User account processing method and apparatus, electronic device, medium, and program product

Abstract

This application discloses a user account processing method, apparatus, electronic device, medium, and program product. This application acquires graph data, including multiple nodes and edges connecting the nodes. Nodes represent user accounts, and edges represent transaction relationships between user accounts. Based on attention weights, the node features are weighted to obtain attention-based node features. The edge features and node features are fused to obtain edge-based node features. Combining the attention-based node features and the edge-based node features, the risk level of a user account is determined. The user account is then processed according to the risk level. This application can improve the accuracy of identifying the risk level of a user account, enabling reasonable processing of user accounts based on the identification results. This application can be applied to various scenarios such as cloud technology, artificial intelligence, smart transportation, and assisted driving.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a user account processing method, apparatus, electronic device, medium, and program product. Background Technology

[0002] In recent years, with the rapid development of computer and internet technologies, users can conduct transactions online. While the internet brings convenience to users, it may also harbor high-risk accounts that initiate illegal transactions and disrupt the established transaction order.

[0003] However, current methods typically involve determining whether a user account's transactions are illegal and taking action based on the assessment. This approach cannot comprehensively identify user account information, is prone to misjudgments (such as misidentifying high-risk accounts as low-risk accounts), has low accuracy, and cannot provide a reasonable course of action for the user account based on the assessment results. Summary of the Invention

[0004] This application provides a user account processing method, apparatus, electronic device, medium, and program product, which can improve the accuracy of identifying the risk level of user accounts and process user accounts reasonably based on the identification results.

[0005] This application provides a user account processing method, comprising: acquiring graph data, the graph data including multiple nodes and edges connecting the nodes, the nodes representing user accounts, and the edges representing transaction relationships between user accounts; calculating the weights of the node features of the nodes based on attention weights to obtain attention-based node features, the node features being feature data of the user account; performing feature fusion processing on the edge features and the node features to obtain edge-based node features, the edge features being feature data of the transaction relationships; determining the risk level of the user account by combining the attention-based node features and the edge-based node features; and processing the user account according to the risk level.

[0006] This application embodiment also provides a user account processing device, including: an acquisition unit, configured to acquire graph data, the graph data including multiple nodes and edges connected between the nodes, the nodes representing user accounts, and the edges representing transaction relationships between user accounts; an attention unit, configured to perform weight calculation on the node features of the nodes based on attention weights to obtain node features with attention, the node features being feature data of the user account; a fusion unit, configured to perform feature fusion processing on the edge features and the node features to obtain node features with edge features, the edge features being feature data of the transaction relationships; a determination unit, configured to determine the risk level of the user account by combining the node features with attention and the node features with edge features; and a processing unit, configured to process the user account according to the risk level.

[0007] This application also provides an electronic device, including a processor and a memory, wherein the memory stores a plurality of instructions; the processor loads instructions from the memory to execute steps in any of the user account processing methods provided in this application.

[0008] This application also provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to execute steps in any of the user account processing methods provided in this application.

[0009] This application also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of any user account processing method provided in this application.

[0010] This application embodiment can acquire graph data, which includes multiple nodes and edges connecting the nodes. The nodes represent user accounts, and the edges represent transaction relationships between user accounts. Based on attention weights, the node features of the nodes are weighted to obtain attention-based node features, which are the feature data of the user accounts. The edge features and node features are fused to obtain edge-based node features, which are the feature data of the transaction relationships. Combining the attention-based node features and the edge-based node features, the risk level of the user account is determined. The user account is then processed according to the risk level.

[0011] In this application, on the one hand, attention mechanisms are used to focus on the implicit expressions between nodes, enhancing the feature representation capabilities of node features and enabling in-depth mining of communication or transaction information between user accounts. On the other hand, edge features are used to enhance the expressive capabilities of node features for transaction relationships, enabling in-depth mining of transaction links. Thus, by combining the implicit expressions between different user accounts and the transaction relationships between different accounts, the correlation between user accounts and between user accounts and transactions can be mined from multiple dimensions, improving the accuracy of identifying the risk level of user accounts and enabling reasonable handling of user accounts based on the identification results. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1a This is a schematic diagram of a scenario illustrating the user account processing method provided in an embodiment of this application;

[0014] Figure 1b This is a flowchart illustrating the user account processing method provided in an embodiment of this application;

[0015] Figure 1c This is a schematic diagram illustrating the calculation of attention weights provided in an embodiment of this application;

[0016] Figure 1d This is a schematic diagram illustrating the node features with attention obtained through weighted processing provided in an embodiment of this application;

[0017] Figure 1e This is a schematic diagram illustrating the aggregation process used to obtain the aggregation feature according to an embodiment of this application;

[0018] Figure 1f This is a schematic diagram of the processing method based on evidence level and risk level provided in the embodiments of this application;

[0019] Figure 2a This is a flowchart illustrating a user account processing method provided in another embodiment of this application;

[0020] Figure 2b This is yet another flowchart illustrating a user account processing method provided in another embodiment of this application;

[0021] Figure 2c This is a schematic diagram of the optimized graph data provided in the embodiments of this application;

[0022] Figure 3This is a schematic diagram of the user account processing device provided in the embodiments of this application;

[0023] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0024] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] This application provides a user account processing method, apparatus, electronic device, medium, and program product.

