, determine its corresponding annotation data, including first annotation data indicating whether the N risk rules can deduce the first assumed knowledge point, and second annotation data indicating whether the first assumed knowledge point matches the knowledge graph;
[0009] The target model is trained using multiple labeled data corresponding to the aforementioned multiple assumed knowledge points; the trained target model is then used to identify risk objects.
[0010] In one possible implementation, the target model is a probabilistic graphical model; training the target model using multiple labeled data corresponding to the multiple assumed knowledge points includes:
[0011] Based on the first and second labeled data corresponding to any first assumed knowledge point, the factor values of multiple preset factors corresponding to the first assumed knowledge point are determined. The multiple preset factors are used to reflect the correlation between the assumed knowledge point and each risk rule.
[0012] Based on the weight parameters and the factor values of each of the multiple assumed knowledge points, the joint probability distribution of the multiple labeled data is determined;
[0013] With the goal of maximizing the joint probability distribution, the weight parameters are adjusted to obtain the optimized parameters of the probabilistic graphical model.
[0014] In one possible implementation, the plurality of preset factors includes at least two of the following:
[0015] Indicates whether the risk rule can deduce the first type of factor of the first assumed knowledge point;
[0016] A second type of factor indicating whether the first labeled data and the second labeled data are consistent;
[0017] A third type of factor indicating whether the reasoning results of any two of the aforementioned risk rules are consistent for the first assumed knowledge point.
[0018] In one possible implementation, determining the joint probability distribution of the multiple labeled data includes:
[0019] For any first assumed knowledge point, the inner product of the first vector formed by its corresponding factor values and the weight vector formed by the weight parameters is calculated. The inner product results corresponding to all the assumed knowledge points are normalized and summed to obtain the joint probability distribution.
[0020] In one possible implementation, after obtaining the optimized parameters of the probabilistic graphical model, the method further includes:
[0021] For the target knowledge points formed by the target user or target transaction to be analyzed, determine the corresponding first labeled data, and based on the first labeled data and two label values corresponding to true and false respectively, determine the first set of factor values and the second set of factor values corresponding to the multiple preset factors.
[0022] Based on the optimization parameters, the first probability corresponding to the first group of factor values and the second probability corresponding to the second group of factor values are determined respectively.
[0023] Based on the tag value corresponding to the larger of the first probability and the second probability, it is determined whether the target user or target transaction is a risk object.
[0024] In one possible implementation, the first labeled data includes N elements. When the i-th risk rule can deduce the first assumed knowledge point, the i-th element of the first labeled data is 1, otherwise it is 0.
[0025] In one possible implementation, the target model is a classification model; training the target model using multiple labeled data corresponding to the multiple assumed knowledge points includes:
[0026] A classification model is trained by using the first labeled data from the multiple labeled data as the sample feature data and the second labeled data as the sample label data.
[0027] In one possible implementation, the classification model includes at least: a logistic regression model, a neural network, and a gradient boosting decision tree (GBDT).
[0028] In one possible implementation, after training to obtain the classification model, the method further includes:
[0029] For any second assumed knowledge point among the plurality of assumed knowledge points, the classification model is used to classify it and the corresponding confidence level is calculated;
[0030] Any second assumed knowledge point whose confidence level is less than a preset first threshold is sent to the manual review platform for manual review, and the corrected second annotation data is determined based on the review results;
[0031] The classification model is retrained using the first labeled data from the multiple labeled data as the sample feature data and the corrected second labeled data as the sample label data.
[0032] In one possible implementation, after training to obtain the classification model, the method further includes:
[0033] For the target knowledge points formed by the target user or target transaction to be analyzed, determine the corresponding first labeled data as the feature of the sample to be tested.
[0034] The features of the sample to be tested are input into the classification model, and the target user or target transaction is determined as a risk object based on the classification result output by the model.
[0035] In one possible implementation, after determining the corresponding labeled data for any first assumed knowledge point, the method further includes:
[0036] For any third assumed knowledge point among the plurality of assumed knowledge points, if it is inferred by fewer than a preset second threshold of risk rules, then it is removed from the set of assumed knowledge points.
[0037] In one possible implementation, the plurality of knowledge graph rule mining algorithms include several of the following: path ranking algorithm PRA, association rule mining algorithm AMIE for incomplete knowledge bases, and subgraph feature extraction method SFE.
[0038] Secondly, a data mining method based on knowledge graphs is provided, including:
[0039] A pre-formed knowledge graph is obtained, which contains several knowledge points related to business objects; some business objects in the knowledge graph are set as target objects.
