Knowledge graph application method and device, electronic equipment, medium and program product

Abstract

The present disclosure provides an application method and device of knowledge graph based on fraud information, electronic equipment, medium and computer program product. The above method and device can be used in the field of artificial intelligence technology. The above method comprises: constructing a knowledge graph in real time according to fraud information information of a bank internal system obtained in real time; determining a query result in response to a query request; determining a relevant answer from the knowledge graph in response to an inquiry request by using a pre-constructed question and answer model; and matching a fraud prevention prompt according to the query result or the relevant answer. Wherein, the knowledge graph is constructed in real time according to the fraud information information of the bank internal system obtained in real time, comprising: using a pre-constructed entity relationship extraction model to extract entities and relationships from the fraud information information of the bank internal system obtained in real time to obtain a triple pre-selected set; aligning the entities in the triple pre-selected set to obtain a triple set; and constructing a knowledge graph according to the triple set.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of artificial intelligence, and more particularly, to an application method and device of a knowledge graph based on fraud information, an electronic device, a medium and a computer program product. BACKGROUND

[0002] With the popularity and rapid development of the network, fraud activities are changing day by day. As a front line of transactions, banks have a large amount of fraud information and specific transaction information. Understandably, through analysis, it can be found that fraud means or account information are traceable. If the scattered fraud information can be linked, the occurrence of fraud can be effectively prevented, and the property safety of users can be ensured. SUMMARY

[0003] Therefore, the present disclosure provides an application method and device of a knowledge graph based on fraud information, an electronic device, a computer readable storage medium and a computer program product, which can obtain comprehensive fraud information and corresponding fraud prevention prompts, thereby effectively preventing the occurrence of fraud and ensuring the property safety of users.

[0004] One aspect of the present disclosure provides an application method of a knowledge graph based on fraud information, comprising: constructing a knowledge graph in real time according to fraud information of a bank internal system obtained in real time; determining a query result in response to a query request, wherein the query request includes a keyword related to a node and / or an edge, and the query result includes a node and / or an edge corresponding to the query request in the knowledge graph and associated information of the node and / or the edge; determining a relevant answer from the knowledge graph in response to an inquiry request by using a pre-constructed question and answer model; and matching a fraud prevention prompt according to the query result or the relevant answer.

[0005] The knowledge graph is constructed in real time according to the fraud information of the bank internal system obtained in real time, comprising: using a pre-constructed entity relationship extraction model to extract entities and relationships from the fraud information of the bank internal system obtained in real time to obtain a preselected set of triples; aligning the entities in the preselected set of triples to obtain a set of triples; and constructing a knowledge graph according to the set of triples.

[0006] According to the application method of the knowledge graph based on fraud information provided in the embodiments of the present disclosure, the knowledge graph can be constructed in real time according to the fraud information obtained in real time. In response to a query request, a search can be performed in the knowledge graph, and thus the query result can be determined in the knowledge graph. In response to an inquiry request, a relevant answer can be determined from the knowledge graph by using a pre-constructed question and answer model, and the relevant answer can be a node and / or an edge related to a question in the inquiry request and an edge and / or a node associated with the node and / or the edge. According to the query result or the relevant answer, a fraud prevention prompt can be matched in a pre-constructed fraud prevention prompt library. The application method provided in the present disclosure can associate scattered fraud information, obtain comprehensive fraud information in response to a query or an inquiry, and further obtain a corresponding fraud prevention prompt, so that the generation of fraud can be effectively prevented, and the property safety of a user can be ensured.

[0007] In some embodiments, the aligning the entities in the preselected set of triples to obtain a set of triples comprises: calculating a similarity between each two entities in the preselected set of triples; when the similarity between the two entities satisfies a set threshold, determining whether the relationship in the triples in which the two entities are located is consistent; when the relationship in the triples in which the two entities are located is consistent, deleting one of the triples in which the two entities are located; and when the relationship in the triples in which the two entities are located is inconsistent, replacing one of the two entities with the other.

[0008] In some embodiments, the calculating the similarity between each two entities in the preselected set of triples comprises: calculating a first similarity between each two entities in the preselected set of triples by using a Dice distance method; calculating a second similarity between the two entities by using an edit distance method; and weighted summing the first similarity and the second similarity to obtain the similarity between each two entities in the preselected set of triples.

[0009] In some embodiments, the pre-constructing the entity relation extraction model comprises: operation S41, training an extraction rule of a triple element in a triple in the entity relation extraction model according to a label of each word in training text data to obtain a pre-extraction rule, wherein the triple element comprises a first entity, a relationship between the first entity and a second entity, and the second entity; operation S42, verifying the pre-extraction rule of the entity relation extraction model by using verification text data; operation S43, if the verification is passed, applying the pre-extraction rule as an extraction rule of the entity relation extraction model; and operation S44, if the verification is not passed, repeatedly performing operation S41 and operation S42 until the verification is passed.

[0010] In some embodiments, the determining the relevant answer from the knowledge graph in response to the inquiry request by using the pre-constructed question and answer model comprises: splicing the question vector of the inquiry request and m pre-selected relevant answer vectors in the knowledge graph by using a pre-constructed vector splicing model to obtain m splicing vectors, where m is an integer greater than or equal to 1; predicting a probability value of each splicing vector in the m splicing vectors by using a pre-constructed probability prediction model; and determining one of the m pre-selected relevant answers as the relevant answer according to the ranking of the m probability values.

[0011] In some embodiments, the pre-constructed vector splicing model comprises: operation S61, training a splicing parameter in the vector splicing model according to a training sample to obtain a training splicing parameter, where the training sample comprises a question vector and a pre-selected relevant answer vector corresponding to the question vector; operation S62, verifying the training splicing parameter of the vector splicing model by using a verification sample; operation S63, if the verification is passed, applying the training splicing parameter as a model parameter of the vector splicing model; and operation S64, if the verification is not passed, repeatedly performing operation S61 and operation S62 until the verification is passed.

[0012] In some embodiments, the pre-constructed probability prediction model comprises: operation S71, training a probability prediction parameter in the probability prediction model according to a splicing vector training sample to obtain a training probability prediction parameter; operation S72, verifying the training probability prediction parameter of the probability prediction model by using a splicing vector verification sample; operation S73, if the verification is passed, applying the training probability prediction parameter as a model parameter of the probability prediction model; and operation S74, if the verification is not passed, repeatedly performing operation S71 and operation S72 until the verification is passed.

[0013] Another aspect of the present disclosure provides an application device of a knowledge graph based on fraud information, comprising: a first construction module configured to construct a knowledge graph in real time according to fraud information of a bank internal system obtained in real time; a first determination module configured to determine a query result in response to a query request, wherein the query request comprises a keyword related to a node and / or an edge, and the query result comprises a node and / or an edge corresponding to the query request in the knowledge graph and associated information of the node and / or the edge; a second determination module configured to determine a relevant answer from the knowledge graph in response to an inquiry request by using a pre-constructed question and answer model; and a matching module configured to match a fraud prevention prompt according to the query result or the relevant answer.

[0014] The method comprises the following steps: constructing a knowledge graph in real time according to real-time obtained fraud information of a bank internal system, and constructing a fraud information knowledge graph in real time according to the knowledge graph.

[0015] Another aspect of the present disclosure provides an electronic device comprising one or more processors and one or more memories, wherein the memories are configured to store executable instructions which, when executed by the processors, implement the method as described above.

[0016] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions which, when executed, implement the method as described above.