[0026] Specifically, the user account processing device can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet, smart Bluetooth device, laptop, or personal computer (PC); the server can be a single server or a server cluster consisting of multiple servers.

[0027] In some embodiments, the user terminal includes, but is not limited to, mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, and aircraft. The embodiments of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0028] In some embodiments, the user account processing device may also be integrated into multiple electronic devices, such as multiple servers, with multiple servers implementing the user account processing method of this application.

[0029] In some embodiments, the server may also be implemented as a terminal.

[0030] For example, refer to Figure 1aUser account processing is integrated into the server, which can acquire graph data, including multiple nodes and edges connecting the nodes. Nodes represent user accounts, and edges represent transaction relationships between user accounts. Based on attention weights, the node features are weighted to obtain attention-bearing node features, which are the feature data of user accounts. The edge features are fused with the node features to obtain edge features, which are the feature data of transaction relationships. Combining the attention-bearing node features and the edge-bearing node features, the risk level of the user account is determined. The user account is then processed according to the risk level.

[0031] The server can also retrieve transaction data from clients to generate graph data. After processing user accounts, it sends the processing results back to the client.

[0032] The following provides a detailed explanation. It is understood that the specific embodiments of this application involve data related to user accounts, transaction information, feature data, transaction relationships, transaction frequency, friend information, group information, login devices, registration information, whether transactions were blocked, association relationships, communication information, search history information, etc. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0033] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0034] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0035] Machine learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory, among others. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instruction-based learning.

[0036] With the research and advancement of artificial intelligence (AI) technology, AI is being studied and applied in various fields, such as smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, autonomous driving, drones, robots, smart healthcare, and smart customer service. It is believed that with the development of technology, AI will be applied in more fields and play an increasingly important role.

[0037] In this embodiment, a user account processing method involving artificial intelligence is provided, such as... Figure 1b As shown, the specific process for handling user accounts can be as follows:

[0038] 110. Obtain graph data. Graph data includes multiple nodes and edges connecting the nodes. Nodes represent user accounts, and edges represent transaction relationships between user accounts.

[0039] Graph data refers to data represented in the form of heterogeneous graphs. It is a type of non-relational data that uses graph theory to store information about relationships between entities. Non-relational data has complex and variable relational structures and is typically stored in non-relational databases. Graph data can consist of nodes and edges between them. For example, graph data can store information about different user accounts related to transactions. Different nodes in the graph data can represent different user accounts, and edges can represent transaction relationships between user accounts, such as transfers, refunds, and other transaction-related relationships.

[0040] In this context, a user account refers to an account created by a user to use a particular application or function, serving as a representation of the user's identity within the application. For example, when users conduct a transaction, the application may indicate that the transaction occurred between the corresponding user accounts.

[0041] In some implementations, transaction data from user accounts can be obtained to construct graph data. Specifically, prior to obtaining the graph data, the following steps may also be included:

[0042] Obtain transaction data from historical transactions;

[0043] Determine the transaction relationships between user accounts from transaction data;

[0044] Graph data is constructed using user accounts as nodes and transaction relationships as edges.

[0045] Historical transactions refer to transactions sent before the current moment. Transaction data refers to data related to transactions between user accounts, such as, but not limited to, transaction time, transaction amount, the counterparty user account in the transaction, the number of transactions, and whether the transaction was blocked. Transaction relationships can be relationships determined by transaction data; for example, transaction data between user accounts can determine whether transfers, refunds, or other similar transactions have occurred.

[0046] For example, users can transact with other users within the application using their user accounts. With user permission, the server can retrieve transaction data from multiple historical transactions. This data can include all user accounts involved in the transaction and the transaction information. User accounts can be used as nodes to determine if there are transaction relationships such as transfers or refunds between user accounts. If so, the user accounts are connected to construct a graph. Edges in the graph represent transactions such as transfers or refunds between two connected user accounts. It should be noted that after constructing the graph, if a new transaction occurs, corresponding nodes or edges can be added to the graph based on that new transaction.

[0047] In some implementations, to improve the efficiency of generating and processing graph data, only transaction data from historical transactions that meet preset transaction conditions can be acquired to construct the graph data. These preset transaction conditions can be determined by the characteristics of illegal transactions. For example, when applied to application scenario A, the characteristics of illegal transactions that typically occur in this scenario might include transactions occurring in the early morning or transactions with amounts in multiples of 100. Therefore, historical transactions with early morning transaction times or transaction amounts in multiples of 100 can be considered as potential illegal transactions. When acquiring historical transaction data, only the transaction data from these potential illegal transactions can be acquired, thereby significantly reducing the amount of graph data and improving the efficiency of generating and processing graph data.