[0040] Several knowledge graph rule mining algorithms are used to mine rules in the knowledge graph to obtain N target rules, where any one of the target rules is used to deduce knowledge points related to the target object.
[0041] By using the N target rules respectively, reasoning is performed on the knowledge graph to obtain multiple hypothetical knowledge points that are assumed to involve the target object;
[0042] For any first assumed knowledge point, determine its corresponding annotation data, including first annotation data indicating whether the N target rules can infer the first assumed knowledge point, and second annotation data indicating whether the first assumed knowledge point matches the knowledge graph;
[0043] The target model is trained using multiple labeled data corresponding to the aforementioned multiple assumed knowledge points; the trained target model is then used to mine target objects.
[0044] Thirdly, a device for mining risk objects based on knowledge graphs is provided, including:
[0045] The acquisition unit is configured to acquire a pre-formed knowledge graph, which contains several knowledge points related to users and transactions; some users and / or some transactions in the knowledge graph are identified as risk objects.
[0046] The mining unit is configured to use several knowledge graph rule mining algorithms to perform rule mining on the knowledge graph with the risk object as the target, and obtain N risk rules, wherein any one of the risk rules is used to deduce the knowledge points related to the risk object.
[0047] The reasoning unit is configured to use the N risk rules to perform reasoning on the knowledge graph to obtain multiple hypothetical knowledge points that are assumed to involve risk objects.
[0048] The determining unit is configured to determine the corresponding annotation data for any first assumed knowledge point, including first annotation data indicating whether the N risk rules can deduce the first assumed knowledge point, and second annotation data indicating whether the first assumed knowledge point matches the knowledge graph.
[0049] The training unit is configured to train a target model using multiple labeled data corresponding to the multiple assumed knowledge points; the trained target model is used to identify risk objects.
[0050] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first or second aspect.
[0051] Fifthly, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method of the first aspect or the second aspect.
[0052] This specification presents a method and apparatus for mining risk objects based on knowledge graphs. The method itself does not impose any constraints on the form of the rules, supports multiple rule mining algorithms, can provide richer rule forms, and can achieve cross-validation, effectively improving the accuracy of mining risk objects. Attached Figure Description
[0053] To more clearly illustrate the technical solutions of the various embodiments disclosed in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only a few embodiments disclosed in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0054] Figure 1A This illustration shows an implementation scenario of mining risk objects based on a knowledge graph, according to one embodiment.
[0055] Figure 1B A framework diagram is shown for a method for mining risky objects based on a knowledge graph, according to one embodiment.
[0056] Figure 2 A flowchart illustrating a method for mining risky objects based on a knowledge graph according to one embodiment;
[0057] Figure 3 A flowchart illustrating a method for training a probabilistic graphical model according to one embodiment;
[0058] Figure 4 A schematic block diagram of an apparatus for mining risky objects based on a knowledge graph, according to one embodiment, is shown. Detailed Implementation
[0059] The solution provided in this specification will now be described with reference to the accompanying drawings.
[0060] Figure 1A This diagram illustrates an implementation scenario for risk object mining based on a knowledge graph, according to one embodiment. In the transaction risk analysis scenario, the underlying knowledge graph can contain knowledge points related to users and transactions. These knowledge points can be represented as nodes, node attributes, and relationships between nodes in the knowledge graph. Furthermore, some users and / or some transactions have already been identified as risk objects in this knowledge graph. Figure 1A In the example, nodes circled in black represent known risky users. To leverage this knowledge graph, we can mine more risky objects, such as... Figure 1A As shown, rule mining is first performed on the knowledge graph to obtain some risk rules.
[0061] In a knowledge graph, a rule is an abstract logical expression. For example, `TranferTo(A,B)&Pay(A,x)=>Receive(B,x)`, where A, B, and x are variables included in the rule. This rule means: when A initiates a transfer to B and A pays x yuan, it is inferred that B received x yuan. Rule mining is the process of extracting generalizable rules from knowledge graph data using various algorithmic strategies. For the knowledge graph containing risk objects, if rule mining is performed with the goal of obtaining these risk objects, several risk rules can be obtained—rules related to the risk objects. For example, `Tranfer-typeA(A,B)&Label(A,“y”)=>Label(B,“y”)` can be considered a risk rule, indicating that if A initiates a transfer of type A to B, and A's risk label is y (indicating whether the user is fraudulent), then it is inferred that B's risk label is also y.