[0017] Another aspect of the present disclosure provides a computer program product comprising a computer program comprising computer-executable instructions which, when executed, implement the method as described above. BRIEF DESCRIPTION OF DRAWINGS

[0018] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0019] Figure 1 An exemplary system architecture to which the method and device according to embodiments of the present disclosure can be applied is schematically shown;

[0020] Figure 2 A flowchart of an application method of a fraud information knowledge graph according to embodiments of the present disclosure is schematically shown;

[0021] Figure 3 A flowchart of constructing a knowledge graph in real time according to real-time obtained fraud information of a bank internal system according to embodiments of the present disclosure is schematically shown;

[0022] Figure 4 A flowchart of aligning entities in a preselected set of triples to obtain a set of triples according to embodiments of the present disclosure is schematically shown;

[0023] Figure 5 A flowchart of calculating a similarity between each two entities in a preselected set of triples according to embodiments of the present disclosure is schematically shown;

[0024] Figure 6 A flowchart of preconstructing an entity relation extraction model according to embodiments of the present disclosure is schematically shown;

[0025] Figure 7 A flowchart illustrating a process of determining a relevant answer from a knowledge graph in response to an inquiry request by utilizing a pre-constructed question and answer model according to an embodiment of the disclosure is schematically shown;

[0026] Figure 8 A flowchart illustrating a pre-constructed vector splicing model according to an embodiment of the disclosure is schematically shown;

[0027] Figure 9 A flowchart illustrating a pre-constructed probability prediction model according to an embodiment of the disclosure is schematically shown;

[0028] Figure 10 A flowchart illustrating an entity alignment method based on Dice and edit distance according to an embodiment of the disclosure is schematically shown;

[0029] Figure 11 A flowchart illustrating a question and relationship semantic matching according to an embodiment of the disclosure is schematically shown;

[0030] Figure 12 A general architecture diagram of a bank fraud field knowledge graph retrieval platform according to an embodiment of the disclosure is schematically shown;

[0031] Figure 13 A backend web architecture diagram according to an embodiment of the disclosure is schematically shown;

[0032] Figure 14 A flowchart of an underlying operation when a double-click extension operation is performed according to an embodiment of the disclosure is schematically shown;

[0033] Figure 15 A block diagram of an application device based on a fraud information knowledge graph according to an embodiment of the disclosure is schematically shown;

[0034] Figure 16 A block diagram of a first construction module according to an embodiment of the disclosure is schematically shown;

[0035] Figure 17 A block diagram of an electronic device according to an embodiment of the disclosure is schematically shown. DETAILED DESCRIPTION

[0036] Hereinafter, embodiments of the disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely exemplary and is not intended to limit the scope of the disclosure. In the following detailed description of embodiments of the disclosure, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. However, it would be apparent to one skilled in the art that the embodiments of the disclosure can be practiced without these specific details. In other instances, descriptions of well-known structures and techniques have been omitted in order to avoid obscuring the concepts of the disclosure.

[0037] In the technical solutions of the present disclosure, the acquisition, storage and application of user personal information comply with relevant laws and regulations, necessary security measures are taken, and the public order and good customs are not violated. In the technical solutions of the present disclosure, the acquisition, collection, storage, use, processing, transmission, provision, disclosure and application of data comply with relevant laws and regulations, necessary security measures are taken, and the public order and good customs are not violated.

[0038] The terms used herein are merely used to describe specific embodiments, and are not intended to limit the present disclosure. The terms "include", "contain" and the like used herein indicate the existence of the described features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0039] In the case of using expressions similar to "at least one of A, B or C, etc.", in general, it should be interpreted according to the meaning of the expression as understood by a person skilled in the art (for example, "a system having at least one of A, B or C" should include but is not limited to a system having A alone, a system having B alone, a system having C alone, a system having both A and B, a system having both A and C, a system having both B and C, and / or a system having A, B and C, etc.). The terms "first", "second" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features.

[0040] With the popularity and rapid development of the network, fraud activities are changing day by day. As a front line of transactions, banks have a large amount of fraud information and specific transaction information. It can be understood that through analysis, fraud means or account information can be found, and if scattered fraud information can be linked, fraud can be effectively prevented, and the safety of users' property can be ensured.

[0041] Embodiments of the present disclosure provide an application method and device of a fraud information-based knowledge graph, an electronic device, a computer readable storage medium and a computer program product. The application method of the fraud information-based knowledge graph comprises: constructing a knowledge graph in real time according to fraud information of a bank internal system obtained in real time; determining a query result in response to a query request, wherein the query request comprises a keyword related to a node and / or an edge, and the query result comprises a node and / or an edge corresponding to the query request in the knowledge graph and associated information of the node and / or the edge; determining a related answer from the knowledge graph in response to an inquiry request by using a pre-constructed question and answer model; and matching a fraud prevention prompt according to the query result or the related answer.

[0042] According to the fraud information of the bank internal system obtained in real time, a knowledge graph is constructed in real time, including: using a pre-constructed entity relationship extraction model, performing entity and relationship extraction on the fraud information of the bank internal system obtained in real time to obtain a preselected set of triples; aligning the entities in the preselected set of triples to obtain a set of triples; and constructing a knowledge graph according to the set of triples.

[0043] It should be noted that the application method, device, electronic device, computer readable storage medium and computer program product of the knowledge graph based on fraud information according to the present disclosure can be used in the field of artificial intelligence technology, and can also be used in any field other than the field of artificial intelligence technology, for example, the field of finance, and the field of the present disclosure is not limited here.

[0044] Figure 1 An exemplary system architecture 100 to which the application method, device, electronic device, computer readable storage medium and computer program product of the knowledge graph based on fraud information can be applied according to an embodiment of the present disclosure is schematically shown. It should be noted that, Figure 1 The system architecture shown is only an example of a system architecture to which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0045] As Figure 1 shown, the system architecture 100 according to this embodiment can include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used as a medium to provide a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0046] Users can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0047] The terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0048] The server 105 can be a server that provides various services, such as a background management server that provides support for a website browsed by a user using the terminal device 101, 102, or 103 (as an example). The background management server can analyze and process received user requests and the like, and feed back the processing results (such as a webpage, information, or data obtained or generated according to a user request) to the terminal device.

[0049] It should be noted that the application method of the knowledge graph based on fraud information provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the application device of the knowledge graph based on fraud information provided in the embodiments of the present disclosure can generally be arranged in the server 105. The application method of the knowledge graph based on fraud information provided in the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the terminal device 101, 102, or 103 and / or the server 105. Accordingly, the application device of the knowledge graph based on fraud information provided in the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the terminal device 101, 102, or 103 and / or the server 105.

[0050] It should be understood that Figure 1 The number of terminal devices, networks, and servers in the system 100 is merely illustrative. Any number of terminal devices, networks, and servers can be provided according to implementation needs.

[0051] The application method of the knowledge graph based on fraud information provided in the embodiments of the present disclosure will be described in detail below based on the scenario described above. Figure 1 The application method of the knowledge graph based on fraud information provided in the embodiments of the present disclosure will be described in detail below based on the scenario described above. Figures 2-9 The application method of the knowledge graph based on fraud information provided in the embodiments of the present disclosure will be described in detail below based on the scenario described above.

[0052] Figure 2 A flowchart of the application method of the knowledge graph based on fraud information according to the embodiments of the present disclosure is schematically shown.

[0053] As shown in Figure 2 The application method of the knowledge graph based on fraud information of this embodiment includes operations S210-S240.

[0054] In operation S210, a knowledge graph is constructed in real time according to fraud information of a bank internal system obtained in real time.

[0055] In operation S220, a query result is determined in response to a query request, where the query request includes a keyword related to a node and / or an edge, and the query result includes a node and / or an edge corresponding to the query request in the knowledge graph and associated information of the node and / or the edge.

[0056] At operation S230, a relevant answer is determined from the knowledge graph in response to the inquiry request by using a pre-constructed question and answer model.

[0057] At operation S240, a fraud prevention prompt is matched according to the query result or the relevant answer.

[0058] As shown in FIG. 2, operation S210 includes operations S211-S213. Figure 3

[0059] At operation S211, an entity and relationship extraction is performed on the real-time obtained fraud information of the bank internal system by using a pre-constructed entity relationship extraction model, to obtain a pre-selected set of triples.

[0060] At operation S212, the entities in the pre-selected set of triples are aligned to obtain a set of triples.

[0061] At operation S213, a knowledge graph is constructed according to the set of triples. Through operations S211-S213, the knowledge graph can be constructed in real time according to the real-time obtained fraud information of the bank internal system. Compared with the pre-selected set of triples without alignment operation, the set of triples after alignment operation has cleaner data and no noise interference, so that the knowledge graph constructed by the set of triples is more concise, and the knowledge graph can be used more efficiently in operations S220 and S230.

[0062] According to the application method of the knowledge graph based on fraud information, the knowledge graph can be constructed in real time according to the real-time obtained fraud information of the bank internal system. In response to a query request, a search can be performed in the knowledge graph, so that a query result can be determined in the knowledge graph. In response to an inquiry request, a relevant answer can be determined from the knowledge graph by using a pre-constructed question and answer model, the relevant answer can be a node and / or an edge related to the inquiry request, and an edge and / or a node associated with the node and / or the edge. According to the query result or the relevant answer, a fraud prevention prompt can be matched in a pre-constructed fraud prevention prompt library. The application method can link the scattered fraud information, and in response to a query or an inquiry, comprehensive fraud information and corresponding fraud prevention prompts can be obtained, so that the occurrence of fraud can be effectively prevented, and the property safety of users can be protected.