[0048] In practical applications, applications often have a large user base and complex relationship networks, resulting in graph data with massive numbers of nodes and edges. This large graph data volume makes it difficult to support computational resources, leading to poor efficiency and accuracy in identifying user account risk levels. Therefore, this application's embodiments simplify the graph data after construction from multiple dimensions, such as the number of nodes, the number of edges, and node characteristics, to reduce the graph data size, save computational resources, and improve the efficiency and accuracy of user account identification. The following details the method for simplifying the graph data.

[0049] In some implementations, the number of nodes in the graph data can be reduced by deleting user accounts that meet the characteristics of low-risk accounts. Specifically, before acquiring the graph data, the process may also include:

[0050] The node corresponding to the target user account is identified as the node to be deleted. The target user account is a user account that meets the preset account conditions.

[0051] In the graph data, delete the node to be deleted.

[0052] The preset account criteria can be set based on the characteristics of low-risk accounts. For example, user accounts with a small total transaction amount, a low number of transactions, or a small number of counterparty user accounts can be considered low-risk user accounts. Counterparty user accounts can refer to user accounts that have transacted with the current user account. Therefore, nodes corresponding to these user accounts in the graph data can be deleted.

[0053] In some implementations, sub-features within node features can be filtered based on preset index value conditions to reduce the amount of node feature data. Specifically, node features may include at least one sub-feature, and before acquiring graph data, the following may also be included:

[0054] Based on a preset index calculation strategy, sub-features are calculated to obtain at least one index value.

[0055] Sub-features whose index values ​​meet preset index value conditions are identified as features to be deleted.

[0056] In graph data, delete the features to be deleted from the node features.

[0057] The indicators can include, but are not limited to, at least one of the following: IV (Information Ratio), GINI coefficient, and Pearson coefficient. The IV refers to the contribution of a feature to the prediction of the target, i.e., the predictive power of the feature; the higher the IV, the stronger the predictive power and the higher the information contribution. The GINI coefficient is the ratio of the area between the ROC curve and the diagonal AC to the area enclosed by the diagonal AC curve. The GINI coefficient is a function between (0,1); the larger the GINI coefficient, the stronger the model's discriminative power. The Pearson coefficient measures whether two datasets lie on a single line; it measures the linear relationship between interval variables. The Pearson coefficient ranges from -1.0 to 1.0; variables close to 0 are considered uncorrelated, while those close to 1 or -1 are considered strongly correlated.

[0058] The preset indicator calculation strategy can refer to the method used to calculate the indicator value. When there are multiple indicator values, the preset indicator calculation strategy can also include the order in which the multiple indicator values ​​are calculated.

[0059] The preset indicator value conditions can be threshold values ​​set according to the indicator calculation strategy. For example, a threshold of 0.1 can be set for the IV value, identifying sub-features with IV values ​​greater than 0.1 as features to be deleted. Similarly, a threshold of 0.1 can be set for the GINI coefficient, identifying sub-features with GINI coefficients greater than 0.1 as features to be deleted. Likewise, a threshold of 0.7 can be set for the Pearson coefficient, identifying sub-features with Pearson coefficients greater than 0.7 as features to be deleted.

[0060] In some implementations, the preset index calculation strategy may involve first calculating the IV value and GINI coefficient of the sub-feature, and then calculating the Pearson coefficient of the sub-features whose IV value is greater than a preset IV threshold and whose GINI coefficient is greater than a preset GINI threshold. The preset index value conditions may be conditions determined based on the preset IV threshold, preset GINI threshold, and preset Pearson threshold. For example, the IV value and GINI coefficient of the sub-feature may be calculated first, then the GINI coefficient of the sub-features with an IV value greater than 0.1 and a GINI coefficient greater than 0.1 may be calculated. The sub-features with a calculated GINI coefficient greater than 0.7 may then be sorted, retaining the sub-feature with the largest IV value after sorting. The remaining sub-features in the node features, excluding the retained sub-features, may be identified as features to be deleted.

[0061] In some implementations, edges with low correlation in the graph data can be removed based on the relationships between nodes, thereby reducing the number of edges in the graph data. Specifically, before obtaining the graph data, the process may further include:

[0062] Determine the relationship between the two nodes connected by the edge;

[0063] If the association relationship meets the preset association relationship, the edge corresponding to the association relationship will be determined as the edge to be deleted. The preset association relationship is used to indicate a low degree of association.

[0064] In graph data, delete the edge to be deleted.