[0062] Next, the obtained risk rules are used to perform rule reasoning on the original knowledge graph to obtain multiple assumed knowledge points involving risk objects.
[0063] Rule-based reasoning is the process of using one or more rules to deduce new knowledge from existing knowledge. When reasoning using mined risk rules in a knowledge graph, some hypothetical knowledge points can be obtained, including some hypothetical risk objects. For example, using the rule Transfer-typeA(A,B)&Label(A,“y”) => Label(B,“y”), and combining it with the existing knowledge Transfer-typeA(Anna,Bob) and Label(Anna,“1”), the new knowledge Label(Bob,“1”) can be inferred. That is, when Anna initiated a type A transfer to Bob, and Anna's risk label is 1 (indicating a fraudulent user), using the above risk rule Transfer-typeA(A,B)&Label(A,“y”) => Label(B,“y”), it can be inferred that Bob is also a fraudulent user (risk object).
[0064] Then, based on the obtained assumed knowledge points and the mined risk rules, a risk rule-based model is formed for the identification of risk objects.
[0065] In related technologies, rule mining methods mainly include PRA (Path Ranking Algorithm), TensorLog, and Neural LP. PRA, for each relation, searches for paths between entities based on the closed-world assumption, inducing path rules, and learning rule weights through linear regression. The closed-world assumption states that all facts included in the knowledge graph are true, and all facts not included in the knowledge graph are false. This assumption can lead to real events being misclassified as false due to missing graph data. Therefore, this method has the following problems: 1. It can only learn rules in simple path forms and cannot support more complex rules; while risk rules are likely to have relatively complex forms. 2. Training a linear regression classifier based on the closed-world assumption makes the model performance highly dependent on sample sampling, resulting in large and unstable variations in the obtained rule weight values.
[0066] Both TensorLog and Neural LP methods use neural networks to fit path rules, extracting path rules and weights from the trained network parameters. The problems are as follows: 1. Both methods only support path rules. 2. Both methods use neural network models, resulting in high overall complexity, low efficiency, and difficulty in handling large-scale data, including knowledge graphs describing transaction payment relationships.
[0067] Therefore, existing rule mining methods only provide a single algorithm, resulting in a limited number of rules, a single format, and low accuracy. When mining risky transactions and users in large-scale payment / transaction relationship knowledge graphs, they struggle to obtain accurate and comprehensive results. Based on this, in one or more embodiments of this specification, multiple rule mining algorithms are employed in the rule mining stage. Furthermore, in the modeling stage, the hypothetical risk objects obtained from different risk rules are cross-validated. Based on the cross-validation results, a rule-based model is constructed, thereby effectively improving the accuracy of mining transaction risk objects.
[0068] Figure 1B This diagram illustrates a framework of a knowledge graph-based method for mining risk objects according to one embodiment. First, pre-formed knowledge graph data is loaded, where some users and / or transactions are identified as risk objects. Then, M knowledge graph rule mining algorithms are used to mine rules from the knowledge graph, resulting in M rule sets. These M rule sets are merged to obtain a set containing N risk rules, which are used to deduce knowledge points related to risk objects. Knowledge reasoning is performed on the original knowledge graph using these rules to obtain multiple hypothetical knowledge points assuming involvement of risk objects. After determining the corresponding labeled data based on the cross-validation results of the hypothetical knowledge points and each risk rule, a target model is trained using this labeled data. The trained target model is used to mine risk objects. The target model can be a probabilistic graphical model or a classification model, such as a logistic regression model, neural network, gradient boosting decision tree (GBDT), etc.
[0069] The specific implementation steps of the above rule mining method are described below with reference to specific embodiments. Figure 2 A flowchart illustrating a method for mining risky objects based on a knowledge graph according to one embodiment is provided. The subject executing the method can be any platform, server, or device cluster with computing and processing capabilities.
[0070] In step 201, a pre-formed knowledge graph K is obtained, which contains several knowledge points related to users and transactions; some users and / or some transactions in the knowledge graph are identified as risk objects.
[0071] In daily electronic payments and transactions, in addition to normal users and transactions, there are also risky users and risky transactions. Risky users are those whose payment accounts are misused by someone else, such as users whose accounts are stolen, or fraudulent users who intend to carry out illegal transactions (such as malicious cash withdrawal, fraud, illegal fund transfer, etc.). Risky transactions can be transactions made by risky users or transactions whose attributes are deemed to be illegal, such as a user's account being stolen and then transferring money to other users, or transactions generated when a Taobao account is stolen and then used to purchase goods, or transactions generated when a normal user transfers money to a suspicious user.