[0063] Figure 4 A flowchart of aligning the entities in the pre-selected set of triples to obtain the set of triples is schematically shown.

[0064] Operation S212 aligns the entities in the pre-selected set of triples to obtain the set of triples, including operations S2121-S2124.​

[0065] In operation S2121, the similarity between each two entities in the preselected set of triples is calculated.

[0066] As an implementable way, as shown in Figure 5 operation S2121, the similarity between each two entities in the preselected set of triples is calculated, including operation S21211 to operation S21213.

[0067] In operation S21211, the first similarity between each two entities in the preselected set of triples is calculated by using the Dice distance method. For example, the first similarity can be represented as Dice(e1, e2), and the first similarity can be obtained by formula (1).

[0068]

[0069] wherein e1 represents one of each two entities, e2 represents the other of each two entities, Len(e1) represents the string length of e1, Len(e2) represents the string length of e2, and common(e1, e2) represents the number of identical characters of e1 and e2.

[0070] In operation S21212, the second similarity between the two entities is calculated by using the edit distance method. It can be understood that the principle of the edit distance method can be shown in formula (2).

[0071]

[0072] Distance is the edit distance, i is the length of one string, j is the length of the other string, when min(i, j) = 0, it means that one of the string lengths i and j is empty, at this time, max(i, j) insertion character operations are needed to make the empty string into non-empty, and the edit distance in this case is max(i, j).

[0073] When min(i, j)≠0, there are three cases for different actions. Distance(i-1, j-1)+1 represents performing a deletion operation to delete the i-th character of one string; Distance(i-1, j)+1 represents an insertion operation, that is, inserting the j-th character in the other string; Distance(i-1, j-1) i≠j +1 represents a replacement operation, when the i-th character of one string and the j-th character of the other string are different, the i-th character of one string is replaced by the j-th character of the other string. Based on this principle, the edit distance between entities e1 and e2 can be obtained according to formula (3).

[0074] D(e1, e2) = Distance (Len(e1) Len(e2)) (3)

[0075] Wherein, Len(e1) represents the string length of e1, Len(e2) represents the string length of e2.

[0076] It can be understood that since the data meaning of Dice distance and edit distance is opposite, the greater the Dice distance is, the higher the similarity is, and the greater the edit distance is, the lower the similarity is. And the range of Dice distance is 0-1, in order to combine the two to calculate the similarity, the edit distance D(e1, e2) needs to be scaled, and the scaling value can be understood as the second similarity, which can be represented by Score(e1, e2). The second similarity can be obtained by formula (4).

[0077]

[0078] In operation S21213, the first similarity and the second similarity are weighted and summed to obtain the similarity between each two entities in the preselected set of triples. For example, the similarity between each two entities can be represented by Com(e1, e2), and the similarity can be obtained by formula (5).

[0079] Com(e1, e2) = a·Dice(e1, e2) + β·Score(e1, e2) (5)

[0080] Wherein, a represents the weight of entity e1, and β represents the weight of entity e2.

[0081] Through operation S21211 to operation S21213, the similarity between each two entities in the preselected set of triples can be conveniently calculated.

[0082] In operation S2122, when the similarity between two entities meets the set threshold value, it is judged whether the relationship in the triple in which the two entities are located is consistent. It can be understood that the set threshold value can be a critical value, and when the similarity is greater than the critical value, it is judged that the two entities are the same. When the two entities are the same, it is necessary to continue to judge whether the relationship in the triple in which the two entities are located is consistent.

[0083] In operation S2123, when the relationship in the triple in which the two entities are located is consistent, one of the triples in which the two entities are located is deleted.

[0084] In operation S2124, when the relationship in the triple in which the two entities are located is inconsistent, one of the two entities is replaced by the other. Thus, through operations S2121-S2124, alignment of the entities in the preselected set of triples can be facilitated, resulting in the set of triples.

[0085] Figure 6 A flowchart of pre-constructing an entity relationship extraction model according to an embodiment of the present disclosure is schematically shown.

[0086] The pre-constructed entity relationship extraction model includes operations S41-S44.

[0087] In operation S41, according to the annotation of each word in the training text data, the extraction rule of the three elements of the triple in the entity relationship extraction model is trained, resulting in a pre-extraction rule, wherein the three elements include the first entity, the relationship between the first entity and the second entity, and the second entity.

[0088] In operation S42, the pre-extraction rule of the entity relationship extraction model is verified using the verification text data.

[0089] In operation S43, if the verification is passed, the pre-extraction rule is applied as the extraction rule of the entity relationship extraction model.

[0090] In operation S44, if the verification is not passed, operations S41 and S42 are repeatedly executed until the verification is passed.

[0091] Through operations S41-S44, the pre-constructed entity relationship extraction model can be facilitated.

[0092] Figure 7 A flowchart of determining a relevant answer from a knowledge graph in response to a query request using a pre-constructed question and answer model according to an embodiment of the present disclosure is schematically shown.

[0093] Operation S230 determines a relevant answer from a knowledge graph in response to a query request using a pre-constructed question and answer model, including operations S231-S233.

[0094] In operation S231, the question vector of the query request and the m preselected relevant answer vectors in the knowledge graph are spliced using the pre-constructed vector splicing model to obtain m spliced vectors, wherein m is an integer greater than or equal to 1.

[0095] In operation S232, the probability value of each spliced vector in the m spliced vectors is predicted using the pre-constructed probability prediction model. For example, the probability value of each spliced vector can be represented by P, and the probability value can be obtained by formula (6).

[0096] P = sigmoid(Wf x f + b f ) (6)

[0097] wherein, f can represent a concatenation vector, W f and b f may both be represented as probability prediction parameters.

[0098] In operation S233, one of the m pre-selected relevant answers is determined as the relevant answer according to the ordering of the m probability values. For example, the m probability values can be ordered from large to small, and the pre-selected relevant answer corresponding to the probability value ordered first is taken as the relevant answer; for example, the m probability values can be ordered from small to large, and the pre-selected relevant answer corresponding to the probability value ordered last is taken as the relevant answer.

[0099] Through operations S231-S233, it can be facilitated to determine the relevant answer from the knowledge graph in response to the inquiry request by using the pre-constructed question and answer model.

[0100] Figure 8 A flowchart of a pre-constructed vector concatenation model according to an embodiment of the present disclosure is schematically shown.

[0101] The pre-constructed vector concatenation model includes operations S61-S64.

[0102] In operation S61, the concatenation parameters in the vector concatenation model are trained according to the training samples, to obtain training concatenation parameters, wherein the training samples include question vectors and pre-selected relevant answer vectors corresponding to the question vectors.

[0103] In operation S62, the training concatenation parameters of the vector concatenation model are verified using verification samples.

[0104] In operation S63, if the verification is passed, the training concatenation parameters are applied as the model parameters of the vector concatenation model.

[0105] Operation S64, if the verification is not passed, operations S61 and S62 are repeatedly executed until the verification is passed. Through operations S61-S64, it can be facilitated to pre-construct the vector concatenation model.

[0106] Figure 9 A flowchart of a pre-constructed probability prediction model according to an embodiment of the present disclosure is schematically shown.

[0107] The pre-constructed probability prediction model includes operations S71-S74.

[0108] In operation S71, the probability prediction parameters in the probability prediction model are trained according to the concatenation vector training samples, to obtain training probability prediction parameters.

[0109] In operation S72, the training probability prediction parameters of the probability prediction model are verified by using the splicing vector.

[0110] In operation S73, if the verification is passed, the training probability prediction parameters are applied as the model parameters of the probability prediction model.

[0111] In operation S74, if the verification is not passed, operations S71 and S72 are repeatedly executed until the verification is passed. Through operations S71-S74, the probability prediction model can be pre-constructed.

[0112] The application method of the fraud information-based knowledge graph according to the embodiments of the present disclosure is described below. Figures 10-14 It should be understood that the following description is only exemplary and is not a specific limitation of the present disclosure.

[0113] The application method of the fraud information-based knowledge graph according to the embodiments of the present disclosure can include the following steps.

[0114] 1. Construction of bank data information knowledge graph.

[0115] The present disclosure studies and implements the key technologies required for knowledge graph construction, namely knowledge extraction, entity alignment, and knowledge storage. The present disclosure designs an entity relationship joint extraction model based on the BERT language model. At the same time, for the case of multiple triplets in a sentence, the present disclosure applies the pointer combined labeling idea to the knowledge extraction model. For semantically ambiguous entities, the present disclosure proposes a Dice and edit distance joint algorithm for entity alignment to optimize the graph effect and avoid entity ambiguity. Finally, the obtained triplet information is stored through Neo4j.