[0065] In this context, "association" refers to the relationship used to characterize the degree of connection between nodes. Essentially, the association between nodes is also the association between the user accounts they represent. For example, the association between user accounts can be determined through historical transaction data, friend information, group information, login devices, registration information, and whether transactions were blocked. This association serves as the basis for the association between nodes. For instance, the more transactions or the higher the transaction amount between user accounts, the higher the degree of association between them is considered, and vice versa. Furthermore, within the application, user accounts that are friends, have many mutual friends, share many similar groups, have logged in using the same device, were registered with the same identity information, or have many similar blocked transactions are considered to have a high degree of association, and vice versa.

[0066] The preset association can refer to the association set according to actual needs to represent the low degree of association between nodes. For example, the preset association may include, but is not limited to, one or more of the following: the number of transactions between user accounts is less than a preset number, the transaction amount is less than a preset amount, the user accounts are not friends, the number of mutual friends is less than a preset number of friends, the number of the same groups joined is less than a preset number of groups, the user accounts do not log in using the same device, the user accounts do not register using the same identity information, and the number of similar blocked messages is higher than a preset number of SMS messages.

[0067] In some implementations, data used to determine the relationships between nodes can be stored in node features. Specifically, determining the relationship between two nodes connected by an edge can include: acquiring node features; and determining the relationship between the two nodes based on the node features. For example, data for judging the relationship can be acquired from the node features to determine the relationship between the two nodes connected by the edge, or the relationship between the two nodes connected by the edge can be determined by calculating the similarity between node features.

[0068] 120. Based on attention weights, calculate the weights of node features to obtain node features with attention. The node features are the feature data of user accounts.

[0069] Among them, node features may include, but are not limited to, at least one of the following: user account attribute information, user account transaction information related to the transaction, etc. For example, user account attribute information may include, but is not limited to, account name, login device information, the association relationship between the current user account and other user accounts, etc.; user account transaction information related to the transaction may include, but is not limited to, transaction time, transaction amount, number of transactions, the counterparty user account that transacted with the current user account, the number of counterparty user accounts, whether the transaction was blocked, etc.

[0070] Here, attention weights refer to the weight coefficients in the attention mechanism. Attention mechanisms can be used to calculate node features with attention characteristics. Attention mechanisms are a problem-solving method that mimics human attention, allowing for the rapid filtering of high-value information from large amounts of data. Algorithms related to attention mechanisms include SoftAttention, HardAttention, StaticAttention, DynamicAttention, and Self-Attention, and any one or more of these can be used when calculating node features with attention characteristics.

[0071] In practical applications, a large number of transactions often occur between numerous user accounts, resulting in a vast amount of node and node feature data. Attention weights are used to calculate the weights of node features. For example, attention weights can be used to perform dot product operations on the node features of each node to obtain attention-enhanced node features for each node. This allows for the filtering of high-value information from node features, enhancing their expressive power and improving the accuracy of identifying the risk level of user accounts.

[0072] In some implementations, attention weights can be determined based on the node features of neighboring nodes, enabling neighboring nodes to participate in the computation of the implicit representation of node features using an attention mechanism. Specifically, by calculating the weights of node features through attention weights, attention-enabled node features can be obtained, which may include:

[0073] Based on the node features of the node and the node features of the neighboring nodes, the attention weights of the corresponding neighboring nodes are calculated. The neighboring nodes are the nodes connected to the node in the graph data.

[0074] Based on attention weights, the node features of a node are weighted to obtain node features with attention.

[0075] For example, in practical applications, any node in the graph data can be considered the central node, and nodes connected to the central node can be considered its neighbors. For instance, central node A has three neighbors: nodes B, C, and D. For central node A, the importance of central node A to node B can be calculated based on the node features of central node A and node B. Similarly, the importance of central node A to node C and to node D can be obtained, and this importance can be converted into attention weights. The importance between features can be represented by the distance between features, such as by calculating the distance between node features using a similarity measurement. After obtaining the attention weights, the node features of central node A can be weighted and summed or weighted averaged using the attention weights corresponding to nodes B, C, and D respectively, to obtain the attention-enabled node features of central node A.

[0076] In some implementations, attention weights can be obtained by calculating the node features of a node and its neighboring nodes, followed by normalization. This simplifies the determination of importance values ​​based on the node and its neighboring nodes, improving the computational efficiency of weighted processing based on attention weights. Specifically, calculating the attention weights of corresponding neighboring nodes based on the node features of a node and the node features of its neighboring nodes can include:

[0077] Target operations are performed on the node features of a node and the node features of its neighboring nodes to obtain the operation results for the corresponding neighboring nodes.

[0078] The calculation results are normalized to obtain the attention weights of the corresponding adjacent nodes.

[0079] The target operation can refer to the calculation performed on the feature vector, which may include, but is not limited to, summation, vector dot product, linear summation, etc.

[0080] Normalization refers to the process of adjusting the value of the calculation result to a preset value range using normalization functions such as Softmax, Sigmoid, or MySQL functions. In other words, the attention weight value obtained by normalization is within the preset value range.