[0072] By collecting relevant user attribute information, such as login device, frequent residence, and recent transactions, knowledge points related to the user are formed. Similarly, transaction-related attribute information, such as transaction account, transaction amount, payment method, transaction time, and transaction location, is collected to form transaction-related knowledge points. These knowledge points, containing both user and transaction information, are pre-formed into a knowledge graph, and certain users and / or transactions known to pose a risk are identified as risk objects.
[0073] In one embodiment, the above knowledge points can be in the form of triples, specifically, the triple (s, p, o), where s represents subject, p represents predicate, and o represents object. The triple (s, p, o) indicates that there is a relation p between entities s and o. For example, the triple (Anna, TransferTo, Bob) indicates that Anna initiated a transfer to Bob.
[0074] In another embodiment, the aforementioned knowledge point can be in the form of "relationship (entity 1, entity 2)," representing a relationship between entity 1 and entity 2. For example, TransferTo(Anna, Bob) represents Anna initiating a transfer to Bob.
[0075] In another embodiment, the aforementioned knowledge points can also be represented as attributes of nodes or relationships in a knowledge graph. For example, Label(Anna, "1").
[0076] In step 202, several knowledge graph rule mining algorithms are used to mine rules on the knowledge graph K with the goal of obtaining the risk object, resulting in N risk rules. Any one of these risk rules is used to deduce knowledge points related to the risk object.
[0077] In one embodiment, M knowledge graph rule mining algorithms, Algo1, Algo2, ..., AlgoM, are used to mine rules from the knowledge graph K, resulting in M rule sets, Rule1, Rule2, ..., RuleM. These M rule sets are then merged to obtain N risk rules, where any one of these risk rules is used to deduce knowledge points related to the risk object. Optionally, after merging the M rule sets, duplicate rules can be removed to obtain the N risk rules.
[0078] In a more specific embodiment, the knowledge graph rule mining algorithm used may include: PRA (PathRanking Algorithm), AMIE (Association Rule Mining under IncompleteEvidence), SFE (Subgraph Feature Extractor), and any other possible knowledge graph rule mining algorithm, which is not limited here.
[0079] In step 203, the N risk rules are used to perform reasoning on the knowledge graph K to obtain multiple hypothetical knowledge points that are assumed to involve risk objects.
[0080] In one embodiment, the N risk rules and the knowledge graph K are input into a knowledge reasoning system. The knowledge reasoning system then performs knowledge reasoning on the knowledge graph K according to each rule to obtain multiple hypothetical knowledge points that involve the risk object. The knowledge reasoning system uses a set of rules to reason new knowledge from existing knowledge.
[0081] For example, using the rule `TranferTo(A,B)&Pay(A,100)=>Receive(B,100)`, and combining it with the knowledge `TranferTo(Anna,Bob)` and `Pay(Anna,100)`, we can infer the new knowledge `Receive(Bob,100)`. That is, when Anna initiates a transfer to Bob and Anna pays 100, using the rule `TranferTo(A,B)&Pay(A,100)=>Receive(B,100)`, we can infer that Bob received 100.
[0082] In step 204, for any first assumed knowledge point, its corresponding annotation data is determined, including first annotation data Λ indicating whether the N risk rules can deduce the first assumed knowledge point, and second annotation data Y indicating whether the first assumed knowledge point matches the knowledge graph.
[0083] In a specific example, the first and second labeled data can be recorded in the following format: If the j-th rule among the N risk rules can deduce the i-th knowledge point among the plurality of assumed knowledge points, then the data in the i-th row and j-th column of the first labeled data Λ is marked as 1; otherwise, it is marked as 0. If the i-th knowledge point among the plurality of assumed knowledge points is true in the knowledge graph K, that is, the i-th knowledge point appears in the knowledge graph K, then the data in the i-th row of the second labeled data Y is marked as 1; if it is false or does not appear in the knowledge graph K, it is marked as 0.
[0084] For example, in a specific instance, the N risk rules include rules {r1, r2}, and among the multiple assumed knowledge points, there are three knowledge points {k1, k2, k3}. Rule r1 can deduce knowledge points k1 and k3, but cannot deduce knowledge point k2; rule r2 can deduce knowledge points k1 and k2, but cannot deduce knowledge point k3; knowledge points k2 and k3 appear in the knowledge graph K, while knowledge point k1 does not appear in the knowledge graph K. In this specific example, the first labeled data Λ is shown in Table 1, and the second labeled data Y is shown in Table 2.