[0116] 2. Construction of bank data information knowledge graph question and answer model.

[0117] The present disclosure realizes the question answering based on the knowledge graph of the present disclosure through the fraud information entity recognition, the candidate answer generation and the bank field fraud question-relation semantic matching model. The relation semantic matching model realizes the question answering based on the bank field fraud knowledge graph of the present disclosure. In view of the importance of the bank field fraud entity recognition task in the question answering model, the BERT-BiLSTM-CRF model is adopted to extract the bank field fraud information entity in the question, and through the comparative experiment, it is proved that the model can effectively improve the entity recognition effect. In view of the entity recognition effect. In view of the fact that only the vector representation of the [CLS] position is used in the BERT downstream task, the one-dimensional convolution and the maximum pooling operation are combined, and the bank field fraud question-relation semantic matching model based on the bank field fraud question language model of the BERT language model is designed, the fusion of all position coding information of the BERT coding sequence is realized, and the ability of the model to identify the relation is improved

[0118] 3. A search warning platform for Web-based bank field fraud prevention.

[0119] Based on the knowledge graph constructed by the present disclosure, the Flask library of Python is used to build a Web page framework, and Elasticsearch is used to build a search engine. Through the interactive design of the Flask background development framework, the Echarts graphic visualization framework and the BootStrap front-end visualization framework and other technologies, the knowledge graph search recommendation platform in the field of the present disclosure is built. The platform integrates the visualization of the graph of the present disclosure, the search of the graph of the present disclosure, the intelligent recommendation of the present disclosure, the expansion of the graph of the present disclosure, the dynamic adjustment of the time axis of the present disclosure and other modules. It can meet the current demand of the society for obtaining fraud field news.

[0120] The specific technical solutions of the above three steps are described in detail as follows.

[0121] 1. Entity relation joint extraction model

[0122] The present disclosure uses the knowledge extraction algorithm based on BERT, and selects the bank fraud field as the knowledge extraction object. After extracting the feature vector of the text data through the BERT layer, the subject "Subject" is predicted, and then the corresponding relation "Link" and object "Object" are predicted according to the extracted "Subject". The main process of the algorithm is data preprocessing, model construction and model training.

[0123] The specific model construction process is as follows.

[0124] (1) First, the text is processed into an ID sequence and then input into the BERT layer as the input of the whole model. The network layer will extract the features, and then the text can be converted into a vector coding sequence.

[0125] (2) After that we will pass the vector sequence output by BERT through LN (Layer Normalization) and then connect two binary classifiers to predict the subject "Subject".

[0126] (3) After predicting the "Subject", we extract the feature vectors corresponding to the start and end positions of the subject "Subject" from the sequence output by BERT.

[0127] (4) Then we layer-normalize the output sequence of BERT using the feature vectors of "Subject" as conditions.

[0128] (5) Finally, after conditional normalization, we use the same method to predict the corresponding object Object for each relationship Link through multiple classifiers. In this way, the information extraction task is ingeniously converted into a classification task.

[0129] The current relatively common method of triple extraction is to first find all entities in the text data through named entity recognition technology, and then classify the relationships of these entities to obtain the relationship. However, this method is difficult to solve the problem of multiple objects corresponding to a subject, and it divides the information extraction into two tasks, which requires independent training of two models to complete, which will cause the errors of the two parts to accumulate and be relatively complex. In this disclosure, a model is used to complete the extraction of information, and the extraction of entity keywords in the text is converted into a combination of multiple binary classification tasks. Specifically, when extracting the subject Subject, it can be converted into finding the start and end positions of the Subject in the sentence. Therefore, we can construct two classifiers and perform two classifications on each word to determine whether the word is the start or end position of the subject "Subject". If so, output 1, otherwise output 0. After processing, the subject can be extracted according to the output sequence of the label. Then the encoding information of the subject Subject is used as a condition to extract the corresponding relationship Link and object Object. Here we extract the object Object for each type of relationship Link in the same way as we extract the subject Subject.

[0130] Therefore, we use the sigmoid activation function in the model and adopt the "0 / 1 label" strategy to determine the position of the extracted entity or relationship in the text vector through the positions of 1 and 0 in the pointer Start and End.

[0131] Specifically, the sentence text is input into the BERT language model after text preprocessing. The input text information is represented by word vectors, position vectors and segmentation vectors. The input BERT language model is encoded, and the context features are extracted first to obtain a sequence. The sequence contains the information of the text before and after each word, and then it is transmitted to the next step for normalization operation. Then pass through two pointer classifiers, which all use sigmoid activation function. The method of pointer labeling is that S-Start is 1, which represents that this place is the start pointer, and S-End is 1, which represents that this place is the end pointer. The encoding output by S-Start and S-End can determine the main entity Subject in the input sentence.

[0132] Taking the entity "Zhang San" as an example, we can get the entity "Zhang San" through the S-Start and S-End pointers, and the corresponding object Object of the entire sentence through the "Link" connected with Subject, so as to get the corresponding object Object of the Link. Finally we can get the triple in the form of "[Subject, Link, Object]". As shown in Fig. 1, taking the relationship "fraudulent transfer" as an example, assuming that the main entity Subject is "Zhang San", the O-Start and O-End positions obtained through the relationship "fraudulent transfer" can indicate the position information of the corresponding object Object of the main entity "Zhang San" and the relationship "fraudulent transfer", that is, "Li Si". Therefore, the successfully predicted triple "[Zhang San, fraudulent transfer, Li Si]" is output. Figure 1

[0133] In the selection of loss function, since the model deals with classification problems, cross entropy is selected. As shown in formula (7), where Loss is the loss value, x is the sample, n is the sample number, y is the sample actual value, is the model prediction output value. It can identify the difference between y and , which can be represented as the difference between the predicted and actual variables here. The smaller the value, the more accurate the result.

[0134]

[0135] 2, Entity relationship alignment in the field of bank fraud.

[0136] ​Due to the existence of syntax mismatch, logic mismatch, semantic mismatch and other reasons, there are a large number of heterogeneous problems in the knowledge graph, and the information between them cannot interact with each other. For example, Zhang Xiaosan and Zhang San are the same user representation, which will be judged as two entities. The triple "[Zhang Xiaosan, cheated by transfer, Li Si]" and the triple "[Zhang San, cheated by transfer, Li Si]" represent the same kind of triple relationship. In the knowledge graph, they should be linked to the same node. Due to the complexity of news text, this situation often occurs, which will affect the quality of the graph. The entity alignment technology can disambiguate in this case, therefore, after completing the knowledge extraction task, we need to align the extracted triple entities. The present disclosure proposes an entity alignment method based on Dice and edit distance, and the specific process is as shown in Figure 10

[0137] The present disclosure proposes an entity alignment method combined with similarity, which obtains a score by weighting the Dice distance and edit distance. And set a threshold, when the joint similarity reaches the threshold, it means that the semantics of the two entities are consistent, but the knowledge graph is a network composed of many triples, there may be the same entity corresponding to different relationships, so we need to judge whether the relationship connected by the two entities is the same, if the same, it means that the node is repeated, and the entity deletion operation is performed, if the relationship is different, it means that the meaning contained in the two triples is different, at this time, the entity replacement is performed.

[0138] The present disclosure adopts a method of fusing Dice coefficient and edit distance to weight the similarity between entities. The Dice distance can calculate the similarity of two strings, and the string is also a kind of set. The Dice coefficient is defined as follows: a measure for comparing similarity, the Dice coefficient is proportional to the similarity, the larger the value, the closer the two sets, and its value range is 0-1, defined as formula (8).

[0139]

[0140] Where |A|∩|B| is the intersection between A and B, representing the similar values in the two sets, |A| and |B| represent the number of A and B respectively, since the denominator repeats the calculation of two characters, the numerator is multiplied by 2 to balance, and the definition of Dice coefficient for string is shown in formula (9).

[0141]

[0142] Len(e1) and Len(e2) represent the length of the string e1 and e2 respectively, and common(e1, e2) represents the number of identical characters of the main entity e1 and e2.

[0143] ​The edit distance is the number of steps to change one character into another by deleting, adding, or replacing steps. In contrast to the Dice coefficient, the size of the edit distance is inversely proportional to the similarity, and the fewer the steps, the closer the two strings are.

[0144] For any two strings s1 and s2, Distance(i, j) is used to represent the edit distance between the first i characters in string s1 and the first j characters in string s2, and the edit distance D(s1, s2) between the two strings satisfies formula (10).