[0081] For example, the importance of the central node i to its neighboring node j can be calculated using the following formula. ,as follows:

[0082]

[0083] Where 'a' can represent The function 'a' is a mapping function that takes two F′-dimensional vectors as input and outputs a scalar. This function 'a' can have different implementations, such as a vector dot product. It can represent a weight matrix, and by using the weight coefficients, node features can be transformed into more expressive features. It can be shared by all central nodes. F can represent the feature vector dimension of the node features, and F′ can represent the feature vector dimension of the node features with attention.

[0084] like Figure 1c As shown, after obtaining importance Then, the weight coefficients of the corresponding neighboring node j can be obtained through normalization. (Attention weight), the specific calculation formula is as follows:

[0085]

[0086] in, This represents the sample size, i.e., the number of importance values ​​calculated. Indicates the kth Therefore, as Figure 1d As shown, the node features of the center node i can be weighted and summed (concat) or averaged (avg) using weight coefficients. In the figure, i is 1 for the center node. The method for obtaining the attention-related node features corresponding to the center node i using weighted summation is as follows:

[0087] .

[0088] in, It can represent nonlinear functions, such as activation functions, and thus obtain attention-oriented node features through weighted summation and activation function processing.

[0089] In some implementations, weighting coefficients It can be the parameter matrix in a multi-head attention mechanism, for example, it can be the key vector parameter matrix. K By introducing a multi-head attention mechanism, the model's fitting ability can be improved.

[0090] 130. Perform feature fusion processing on the edge features and node features to obtain node features with edge features. The edge features are feature data of transaction relationships.

[0091] Among them, edge features can refer to information that can be used to characterize the transaction relationship between user accounts. For example, edge features can include transaction information related to user accounts and transactions. Specifically, since the edges in graph data represent two connected user accounts that have made a transaction, the features can be, but are not limited to, the transaction time, transaction amount, etc.

[0092] Feature fusion processing refers to fusing multiple different features to generate new fused features. For example, features can be fused by concatenation, linear combination, RNN (Recurrent Neural Network) networks with attention mechanisms, DNN (Deep Neural Network) networks, FNN (Factorization-machine-supported Neural Networks), etc., to perform feature interaction, and to perform feature fusion processing on edge features and node features to obtain node features with edge features.

[0093] Since edge features can represent transaction relationships between user accounts, fusing node features with edge features can increase the focus of node features on transaction relationships between user accounts, resulting in node features with edge features that have stronger discriminative power than the original node features. This enhances the ability of node features to express transaction relationships and improves the accuracy of identifying the risk level of user accounts. It should be noted that this application does not restrict the order of execution of steps 120 and 130, and can be adjusted according to actual needs.

[0094] In some implementations, the propagation of edge features can be achieved by aggregating, concatenating, and weighting the features of adjacent nodes and edges connected to a node, thereby enhancing the expressive power of node features for transaction relationships. Specifically, feature fusion processing of edge features and node features to obtain node features with edge features can include:

[0095] The node features of adjacent nodes and the edge features of adjacent edges are aggregated to obtain aggregated features. Adjacent nodes are nodes connected to nodes in the graph data, and adjacent edges are edges connecting adjacent nodes to nodes.

[0096] The first spliced ​​feature is obtained by combining the aggregated features and the node features of the nodes;

[0097] The first concatenated features are weighted and summed to obtain the node features with edge features.

[0098] Aggregation processing refers to methods that combine multiple feature vectors to obtain a single feature vector. For example, methods such as Mean Aggregator, Pooling Aggregator, and LSTM Aggregator can be used to aggregate the node features of neighboring nodes and the edge features of adjacent edges to obtain aggregated features.

[0099] For example, a central node A has three neighboring nodes: B, C, and D. Correspondingly, there are adjacent edges B, C, and D connecting nodes B, C, and D, respectively. For the central node A, the node features of node B and the edge features of its neighbor B can be aggregated to obtain the aggregated features of node B. Similarly, the aggregated features of nodes C and D can be obtained. Then, the aggregated features of node B can be concatenated with the node features of the central node A to obtain the first concatenated features of node B. Similarly, the first concatenated features of nodes C and D can be obtained. Finally, the weighted sum of the first concatenated features of nodes B, C, and D can be used to obtain the node features of the central node A with edge features.

[0100] In some implementations, the node features of adjacent nodes and the edge features of adjacent edges can be concatenated and then aggregated to integrate the features of adjacent nodes and their connected adjacent edges into a whole, increasing the correlation between adjacent nodes and adjacent edges and enhancing the expressive power of node features in representing transaction relationships. Specifically, aggregating the node features of adjacent nodes and the edge features of adjacent edges to obtain aggregated features may include:

[0101] For each neighboring node of a node, the node features of the neighboring nodes and the edge features of the neighboring edges are concatenated to obtain the second concatenated feature.

[0102] All second-joined features are aggregated to obtain aggregated features.