[0085] Table 1: First labeled data Λ in a specific example
[0086] r1 r2 k1 1 1 k2 0 1 k3 1 0
[0087] Table 2: Second labeled data Y in a specific example
[0088] Y k1 0 k2 1 k3 1
[0089] It should be noted that the first row and first column in Table 1 and the first row and first column in Table 2 are added for illustrative purposes only. In practical applications, the first annotation data Λ in this example can be a 3x2 matrix, and the second annotation data Y can be a 3x1 matrix (column vector).
[0090] Furthermore, it should be understood that the above only illustrates one specific recording format for the first and second labeled data. However, labeled data can also be recorded in other formats, such as using other symbols / markers / numerical values to record the matching of assumed knowledge points with other information, or recording labeled data as numerical strings, etc., which are not limited here.
[0091] In one embodiment, for any third hypothetical knowledge point among the plurality of hypothetical knowledge points, if it is inferred by fewer than a preset second threshold of risk rules, it is removed from the set of hypothetical knowledge points. Specifically, for the third hypothetical knowledge point ks, if the number of 1s in the row where it appears in the first labeled data Λ is less than the second threshold, it is removed from the set of hypothetical knowledge points. This can filter out hypothetical knowledge points with low credibility and reduce the possibility of misjudgment in subsequent risk object mining processes.
[0092] In step 205, the target model is trained using multiple labeled data corresponding to the multiple assumed knowledge points; the trained target model is used to identify risk objects.
[0093] The target model can include at least two major categories: probabilistic graphical models and classification models.
[0094] When the target model is a probabilistic graphical model, the training method for the probabilistic graphical model is as follows: Figure 3 As shown.
[0095] In step 301, based on the first labeled data Λ and the second labeled data Y corresponding to any first assumed knowledge point, the factor values of multiple preset factors corresponding to the first assumed knowledge point are determined. The multiple preset factors are used to reflect the correlation between the assumed knowledge point and each risk rule.
[0096] In one embodiment, the plurality of preset factors include: a first type of factor indicating whether the risk rule can deduce the first assumed knowledge point; a second type of factor indicating whether the first labeled data and the second labeled data are consistent; and a third type of factor indicating whether the reasoning results of any two of the risk rules for the first assumed knowledge point are consistent.
[0097] Specifically, the first type of factor is the label bias factor. Its value is determined by whether any rule j in the annotation matrix can lead to any knowledge point i, that is...
[0098] The second type of factor is the accuracy factor. Its value is derived from any rule j in the annotation matrix to determine the truth or falsity of any knowledge point i, and is compared with the label y in the i-th row of the second annotation data Y. i Whether they are consistent or not, that is
[0099] The third type of factor is the correlation coefficient factor. Its value is determined by whether the reasoning results of any two different rules j and k are the same for the same knowledge point i, that is...
[0100] It should be noted that the operator 1{} in the above factor formula means that the value is 1 when the conditional expression inside the curly braces is true, and 0 when the conditional expression inside the curly braces is false.
[0101] When there are N risk rules, for the i-th knowledge point among the multiple assumed knowledge points, its corresponding first-type factor It can have N values, corresponding to the second type of factor. It can have N values, corresponding to the third type of factor. There can be C possible values, where the maximum value of C is N*N / 2, which is the number of pairwise combinations of the rules.
[0102] In other embodiments, other or more factors can be defined in the manner described above, as long as they can reflect the relationship between the assumed knowledge point and each risk rule. For example, a fourth type of factor can be defined to represent the number of risk rules that can be deduced from the assumed knowledge point, and so on.
[0103] In step 302, based on the weight parameter ω and the factor values of the multiple assumed knowledge points, the joint probability distribution of the multiple labeled data is determined.
[0104] In one embodiment, for any first assumed knowledge point, the inner product of the first vector composed of its corresponding factor values and the weight vector composed of the weight parameters is calculated, and the inner product results corresponding to all the assumed knowledge points are normalized and summed to obtain the joint probability distribution.