[0145] D(s1, s2) = Distance(Len(s1) + Len(s2)) (10)

[0146] where Len(s i ) represents the length of the string s i , and Distance(i, j) satisfies formula (11).

[0147]

[0148] When min(i, j) = 0, it means that one of the strings s1 and s2 is empty, and max(i, j) insertion character operations are needed to convert the empty string to a non-empty string. The edit distance in this case is max(i, j).

[0149] When min(i, j) ≠ 0, there are three cases for different actions. Distance(i-1, j-1) + 1 represents the deletion operation, which deletes the i-th character in string s1; Distance(i-1, j) + 1 represents the insertion operation, which inserts the j-th character in string s2; Distance(i-1, j-1) i≠j + 1 represents the replacement operation, which replaces the i-th character in one string with the j-th character in the other string when the i-th character in one string and the j-th character in the other string are different. Based on this principle, the edit distance between entities e1 and e2 can be obtained according to formula (12).

[0150] D(e1, e2) = Distance(Len(e1) Len(e2)) (12)

[0151] where Len(e1) represents the string length of e1, and Len(e2) represents the string length of e2.

[0152] It can be understood that, since the data meanings of the Dice distance and the edit distance are opposite, the greater the Dice distance is, the higher the similarity is, and the greater the edit distance is, the lower the similarity is. And the range of the Dice distance is 0-1, in order to combine the two to calculate the similarity, the edit distance D(e1, e2) needs to be scaled, that is, the value of the edit distance is changed to a value in the range of 0-1, denoted as Score(e1, e2), which can be obtained by formula (13).

[0153]

[0154] Score(e1, e2) is inversely proportional to D(e1, e2), the higher the similarity of e1 and e2 is, the smaller the edit distance D(e1, e2) between them is, and Score(e1, e2) is large, representing that e1 and e2 are different words. Conversely, they are synonymous words.

[0155] After obtaining the Dice coefficient and the edit distance of e1 and e2, the disclosure designs a similarity method combining the two, as shown in formula (14).

[0156] Com(e1, e2) = a·Dice(e1, e2) + β·Score(e1, e2) (14)

[0157] Wherein, a and β represent the weights of Dice and edit distance in the algorithm, respectively.

[0158] After obtaining the joint similarity between the two main entities e1 and e2, the value is used as a standard measure to judge whether the entities are similar, so we set a critical value, and when the similarity is greater than 0.7, it is judged that the entities are the same. The next step is to judge whether the other relationships linked by the two entities in a triple unit overlap, if the relationships overlap, it means that the two entities are repeated entities, and the delete triple operation is performed; if they do not overlap, it means that the entity is a multi-link node linked to other entities, and only a same entity is contained in the triple, at this time, the replace entity operation is performed. Thus, the entity alignment operation is completed.

[0159] 3. Bank fraud field question-relation semantic matching model based on BERT language model.

[0160] Based on the candidate triple data generated by the joint extraction of entity and relation, in order to calculate the semantic matching score between the user question and the relationship information in the candidate triple, the disclosure converts the task of calculating the semantic matching score into a 0-1 classification problem. Among them, label 1 indicates that the question and the relationship are semantically matched, and label 0 indicates that the question and the relationship are not semantically matched.

[0161] For 0-1 classification problems, the activation function of the last classification is generally a sigmoid activation function, and the output result is the probability of the event, which ranges from 0 to 1. The class of the input sample is determined by setting a threshold. In the task of calculating the semantic matching score in the present disclosure, the step of setting the threshold in the 0-1 classification problem is removed, and the event probability output by the sigmoid activation function is taken as the semantic matching score between the input question and the relationship. The closer the output probability is to 1, the more similar the semantics between the input question and the relationship.

[0162] The present disclosure combines the BERT language model, one-dimensional convolution, maximum pooling, and sigmoid activation function to design a question-relation semantic matching model in the field of bank fraud.

[0163] Specifically, as shown in Figure 11 , the input question q and the relationship p are spliced using special characters [CLS] and [SEP], and then input into the BERT encoding layer after vectorization to obtain the BERT encoding sequence T. The vector representation t at the [CLS] character position contains both the features of the current position character and the features of the entire context text. In the downstream tasks of BERT, text classification, text matching, and other tasks are usually implemented based on the vector representation t at the [CLS] character position. Considering that using only the vector representation at the [CLS] position will ignore the feature information at other positions in the text, the present disclosure combines one-dimensional convolution and maximum pooling operations on the basis of the BERT language model to implement the question-relation matching model in the field of bank fraud. The present disclosure divides the encoding sequence T output by the BERT encoding layer into two parts, sequence T2, and directly uses one-dimensional convolution and maximum pooling operations to extract text deep features, and then splices them through vector splicing operations with sequence T1 to further fuse the encoding information at all positions of the BERT encoding sequence. This method can solve the problem of using only the vector representation at the [CLS] position in the downstream tasks of BERT.

[0164] In the process of performing one-dimensional convolution operations, the present disclosure uses convolution kernels of different sizes to extract feature vectors of the text. In the convolution operation of natural language text, the size of the convolution kernel, i.e., the size of the moving window, can be 3, 4, or 5, which is used to extract local features of the text under different windows. For each window of size s, a kernel matrix W S and a nonlinear function relu are used to perform convolution processing on the encoding sequence T2 of BERT. The convolution processing can be as shown in equation (15).

[0165] C i = relu(W S ×t[i:i+s]+B S ) (15)

[0166] where WS and B S The training can be obtained, t[i:i+s] represents the vector representation selected from the BERT encoding sequence T2 in the relative position i to the position i+s, that is, the vector representation in the moving window is selected. For each window, the convolution operation is performed on the encoding sequence T2 with a length of 1, and finally the local feature is obtained. For each window, the maximum feature in c is extracted by the maximum pooling operation, and the local features of multiple windows are connected to further obtain the feature vector f of the pooling layer max pooling Then it is spliced with T1 to obtain the final feature vector f.

[0167] Finally, the probability distribution of the label is calculated by the sigmoid function, that is, the probability of the input question and the relationship being identified as a positive sample "1" and a negative sample "0". The probability of being identified as a positive sample "1" is taken as the matching score of the question-relation by the present disclosure, and the higher the score, the higher the matching degree between the question and the relationship. The calculation method of the probability is shown in formula (16).

[0168] P=sigmoid(W f x f+b f ) (16)

[0169] P represents the probability distribution of the label predicted by the model. Wherein W f and B f are obtained by training.

[0170] 4. Application of Web-based bank anti-fraud knowledge graph network.

[0171] The Flask adopted by the present disclosure is a lightweight framework, which is implemented by Python, and the purpose of its design is to provide the minimum function subset required for Web development

[51] . It is mainly composed of Jinja2 template engine and Werkzeug toolkit. The Jinja2 engine provides us with a website template inheritance mechanism, which allows us to develop and modify on the existing HTML template. And it has an HTML automatic escaping mechanism, which can prevent script attacks. The Werkzeug integrates URL web link routing requests, which can handle multiple user page access requests at the same time, and can quickly respond to different tasks initiated by the client.

[0172] Flask does not require binding connections, there are many built-in ways to make the framework developers can use any way and tool to design application architecture. Therefore, compared with other frameworks (such as Django), it can bring higher flexibility to developers. When the client inputs the website address to the server to initiate an HTTP request, the Flask framework will process these requests. Through Flask, we can quickly build a web site and service without designing our own HTTP request and response processing. Flask has simple underlying logic and can be quickly started. Therefore, the present disclosure adopts the Flask framework to build the platform of the present disclosure, combined with the constructed bank fraud field knowledge graph and retrieval model, to build a bank fraud field knowledge graph integrating graph visualization, graph retrieval, graph expansion, entity attribute display, most frequently accessed, related recommendation, timeline and other functions.

[0173] The system uses Bootstrap

[52] As a front-end development framework, the biggest feature of this framework is the responsive interface design, which supports the browser to smoothly switch between different devices, so that each panel of the page can adapt to the display of different length-width ratio screens. In addition, the rich components of Bootstrap and the jQuery plugins accessible through the Data API help to develop a clear system structure of the operation interface.

[0174] The system uses ECharts

[53] As a data visualization framework, ECharts can provide a variety of types of visualization graphics, support information linkage between different charts, and realize the diversification of data styles.

[0175] The system uses Elasticsearch for semantic query of book input keywords, and returns all entity names and attribute values of the entity.