[0103] For example, if there is a transaction between central node A and node B, where user account A in central node A transfers funds to user account B in node B, then the edge features connecting central node A and node B can include the transfer initiation time (a), transfer amount (b), number of transfers (c), whether the transfer was intercepted (d), and the association between user account A and user account B (e). Therefore, edge features abcde can be generated, such as... This can represent the edge characteristics between central node A and node B. Below, we will use... This represents the edge feature between node u and node v, where node v is the center node and node u is any adjacent node of node v.

[0104] After obtaining the edge features, the node features of adjacent node u can be... and the edge characteristics of edge B After splicing, the result is The aggregated features are then obtained after processing through a multilayer perceptron and a Mean Aggregator. The specific processing method can be expressed by the following formula:

[0105]

[0106] in, This represents a multilayer perceptron. This indicates the sample size, that is, the number of samples after concatenation. For example... Figure 1e As shown, the central node d is connected to nodes a, b, and c. The features of the edges connecting the central node d to nodes a, b, and c, after concatenation, are as follows: , , It can , as well as The latent vectors of the neighborhood of the central node d are used to calculate the average value of these latent vectors, thus obtaining the aggregated feature. .

[0107] After obtaining aggregation characteristics Then, aggregate features can be and the edge characteristics of edge B spliced ​​together Then, the aggregated features are weighted and summed using another multilayer perceptron to obtain node features with edge features. The specific processing method can be expressed by the following formula:

[0108] ;

[0109] in, This represents a multilayer perceptron.

[0110] A multilayer perceptron (MLP) can be a unidirectional neural network, comprising an input layer, hidden layers, and an output layer. The layers are fully connected, with each layer containing several neurons arranged hierarchically. Neurons within the same layer are not interconnected, and information is transmitted between layers in only one direction. Each neuron takes the outputs of the nodes in the previous layer as input, performs a linear transformation (combined with bias) using weights, and then applies a non-linear activation function. This makes the data linearly separable in the output layer, and the output of each node is passed to the nodes in the next layer. It's important to note that the input layer does not process the input vector. Thus, through the multilayer processing of the MLP, feature extraction is performed via the linear transformations of each layer, learning the interactions between node features and edge features, and adjusting node features to incorporate edge features.

[0111] 140. Combine the node features with attention characteristics and the node features with edge characteristics to determine the risk level of a user account.

[0112] The risk level refers to the degree of risk associated with a user account. A higher risk level indicates a higher probability that the user account will initiate illegal transactions. For example, risk levels can be divided into high risk, medium risk, low risk, and no risk, depending on actual needs.

[0113] For example, for each user account, the attention-related node features and edge-related node features corresponding to that user account can be combined. This combined feature is then input into a fully connected (FC) network, a fully connected neural network (FNN), or an RNN network, which can classify the input vector. Through classification processing of the combined features, a probability value corresponding to the risk level can be output; the higher the probability value, the higher the risk level. Therefore, based on the output probability value, the risk level of a user account can be determined as high-risk, medium-risk, low-risk, or no-risk.

[0114] In practical applications, the illegal transactions of some user accounts are often highly concealed and difficult to detect. For example, the transaction chain can be lengthened to allow multiple different user accounts to participate in the same transaction, or different user accounts can be used for communication or transactions. This application's embodiments determine the risk level of a user account by combining node features with attention-based features and node features with edge features. On the one hand, the attention mechanism focuses on the implicit expressions between nodes, enhancing the feature representation capability of node features and allowing for in-depth mining of communication or transaction information between user accounts. On the other hand, edge features enhance the expressive capability of node features for transaction relationships, allowing for in-depth mining of transaction chains. Thus, by integrating the implicit expressions between different user accounts and the transaction relationships between different accounts, the correlation between user accounts and transactions can be mined from multiple dimensions, improving the accuracy of identifying the risk level of a user account.

[0115] In some implementations, the attention-related node features and edge-related node features corresponding to a user account can be input into the XGBoost (Extreme Gradient Boosting) model to obtain the predicted value after XGBoost processing. This predicted value is then used as the risk level of the user account. The XGBoost model is an additive model based on a boosting strategy. It consists of T base learners, each of which is a tree. XGBoost achieves feature classification and extraction by integrating numerous trees. When splitting nodes in each tree, the splitting point can be selected based on the gain of the structure score; for example, the feature with the largest gain can be chosen for splitting. Different features may be split a different number of times by the tree. The weighted average of the number of splits for each feature is taken as its score, and the XGBoost model outputs the score for each feature. The feature score may be a positive integer or zero. Features with a score of zero, i.e. those not segmented by the trees of the Xgboost model, can be identified as irrelevant features and can be deleted. The remaining features are then filtered using a stepwise regression algorithm to obtain target features. The final predicted score is obtained by accumulating the scores of the target features. The risk level is determined based on the predicted score; the higher the score, the higher the risk level.