[0105] In a more specific embodiment, for the i-th hypothetical knowledge point among the plurality of hypothetical knowledge points, a first vector φ is formed by its corresponding factor values. i (Λ,y i ), the first vector φ i (Λ,y i The dimension of y is 2N+C. i Let p be the label of the i-th row in the second labeled data Y. At this time, the joint probability distribution p... ω (Λ,Y) is shown in formula (1):
[0106]
[0107] in, The partition function is used to normalize the calculation results; exp(x) represents e x Let m be the total number of assumed knowledge points. This can be understood as ω and φ. i (Λ,y i The dimensions are the same.
[0108] For example, continuing with the example below step 204 above, for knowledge k1, its first-type factors with respect to rules r1 and r2 The values of are 1 and 1, respectively, and their second-type factors with respect to rules r1 and r2 are... The values of are 0 and 0 respectively, and their third-type factors with respect to rules r1 and r2 are... The values of are 1, 1, 1 respectively. All the values of the three types of factors are combined to form the first vector φ1(Λ,y1)=(1,1,0,0,1,1,1).
[0109] For knowledge k2, its first-type factors with respect to rules r1 and r2 The values of are 0 and 1, and their second-type factors with respect to rules r1 and r2 are... The values of are 0 and 1, and their third-type factors with respect to rules r1 and r2 are... The values of are 1, 0, and 1 respectively. All the values of the three types of factors are combined to form the first vector φ2(Λ,y2)=(0,1,0,1,1,0,1).
[0110] For knowledge k3, its first-type factors with respect to rules r1 and r2 The values of are 1 and 0, and their second-type factors with respect to rules r1 and r2 are... The values of are 1 and 0, respectively, and their third-type factors with respect to rules r1 and r2 are... The values of are 1, 0, and 1 respectively. All the values of the three types of factors are combined to form the first vector φ3(Λ,y3)=(1,0,1,0,1,0,1).
[0111] At this time, the joint probability distribution p ω (Λ,Y) is shown in formula (2):
[0112]
[0113] In step 303, with the goal of maximizing the joint probability distribution, the weight parameter ω is adjusted to obtain the optimized parameters of the probabilistic graphical model.
[0114] In one embodiment, the optimized weight parameters are obtained by maximizing the log-marginal likelihood function corresponding to the joint probability distribution. In this way, a probabilistic graphical model was obtained through training.
[0115] In other embodiments, other types of preset factors can be defined, and then a corresponding joint probability distribution model can be constructed, using the first labeled data Λ and the second labeled data Y to train the model.
[0116] In some implementations, after obtaining the optimized parameters of the probabilistic graphical model in step 303, the method further includes the step of using the trained probabilistic graphical model to mine risky objects:
[0117] For the target knowledge points formed by the target user or target transaction to be analyzed, determine the corresponding first labeled data, and based on the first labeled data and two label values corresponding to true and false respectively, determine the first set of factor values and the second set of factor values corresponding to the multiple preset factors; based on the optimization parameters, determine the first probability corresponding to the first set of factor values and the second probability corresponding to the second set of factor values respectively; based on the label value corresponding to the larger of the first probability and the second probability, determine whether the target user or target transaction is a risk object.
[0118] Specifically, for the target knowledge points formed by the target user or target transaction to be analyzed, N risk rules are first used to infer and label them, obtaining the corresponding first labeled data Λ. Then, y is set to values 1 and 0 respectively to obtain the first set of factor values φ(Λ,1) and the second set of factor values φ(Λ,0). Then, based on the optimized... Calculate the first probability p respectively ω (Λ,1) and the second probability p ω (Λ,0), based on the label value corresponding to the larger of the first probability and the second probability, determine whether the target user or target transaction is a risk object.
[0119] When the target model mentioned in step 205 is a classification model, the training methods for the classification model include:
[0120] Using the first labeled data Λ in the multiple labeled data as sample feature data and the second labeled data Y as sample label data, a classification model is trained. The classification model includes at least: a logistic regression model, a neural network, and a gradient boosting decision tree (GBDT).
[0121] Optionally, in one embodiment, for any second assumed knowledge point among the plurality of assumed knowledge points, a pre-trained classification model is used to classify it and calculate the corresponding confidence level; any second assumed knowledge point whose confidence level is less than a preset first threshold is sent to a manual review platform for manual review, and the corrected second annotation data is determined based on the review results; the classification model is retrained using the first annotation data among the plurality of annotation data as sample feature data and the corrected second annotation data as sample label data.
[0122] After training the classification model, the method further includes the step of using the trained classification model to mine risky objects:
[0123] For the target knowledge points formed by the target user or target transaction to be analyzed, determine the corresponding first labeled data, and determine whether the target user or target transaction is a risk object based on the classification result of the first labeled data by the classification model.