[0176] The system uses Neo4j graph database to construct the bank fraud field knowledge graph, and queries information in the database for traversal, finds the required node, returns all graphs connected to the node, and transmits to the front end for display.

[0177] The system uses the Flask framework to build the application and realizes the dynamic data loading function. Combined with Ajax technology, Echarts software and database data retrieval operation are realized.

[0178] The bank fraud field knowledge graph retrieval platform designed by the present disclosure has a general architecture divided into a bank fraud field data layer, a bank fraud field technology layer and a knowledge graph application layer, and the technology layer corresponds to three important technology modules in the bank fraud field extraction. The overall architecture diagram of the platform is shown in Figure 12 .

[0179] The data layer mainly includes data collection and data cleaning modules. The data collection module designs a knowledge crawler for the bank fraud field according to the rules and data forms in the bank fraud field and the anti-crawler mechanism encountered in the experimental process. The data cleaning module mainly performs preprocessing according to the purpose of the data through standardized operations such as regular expressions. Finally, it provides support for the construction of the bank fraud field knowledge graph and the application of the system.

[0180] The technical layer is divided into a bank fraud field knowledge graph construction technology layer and a retrieval type technology layer.

[0181] For the construction of the bank fraud field knowledge graph, the disclosure adopts a self-annotation data set method for unstructured data, defines entities and relationships, and realizes the extraction of triple information based on the BERT entity relationship joint extraction model. And standardize it into a standard data format for subsequent knowledge storage. For semantically ambiguous entities, the disclosure proposes a Dice and edit distance joint algorithm for entity alignment to improve the quality of the graph. The knowledge graph storage part of the bank fraud field mainly stores triple data and attributes through Neo4j.

[0182] For the retrieval of the bank fraud field knowledge graph: based on the constructed bank fraud field knowledge graph, the disclosure realizes the conversion of natural language into corresponding logic and query statements through user-submitted information into Elasticsearch, precise query acceleration, and then into the bank fraud field Neo4j knowledge graph library we constructed to obtain the knowledge graph information needed by the user through precise or fuzzy matching, find all related nodes, and return the data to the front end for rendering. Based on this, the recognition and query of bank fraud field entities, the relationship query between news, graph expansion, entity attribute display, most frequently accessed, related recommendations, time axis, and other functions are completed, providing users with easy-to-operate application experience and exquisite pages.

[0183] The application layer is to apply the knowledge graph obtained by storing the data layer and training the technology layer algorithm. A bank fraud field knowledge graph retrieval recommendation application is built based on the Flask framework in the back end combined with the Echarts and Bootstrap frameworks in the front end.

[0184] The application involves many technologies, mainly divided into three directions of technology, database technology, algorithm technology and front-end and back-end interaction and design technology.

[0185] The database layer mainly stores the triple data and attributes through Neo4j. In order to store large amounts of data, we use the py2neo package in Python to store the extracted triples. We connect python and Neo4j through the account password in the Neo4j database. Then the entity name and attribute of the node are constructed. Then based on the entity linking in the triple data, the subject and object entities are connected to realize the storage of the relationship. We store the index and type index of the triple in Elasticsearch. Through the information submitted by the user to Elasticsearch, the natural language is converted into corresponding logical and query statements, accurate queries are accelerated, and the user needs of the knowledge graph information are obtained through precise or fuzzy matching in the bank fraud field Neo4j knowledge graph library we built.

[0186] In the algorithm layer, the present disclosure builds a deep learning model BERT, which is built based on the Tensoreflow and Keras deep learning framework, and also uses some natural language processing toolkits, such as the English word segmentation package nltk, the language analysis package numpy and pandas, etc.

[0187] In the front-end and back-end interaction layer, the Bootstrap framework is used as a reference for the network line of the chart display framework Echarts. Echarts dynamically obtains data from the knowledge graph and visualizes the knowledge graph network. The Flask development framework completes the front-end and back-end development of the bank fraud field knowledge graph retrieval platform, combines the trained algorithm model and the stored data, and builds the overall bank fraud field retrieval application system based on Web.

[0188] The interface displayed to the user of the system is called the front-end, and the constantly changing data with the front-end is called the back-end. The system back-end is based on Flask to write interfaces for data transmission with the front-end. The Bootstrap framework is used in the main page to realize the position and layout of each functional module. First, a DOM container is left for the knowledge graph, i.e. the display position of the knowledge graph. Bootstrap supports smooth switching between browsers on different devices, so that each panel of the page can adapt to the display of screens with different length-width ratios. In addition, the rich components of Bootstrap and the jQuery plugins accessible through the Data API can help to develop a clear operation interface.

[0189] Echarts is a data visualization library that mainly displays data in the form of charts. Knowledge graph is also a kind of graph. The bank fraud field knowledge graph visualization in this paper relies on the Echarts front-end framework. Echarts itself is static, while the information query and display of the knowledge graph is a dynamic process. Therefore, the display of this application needs to dynamically obtain data continuously. This part involves dynamic data loading functions combined with Ajax technology for Echarts software and database data retrieval operations. The main implementation logic is as follows.

[0190] (1) JSP page (JAVA server page) requests data from the background by means of AJAX1 asynchronous data loading to find the bank fraud field news information input by the user.

[0191] (2) Servlet page jump obtains the bank fraud field information passed by the JSP page for query, and stores the query results as list.

[0192] (3) The list page is processed to obtain data in json format that can be accepted by the JSP interface, and the queried information is transmitted back to the JSP interface.

[0193] (4) The JSP page obtains the json data transmitted from the background, adjusts the data format according to the required mode, obtains the Node and Link data of Echarts that meet the assignment conditions, and assigns the obtained data through Echarts myChart.setOption. The transmitted json data is converted into the data format received by Echarts, and the dynamic display of the graph is realized. The back-end web page structure is shown in Figure 13

[0194] For the keywords input by the user, this paper first performs word segmentation operation on the keywords input by the user through the nltk library of Python, matches the index and type in the Elasticsearch library, and parses the query results. Then, the nodes and relationships are matched by traversing the Neo4j graph database. Neo4j can perform precise matching and fuzzy matching. We first perform precise matching. Precise matching only matches keywords, which has low inclusiveness but high accuracy.

[0195] ​Neo4j has two ways of fuzzy matching, using = ~ 'fuzzy matching object' to represent. Another is to express according to the position of the relationship, can use starts with, end with, Contains and other position relationship. Unlike the previous accurate matching, fuzzy matching will be processed into a fuzzy matching object. Because there may be duplicate query results, so after getting the matching information, you need to perform a deduplication operation. Finally get the matching node information.

[0196] Due to the complexity of fraud information, there are complex connections between a large number of nodes, in order to better use the connection, realize the true knowledge network. When the user clicks on a node that he is curious about, the expanded node is merged with the original graph to display. Expand around this node as the center. The knowledge graph of the present disclosure has an expansion function module. Double-click a node to activate this function.

[0197] The effect of double-clicking by the user cannot cover the original node, so three-step operation is needed. When the user double-clicks, first, the graph information currently displayed is retained, then the node clicked by the user is queried again to obtain other node information related to it, and finally all information is integrated and displayed to achieve the effect of graph expansion. This method encountered new difficulties in the experiment. When the user double-clicks to expand the graph, the operation of saving the graph information on the current page in the first step will cause the information to be saved repeatedly, resulting in repeated nodes in the page. Therefore, this step also needs to add a deduplication operation. Save the current graph while covering the original node. The new graph expanded in this way is visually displayed as a new node spreading out when the node is clicked. The display effect is smooth and the user experience is good. Figure 14 The underlying operation process when double-clicking to expand is shown.

[0198] The knowledge graph search website designed by the present disclosure mainly consists of two pages, namely the search page of the knowledge graph and the display and interaction page of the knowledge graph. The search page is mainly used to obtain the keywords input by the user, and after obtaining the keywords, the keywords are given to the backend to query the Neo4j database, and then the remaining nodes and relationships connected to the keyword nodes are found out and returned to the knowledge graph display page for rendering and display.

[0199] By clicking the "Search" button on the right side of the search box, the search subpage of the bank fraud information search platform is obtained. This page integrates functions such as graph search, graph expansion, recommended search, most frequently viewed, and attribute display. The knowledge graph is visualized, that is, the network structure of the bank fraud field graph is displayed in the form of "point-line-point".

[0200] Based on the application method of the fraud information-based knowledge graph, the disclosure further provides an application device of the fraud information-based knowledge graph. The following will be described in detail in combination with Figure 15 and Figure 16 The application device 10 of the fraud information-based knowledge graph will be described in detail.