[0116] In some implementations, risk evidence of the user account can also be obtained, and the risk evidence corresponding to the user account, attention-based node features, and edge-based node features can be classified to obtain a predicted value. For example, the predicted value can be input into a trained Xgboost model, and the obtained predicted value can be used as the risk level of the user account. This allows for the fusion of risk-level-related evidence information of the user account to determine its risk level, improving the accuracy of identifying the risk level of the user account. Specifically, determining the risk level of a user account by combining attention-based node features and edge-based node features can include:

[0117] Evidence of the risks associated with obtaining user accounts;

[0118] Extract at least one initial feature from risk evidence, node features with attention, and node features with edge features;

[0119] Each initial feature is scored to obtain a numerical score;

[0120] By combining all the scores associated with a user account, the risk level of the user account is determined.

[0121] Risk evidence refers to evidentiary information that can be used to determine the level of risk. For example, risk evidence may include, but is not limited to, complaint information about user accounts and textual information that characterizes risk, such as communication information and search records. In practical applications, risk evidence can be complaint information or textual information related to illegal transactions.

[0122] For example, with user permission, communication information, search history, and complaint information about user accounts in the application can be obtained as risk evidence. Keyword extraction from this risk evidence yields target keywords related to illegal transactions, and these target keywords are encoded to obtain risk features. Risk features corresponding to the same user account, attention-based node features, and processed node features can be concatenated. The concatenated features are then input into an XGBoost model. The tree structure of the XGBoost model analyzes the concatenated features to obtain M initial features. These initial features can be feature vectors corresponding to complaint information, communication information, search history, transaction time, transaction amount, number of transactions, counterparty user accounts transacting with the current user account, the number of counterparty user accounts, account names, login device information, and the association between the current user account and other user accounts. Each initial feature vector is then calculated. The segmentation score is calculated by weighting the number of segmentations performed on the analyzed feature using the tree. Initial features with a segmentation score of 0 are deleted, resulting in N intermediate features. A stepwise regression algorithm is then used to iteratively calculate the N intermediate features using the tree of the XGBoost model until the model converges, outputting L target features and a score for each of the L target features. This score can also be understood as the XGBoost model's prediction score for the L target features. The scores of the L target features are summed to obtain the final predicted score value A. The risk level of the corresponding user account is determined based on the predicted score value. For example, user accounts with a score value A higher than a preset score value B are identified as high-risk, user accounts with a score value between preset score values ​​C and D are identified as medium-risk, and user accounts with a score value lower than a preset score value E are identified as low-risk.

[0123] In some implementations, determining the risk level of a user account by combining all the scores associated with the user account may include: determining the risk level of the user account and the evidentiary level of the risk evidence associated with the user account by combining all the scores associated with the user account.

[0124] In this context, the evidence level refers to the degree of risk associated with the user account implicated by the evidence. A higher evidence level indicates a higher level of risk for the user account. Evidence levels can be categorized as high-risk, medium-risk, low-risk, or risk-free, depending on the specific needs.

[0125] For example, the evidence level of risk evidence can be determined by the XGBoost model. Since the XGBoost model segments the input features, predicts a score for each target feature (the segmented feature), and then sums the target feature scores to obtain the final predicted score, after obtaining the target feature scores, the scores obtained from segmenting target features using attention-based node features and edge-based node features can be summed to obtain the account level score. Similarly, the scores of the target features obtained from risk evidence segmentation can be summed to obtain the evidence level score. The account level score can be compared with preset account level scores to classify the user account's risk level as high-risk, medium-risk, or low-risk. Similarly, the evidence level score can be compared with preset evidence level scores to classify risk evidence as high-risk, medium-risk, low-risk, or no-risk evidence.

[0126] 150. Handle user accounts according to risk level.

[0127] User accounts can be processed using preset handling strategies. These strategies may include, but are not limited to, account termination, transaction restriction, continuous monitoring, adding to a blacklist, or adding to a whitelist, and can be configured according to actual needs.

[0128] In some implementations, the preset processing strategy can be a variety of pre-set account handling methods. After determining the risk level of a user account, the corresponding account handling method can be obtained to process the user account, thereby improving the efficiency of user account processing. Specifically, processing user accounts according to risk level may include:

[0129] Based on the risk level, obtain the handling method for the target account;

[0130] User accounts are handled using the target account handling method.

[0131] Account handling methods can refer to the methods used to handle user accounts based on their risk level. For example, high-risk user accounts may be handled by methods such as account termination, transaction restrictions, or blacklisting; medium-risk user accounts may be handled by methods such as continuous monitoring; low-risk user accounts may be handled by methods such as whitelisting and continuous monitoring; and risk-free user accounts may be left untouched or simply whitelisted. Target account handling methods can refer to the account handling methods corresponding to the risk level of the user account.