[0124] In summary, the method for mining risk objects based on knowledge graphs proposed in the embodiments of this specification imposes no constraints on the form of risk rules, supports multiple rule mining algorithms, and can provide risk rules with richer forms. Furthermore, when calculating rule confidence, the assumption that a knowledge point appears in the original knowledge graph is used as one of the labeled data points for cross-validation with other labeled data, without relying on the closed-world assumption. The risk rule-based model constructed in this way can more effectively and accurately mine risk objects.
[0125] Based on the above concept, we can extend the knowledge graph-based data mining method to other scenarios, starting from risk analysis. Specifically, this method can include the following steps: First, obtain a pre-formed knowledge graph containing several knowledge points related to business objects; and designate some business objects in the knowledge graph as target objects. These business objects can be users, transactions, goods, or other objects, while the target objects can be business objects of interest to be analyzed. Then, use several knowledge graph rule mining algorithms to mine rules in the knowledge graph, obtaining N target rules, where any one target rule is used to deduce knowledge points related to the target objects. Next, use the N target rules to perform reasoning on the knowledge graph, obtaining multiple hypothetical knowledge points that are assumed to involve the target objects. For any first hypothetical knowledge point, determine its corresponding annotation data, including first annotation data indicating whether the N target rules can deduce the first hypothetical knowledge point, and second annotation data indicating whether the first hypothetical knowledge point matches the knowledge graph. After obtaining multiple annotation data corresponding to multiple hypothetical knowledge points, the target model can be trained using this annotation data; the trained target model is then used to mine target objects.
[0126] According to another embodiment, an apparatus for mining risk objects based on knowledge graphs is also provided. Figure 4 A schematic block diagram of an apparatus according to one embodiment is shown, which can be deployed in any device, platform, or cluster of devices with computing and processing capabilities. Figure 4 As shown, the device 400 includes:
[0127] The acquisition unit 401 is configured to acquire a pre-formed knowledge graph, which contains several knowledge points related to users and transactions; some users and / or some transactions in the knowledge graph are identified as risk objects.
[0128] Mining unit 402 is configured to use several knowledge graph rule mining algorithms to perform rule mining on the knowledge graph with the goal of obtaining the risk object, and obtain N risk rules, wherein any one of the risk rules is used to deduce knowledge points related to the risk object;
[0129] The reasoning unit 403 is configured to use the N risk rules to perform reasoning on the knowledge graph to obtain multiple hypothetical knowledge points that are assumed to involve risk objects.
[0130] The determining unit 404 is configured to determine the corresponding annotation data for any first assumed knowledge point, including first annotation data indicating whether the N risk rules can deduce the first assumed knowledge point, and second annotation data indicating whether the first assumed knowledge point is consistent with the knowledge graph.
[0131] Training unit 405 is configured to train a target model using multiple labeled data corresponding to the multiple assumed knowledge points; the trained target model is used to mine risk objects.
[0132] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform the methods described in any of the above embodiments.
[0133] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method described in any of the above embodiments.
[0134] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.
[0135] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.
[0136] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for mining risky objects based on knowledge graphs, comprising: Obtain a pre-formed knowledge graph, which contains several knowledge points related to users and transactions; Some users and / or some transactions in the knowledge graph are identified as risk objects; Several knowledge graph rule mining algorithms are used to mine the knowledge graph with the goal of obtaining the risk object, resulting in N risk rules. Any one of the risk rules is used to deduce the knowledge points related to the risk object. By using the N risk rules respectively, reasoning is performed on the knowledge graph to obtain multiple hypothetical knowledge points that are assumed to involve risk objects; For any first assumed knowledge point, determine its corresponding annotation data, including first annotation data indicating whether the N risk rules can deduce the first assumed knowledge point, and second annotation data indicating whether the first assumed knowledge point matches the knowledge graph; The target model is trained using multiple labeled data corresponding to the aforementioned multiple assumed knowledge points; the trained target model is then used to identify risky objects.
2. The method according to claim 1, wherein, The target model is a probabilistic graphical model; the target model is trained using multiple labeled data corresponding to the multiple assumed knowledge points, including: Based on the first and second labeled data corresponding to any first assumed knowledge point, the factor values of multiple preset factors corresponding to the first assumed knowledge point are determined. The multiple preset factors are used to reflect the correlation between the assumed knowledge point and each risk rule. Based on the weight parameters and the factor values of each of the multiple assumed knowledge points, the joint probability distribution of the multiple labeled data is determined; With the goal of maximizing the joint probability distribution, the weight parameters are adjusted to obtain the optimized parameters of the probabilistic graphical model.