[0201] Figure 15 The structural block diagram of the application device 10 of the fraud information-based knowledge graph according to the embodiment of the disclosure is schematically shown.

[0202] The application device 10 of the fraud information-based knowledge graph comprises a first construction module 1, a first determination module 2, a second determination module 3 and a matching module 4.

[0203] The first construction module 1 is used to perform operation S210: constructing a knowledge graph in real time according to the fraud information of the bank internal system obtained in real time.

[0204] The first determination module 2 is used to perform operation S220: determining a query result in response to a query request, wherein the query request comprises a keyword related to a node and / or an edge, and the query result comprises a node and / or an edge corresponding to the query request in the knowledge graph and the associated information of the node and / or the edge.

[0205] The second determination module 3 is used to perform operation S230: determining a relevant answer from the knowledge graph in response to an inquiry request by using a pre-constructed question and answer model.

[0206] The matching module 4 is used to perform operation S240: matching a fraud prevention prompt according to the query result or the relevant answer.

[0207] Among them, Figure 16 The structural block diagram of the first construction module 1 according to the embodiment of the disclosure is schematically shown.

[0208] The first construction module 1 is used to perform constructing a knowledge graph in real time according to the fraud information of the bank internal system obtained in real time, and the first construction module 1 can comprise an extraction unit 11, an alignment unit 12 and a first construction unit 13.

[0209] The extraction unit 11 is used to perform entity and relationship extraction on the fraud information of the bank internal system obtained in real time by using a pre-constructed entity relationship extraction model, to obtain a preselected set of triples.

[0210] The alignment unit 12 is used to align the entities in the preselected set of triples to obtain a set of triples.

[0211] The first construction unit 13 is configured to construct the knowledge graph according to the set of triples.

[0212] According to some embodiments of the present disclosure, the alignment unit can include a calculation element, a judgment element, a deletion element and a replacement element.

[0213] The calculation element is configured to calculate the similarity between each two entities in the preselected set of triples.

[0214] The judgment element is configured to judge whether the relationship in the triple in which the two entities are located is consistent when the similarity between the two entities meets a set threshold.

[0215] The deletion element is configured to delete one of the triples in which the two entities are located when the relationship in the triple in which the two entities are located is consistent.

[0216] The replacement element is configured to replace one of the two entities with the other when the relationship in the triple in which the two entities are located is inconsistent.

[0217] According to some embodiments of the present disclosure, the calculation element can include a first calculation element, a second calculation element and a third calculation element.

[0218] The first calculation element is configured to calculate the first similarity between each two entities in the preselected set of triples by using the Dice distance method.

[0219] The second calculation element is configured to calculate the second similarity between the two entities by using the edit distance method.

[0220] The third calculation element is configured to weight and sum the first similarity and the second similarity to obtain the similarity between each two entities in the preselected set of triples.

[0221] According to some embodiments of the present disclosure, the application device of the knowledge graph based on fraud information further includes a second construction module configured to pre-construct an entity relationship extraction model, and the second construction module can include a first training unit, a first verification unit, a first determination unit and a first repetition unit.

[0222] The first training unit is configured to operate S41 to train the extraction rule of the three elements of the triple in the entity relationship extraction model according to the annotation of each word in the training text data, to obtain a pre-extraction rule, wherein the three elements include a first entity, a relationship between the first entity and a second entity, and the second entity.

[0223] The first verification unit is configured to operate S42 to verify the pre-extraction rule of the entity relationship extraction model by using the verification text data.

[0224] The first determining unit is configured to, in operation S43, apply the pre-extraction rule as an extraction rule of the entity relation extraction model if the verification passes.

[0225] The first repeating unit is configured to, in operation S44, repeatedly perform operation S41 and operation S42 until the verification passes if the verification fails.

[0226] According to some embodiments of the present disclosure, the second determining module can include a splicing unit, a prediction unit and a sorting unit.

[0227] The splicing unit is configured to splice the question vector of the inquiry request and m pre-selected relevant answer vectors in the knowledge graph by using a pre-constructed vector splicing model to obtain m spliced vectors, where m is an integer greater than or equal to 1.

[0228] The prediction unit is configured to predict a probability value of each spliced vector in the m spliced vectors by using a pre-constructed probability prediction model.

[0229] The sorting unit is configured to determine one of the m pre-selected relevant answers as the relevant answer according to the sorting of the m probability values.

[0230] According to some embodiments of the present disclosure, the application device of the fraud information-based knowledge graph further includes a third constructing module configured to pre-construct a vector splicing model, and the third constructing module can include a second training unit, a second verification unit, a second determining unit and a second repeating unit.

[0231] The second training unit is configured to, in operation S61, train a splicing parameter in the vector splicing model according to a training sample to obtain a trained splicing parameter, where the training sample includes a question vector and a pre-selected relevant answer vector corresponding to the question vector.

[0232] The second verification unit is configured to, in operation S62, verify the trained splicing parameter of the vector splicing model by using a verification sample.

[0233] The second determining unit is configured to, in operation S63, apply the trained splicing parameter as a model parameter of the vector splicing model if the verification passes.

[0234] The second repeating unit is configured to, in operation S64, repeatedly perform operation S61 and operation S62 until the verification passes if the verification fails.

[0235] According to some embodiments of the present disclosure, the application device based on the fraud information knowledge graph further comprises a fourth construction module, the fourth construction module is configured to pre-construct a probability prediction model, and the fourth construction module can comprise a third training unit, a third verification unit, a third determination unit and a third repetition unit.

[0236] The third training unit is configured to operate S71, train the probability prediction parameters in the probability prediction model according to the spliced vector training sample, and obtain trained probability prediction parameters.

[0237] The third verification unit is configured to operate S72, verify the trained probability prediction parameters of the probability prediction model by using the spliced vector verification sample.

[0238] The third determination unit is configured to operate S73, and if the verification is passed, the trained probability prediction parameters are applied as the model parameters of the probability prediction model.

[0239] The third repetition unit is configured to operate S74, and if the verification is not passed, the operation S71 and the operation S72 are repeatedly executed until the verification is passed.

[0240] According to the application method of the fraud information knowledge graph based on the fraud information knowledge graph according to the present disclosure, the knowledge graph can be constructed in real time according to the fraud information information of the bank internal system obtained in real time. In response to a query request, a search can be performed in the knowledge graph, so that the query result can be determined in the knowledge graph. In response to an inquiry request, the relevant answer can be determined from the knowledge graph by using the pre-constructed question and answer model, and the relevant answer can be the node and / or edge related to the question in the inquiry request and the edge and / or node associated with the node and / or edge. According to the query result or the relevant answer, the anti-fraud prompt in the pre-constructed anti-fraud prompt library can be matched. The application method of the present disclosure can associate scattered fraud information, and in response to a query or an inquiry, comprehensive fraud information can be obtained, and corresponding anti-fraud prompts can also be obtained, so that the occurrence of fraud can be effectively prevented, and the property safety of users can be protected.

[0241] In addition, according to the embodiments of the present disclosure, any one of the first construction module 1, the first determination module 2, the second determination module 3 and the matching module 4 can be combined in one module, or any one of them can be split into multiple modules. Alternatively, at least part of the function of one or more of these modules can be combined with at least part of the function of other modules, and implemented in one module.

[0242] According to embodiments of the present disclosure, at least one of the first constructing module 1, the first determining module 2, the second determining module 3 and the matching module 4 can be implemented at least in part as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc., or implemented in software, hardware and firmware in any one of the three implementation manners or in a proper combination of any of the three implementation manners.

[0243] Alternatively, at least one of the first constructing module 1, the first determining module 2, the second determining module 3 and the matching module 4 can be implemented at least in part as a computer program module which, when executed, can perform the corresponding functions.

[0244] Figure 17 A block diagram of an electronic device suitable for implementing the above method according to embodiments of the present disclosure is schematically shown.

[0245] As shown in Figure 17 , the electronic device 900 according to embodiments of the present disclosure includes a processor 901 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 902 or loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 can include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset, and / or a special-purpose microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 901 can also include an on-board memory for cache use. The processor 901 can include a single processing unit or a plurality of processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0246] In the RAM 903, various programs and data required for the operation of the electronic device 900 are stored. The processor 901, the ROM 902 and the RAM 903 are connected to each other through a bus 904. The processor 901 performs various operations of the method processes according to embodiments of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs can also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 can also perform various operations of the method processes according to embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0247] According to an embodiment of the present disclosure, the electronic device 900 can further include an input / output (I / O) interface 905 that is also connected to the bus 904. The electronic device 900 can further include one or more of the following components connected to the I / O interface 905: an input part 906 including, for example, a keyboard and a mouse; an output part 907 including, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage part 908 including, for example, a hard disk; and a communication part 909 including, for example, a LAN card, a modem, and the like. The communication part 909 performs communication processing via a network such as the Internet. A driver 910 is also connected to the input / output (I / O) interface 905 as necessary. A removable medium 911 such as a magnetic disk, a magneto-optical disk, a semiconductor memory, and the like is attached to the driver 910 as necessary, so that a computer program read therefrom is installed into the storage part 908 as necessary.