3. The method according to claim 2, wherein, The plurality of preset factors includes at least two of the following: Indicates whether the risk rule can deduce the first type of factor of the first assumed knowledge point; A second type of factor indicating whether the first labeled data and the second labeled data are consistent; A third type of factor indicating whether the reasoning results of any two of the aforementioned risk rules are consistent for the first assumed knowledge point.
4. The method according to claim 2, wherein, Determining the joint probability distribution of the multiple labeled data includes: For any first assumed knowledge point, the inner product of the first vector formed by its corresponding factor values and the weight vector formed by the weight parameters is calculated. The inner product results corresponding to all the assumed knowledge points are normalized and summed to obtain the joint probability distribution.
5. The method according to claim 2, wherein, After obtaining the optimized parameters of the probabilistic graphical model, the method further includes: For the target knowledge points formed by the target user or target transaction to be analyzed, determine the corresponding first labeled data, and based on the first labeled data and two label values corresponding to true and false respectively, determine the first set of factor values and the second set of factor values corresponding to the multiple preset factors. Based on the optimization parameters, the first probability corresponding to the first group of factor values and the second probability corresponding to the second group of factor values are determined respectively. Based on the tag value corresponding to the larger of the first probability and the second probability, it is determined whether the target user or target transaction is a risk object.
6. The method according to claim 1, wherein, The first labeled data includes N elements. When the i-th risk rule can deduce the first assumed knowledge point, the i-th element of the first labeled data is 1, otherwise it is 0.
7. The method according to claim 1, wherein, The target model is a classification model; the target model is trained using multiple labeled data corresponding to the multiple assumed knowledge points, including: A classification model is trained by using the first labeled data from the multiple labeled data as the sample feature data and the second labeled data as the sample label data.
8. The method according to claim 7, wherein, The classification model includes at least: logistic regression model, neural network, and gradient boosting decision tree (GBDT).
9. The method according to claim 7, wherein, After training the classification model, the method further includes: For any second assumed knowledge point among the plurality of assumed knowledge points, the classification model is used to classify it and the corresponding confidence level is calculated; Any second assumed knowledge point whose confidence level is less than a preset first threshold is sent to the manual review platform for manual review, and the corrected second annotation data is determined based on the review results; The classification model is retrained using the first labeled data from the multiple labeled data as the sample feature data and the corrected second labeled data as the sample label data.
10. The method according to claim 7, wherein, After training the classification model, the method further includes: For the target knowledge points formed by the target user or target transaction to be analyzed, determine the corresponding first labeled data as the feature of the sample to be tested. The features of the sample to be tested are input into the classification model, and the target user or target transaction is determined as a risk object based on the classification result output by the model.
11. The method according to claim 1, wherein, After determining the corresponding labeled data for any first assumed knowledge point, the method further includes: For any third assumed knowledge point among the plurality of assumed knowledge points, if it is inferred by fewer than a preset second threshold of risk rules, then it is removed from the set of assumed knowledge points.
12. The method according to claim 1, wherein, The knowledge graph rule mining algorithms include several of the following: path ranking algorithm PRA, association rule mining algorithm AMIE for incomplete knowledge bases, and subgraph feature extraction method SFE.
13. An apparatus for mining risk objects based on knowledge graphs, comprising: The acquisition unit is configured to acquire a pre-formed knowledge graph, which contains several knowledge points related to users and transactions; some users and / or some transactions in the knowledge graph are identified as risk objects. The mining unit is configured to use several knowledge graph rule mining algorithms to perform rule mining on the knowledge graph with the risk object as the target, and obtain N risk rules, wherein any one of the risk rules is used to deduce the knowledge points related to the risk object. The reasoning unit is configured to use the N risk rules to perform reasoning on the knowledge graph to obtain multiple hypothetical knowledge points that are assumed to involve risk objects. The determining unit is configured to determine the corresponding annotation data for any first assumed knowledge point, including first annotation data indicating whether the N risk rules can deduce the first assumed knowledge point, and second annotation data indicating whether the first assumed knowledge point matches the knowledge graph. The training unit is configured to train the target model using multiple labeled data corresponding to the multiple assumed knowledge points; The trained target model is used to identify risky objects.
14. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-12.
15. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-12.