[0248] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present disclosure.

[0249] According to an embodiment of the present disclosure, the computer readable storage medium can be a non-volatile computer readable storage medium, for example, which can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more of the above-described ROM 902 and / or RAM 903 and / or one or more memories other than the ROM 902 and the RAM 903.

[0250] The embodiments of the present disclosure also include a computer program product including a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the methods of the embodiments of the present disclosure.

[0251] The above-described functions of the system / apparatus defined in the embodiments of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiments of the present disclosure, the system, apparatus, module, unit, etc. described above can be implemented by the computer program modules.

[0252] In one embodiment, the computer program can be stored in a tangible storage medium, such as an optical, magnetic, or other memory on a server, computer, or other computing device. In another embodiment, the computer program can be transmitted over a network, including the Internet, WAN, LAN, etc., over a wired or wireless connection, using signals, and downloaded and installed by a communication interface 909 and / or removable medium 911. The computer program code contained in the computer program can be executed using any suitable network media, including but not limited to wireless, wired, or any suitable combination of the above.

[0253] In such an embodiment, the computer program can be downloaded and installed from a network, using the communication interface 909 and / or removable medium 911. When the computer program is executed by the processor 901, the above-described functions of the system defined in the embodiments of the present disclosure are performed. According to the embodiments of the present disclosure, the system, apparatus, device, module, unit, etc. described above can be implemented by the computer program modules.

[0254] According to the embodiments of the present disclosure, the program code for carrying out the computer program provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming language, and / or assembly / machine language. The programming language includes but is not limited to, for example, Java, C++, Python, "C" language, or similar programming languages. The program code can be executed entirely on a user computing device, partially on a user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected through the Internet using an Internet service provider).

[0255] The computer program product of the first aspect can include one or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform the operations of the first aspect. The one or more non-transitory computer-readable media can include, for example, magnetic media such as one or more magnetic disks, magnetic tapes or cassettes; optical media such as one or more compact discs (CD), optical discs or discs (for example, DVD, Blu-ray Disc®, digital video disc, ultra density disc, ultra-compact disc, any optical media, etc.); semiconductor media such as solid state hard drives (for example, flash memory, solid state USB drives, etc.); any other suitable medium; or any suitable combination of media.

[0256] Those skilled in the art will understand that features of the various embodiments and / or claims of the present disclosure can be combined and / or sub-combined, even if such combinations or sub-combinations are not expressly noted in the present disclosure. In particular, features of the various embodiments and / or claims of the present disclosure can be combined and / or sub-combined in any number of ways, without departing from the spirit and scope of the present disclosure. All such combinations and / or sub-combinations are within the scope of the present disclosure.

[0257] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although the above describes each embodiment separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and all such substitutions and modifications shall fall within the scope of the present disclosure.

Claims

1. An application method based on fraud information knowledge graph, characterized in that, The method comprises the following steps: constructing a knowledge graph in real time according to fraud information of a bank internal system obtained in real time; determining a query result in response to a query request, wherein the query request comprises a keyword related to a node and / or an edge, and the query result comprises a node and / or an edge corresponding to the query request in the knowledge graph and associated information of the node and / or the edge; determining a relevant answer from the knowledge graph in response to an inquiry request by using a pre-constructed question and answer model; and matching a fraud prevention prompt according to the query result or the relevant answer, wherein the step of constructing a knowledge graph in real time according to fraud information of a bank internal system obtained in real time comprises the following steps: extracting entities and relationships from the fraud information of the bank internal system obtained in real time by using a pre-constructed entity relationship extraction model to obtain a preselected set of triples; aligning the entities in the preselected set of triples to obtain a set of triples; and constructing a knowledge graph according to the set of triples.

2. The method of claim 1, wherein, The step of aligning the entities in the preselected set of triples to obtain a set of triples comprises the following steps: calculating the similarity between each two entities in the preselected set of triples; when the similarity between two entities meets a set threshold, determining whether the relationship in the triple in which the two entities are located is consistent; when the relationship in the triple in which the two entities are located is consistent, deleting one of the two entities in the triple; and when the relationship in the triple in which the two entities are located is inconsistent, replacing one of the two entities with the other.

3. The method of claim 2, wherein, The step of calculating the similarity between each two entities in the preselected set of triples comprises the following steps: calculating a first similarity between each two entities in the preselected set of triples by using a Dice distance method; calculating a second similarity between the two entities by using an edit distance method; and weighting and summing the first similarity and the second similarity to obtain the similarity between each two entities in the preselected set of triples.

4. The method of claim 1, wherein, The pre-constructed entity relationship extraction model comprises the following steps: Operation S41: training extraction rules of three elements of a triple in the entity relationship extraction model according to annotations of each word in training text data to obtain pre-extraction rules, wherein the three elements comprise a first entity, a relationship between the first entity and a second entity, and the second entity; Operation S42: verifying the pre-extraction rules of the entity relationship extraction model by using verification text data; Operation S43: if the verification is passed, applying the pre-extraction rules as extraction rules of the entity relationship extraction model; and Operation S44: if the verification is not passed, repeatedly performing Operation S41 and Operation S42 until the verification is passed.

5. The method of claim 1, wherein, The step of determining a relevant answer from the knowledge graph in response to an inquiry request by using a pre-constructed question and answer model comprises the following steps: splicing a question vector of the inquiry request and m preselected relevant answer vectors in the knowledge graph by using a pre-constructed vector splicing model to obtain m splicing vectors, wherein m is an integer greater than or equal to 1; predicting a probability value of each splicing vector in the m splicing vectors by using a pre-constructed probability prediction model; and Based on the sorting of the m probability values, one of the m pre-selected relevant answers is determined as the relevant answer.

6. The method of claim 5, wherein, The pre-built vector concatenation model includes: Operation S61: Based on the training samples, train the splicing parameters in the vector splicing model to obtain the training splicing parameters. The training samples include question vectors and pre-selected related answer vectors corresponding to the question vectors. Operation S62: Use the verification samples to verify the training splicing parameters of the vector splicing model; In step S63, if the verification passes, the trained concatenation parameters are applied as the model parameters of the vector concatenation model; and If the verification fails in step S64, repeat steps S61 and S62 until the verification passes.

7. The method of claim 5, wherein, The pre-built probability prediction model includes: Operation S71 trains the probability prediction parameters in the probability prediction model based on the spliced ​​vector training samples, thus obtaining the trained probability prediction parameters. Operation S72: Use the concatenated vector verification sample to verify the training probability prediction parameters of the probability prediction model; In step S73, if the verification passes, the trained probability prediction parameters are applied as model parameters of the probability prediction model; and If the verification fails in step S74, repeat steps S71 and S72 until the verification passes.

8. An application device based on a fraud information-based knowledge graph, characterized by, include: The first construction module is used to construct a knowledge graph in real time based on fraud information obtained from the bank's internal system. The first determining module is configured to determine the query result in response to a query request, wherein the query request includes keywords related to nodes and / or edges, and the query result includes nodes and / or edges in the knowledge graph corresponding to the query request and the association information of the node and / or edge; A second determining module is configured to determine relevant answers from the knowledge graph in response to an inquiry request using a pre-built question-answering model; and The matching module is used to match anti-fraud tips based on the query results or related answers. The step of constructing a knowledge graph in real time based on fraud information obtained from the bank's internal system includes: Using a pre-built entity-relation extraction model, entities and relations are extracted from fraud information obtained in real time from the bank's internal system to obtain a pre-selected set of triples. Align the entities in the pre-selected set of triples to obtain a set of triples; and Construct a knowledge graph based on the set of triples.

9. An electronic device, comprising: include: One or more processors; One or more memories are provided for storing executable instructions that, when executed by the processor, implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The storage medium stores executable instructions that, when executed by a processor, implement the method according to any one of claims 1 to 7.

11. A computer program product, characterised in that, The method includes a computer program comprising one or more executable instructions that, when executed by a processor, implement the method according to any one of claims 1 to 7.

Images