[0132] In some implementations, after determining the risk level of a user account, further risk evidence can be used to determine the appropriate handling method for the user account, thereby improving the accuracy of user account handling. Specifically, based on the risk level, obtaining the target account handling method may include:

[0133] Based on the risk level of the user account and the level of evidence of the risk to the user account, obtain the method for handling the target account.

[0134] For example, the evidentiary level of risk evidence can also be determined based on the information contained within it. For instance, the more complaints related to illegal transactions concerning a user account contained in risk evidence, the higher the risk level of the user account and the higher the level of risk evidence. Similarly, the more textual information related to illegal transactions contained in risk evidence, the higher the risk level of the user account and the higher the level of risk evidence. If risk evidence contains no complaint information or textual information related to illegal transactions, it is considered risk-free evidence.

[0135] For example, such as Figure 1fAs shown, for high-risk accounts, different handling methods, ranging from high-risk to extremely low-risk, can be adopted based on the level of evidence. For medium-risk accounts, different methods, ranging from medium-risk to continuous monitoring, can be adopted based on the level of evidence. For low-risk accounts, different methods, ranging from further evaluation to adding to a whitelist, can be adopted based on the level of evidence. High-risk handling methods may refer to account termination (banning), medium-risk handling methods may refer to transaction restrictions, low-risk handling methods may refer to transaction limit restrictions, and extremely low-risk handling methods may refer to restrictions on receiving funds. For user accounts with high-risk evidence but low-risk levels (low-risk user accounts), the user account may have engaged in illegal transactions but has been mistakenly judged as having a low risk level. Therefore, further evaluation of the user account can be conducted manually. For user accounts with low-risk evidence and low-risk levels (low-risk user accounts), the user account should generally be a risk-free user account, but has been mistakenly judged as having a low risk level. Therefore, further evaluation of the user account can be conducted manually.

[0136] The method in this embodiment can identify the risk level of a user account using a preset neural network model. After obtaining graph data in step 110, the graph data can be input into the preset neural network model. After processing in steps 120-140, the preset neural network model outputs the risk level of the user account, and then the user account is processed in step 150. In some embodiments, for user accounts that have been misjudged, such as the two types of misjudged user accounts mentioned above, the node features and edge features of these user accounts can be obtained, and the preset neural network model can be optimized using these node features and edge features. For example, user accounts with high-risk evidence but low-risk levels can be classified as first-type user accounts, and user accounts with low-risk evidence and low-risk levels can be classified as second-type user accounts. The preset neural network model can be trained using the first-type and second-type user accounts to optimize the preset neural network model. For example, a label "low risk" can be assigned to the first type of account, and this label can be used as the ground truth. The features corresponding to the first type of account (node ​​features with attention, node features with edge features, or risk features representing risk evidence) are input into a pre-defined neural network model. The risk level predicted by this model is then used as the predicted value. The model is iteratively trained until it converges, thus using the first type of user accounts to optimize the model and improve the accuracy of identifying user account risk levels. Similarly, a label "no risk" can be assigned to the first type of account, and this label can be used as the ground truth to train the pre-defined neural network model and optimize it. Alternatively, the first and second types of user accounts can be combined into a training sample set to train the pre-defined neural network model.

[0137] In some implementations, risk features can be extracted from risk evidence using a feature extraction network, such as a Residual Network (ResNet), a Deep Learning Network (VGGNet), a Compressed and Activated Network (SENet), or a Convolutional Neural Network (CNN). For the second type of user account, misjudgments may occur due to low accuracy in extracting risk features from risk evidence. In this case, the risk evidence of the second type of user account can be used as training samples. A label "risk-free evidence" can be assigned to this evidence, and this label can be used as the ground truth. The risk evidence of the second type of user account is then input into the feature extraction network, and the evidence level predicted by the network is used as the predicted value. This process is repeated iteratively to train the feature extraction network until it converges. This approach optimizes the feature extraction network using the second type of user account, improving the accuracy of identifying the risk level of user accounts.

[0138] The user account processing solution provided in this application can be applied to various risk control scenarios. For example, taking a financial risk control scenario as an example, graph data is obtained, which includes multiple nodes and edges connecting the nodes. Nodes represent user accounts, and edges represent transaction relationships between user accounts. Based on attention weights, the node features are weighted to obtain attention-based node features, which are the feature data of the user account. The edge features and node features are fused to obtain edge features, which are the feature data of the transaction relationship. Combining the attention-based node features and the edge features, the risk level of the user account is determined. The user account is then processed according to the risk level.

[0139] The solution provided in this application combines node features with attention and node features with edge features to determine the risk level of a user account. On the one hand, the attention mechanism is used to focus on the implicit expressions between nodes, enhancing the feature expression capability of node features and enabling in-depth mining of communication or transaction information between user accounts. On the other hand, edge features are used to enhance the expressive capability of node features for transaction relationships, enabling in-depth mining of transaction links. Thus, by integrating the implicit expressions between different user accounts and the transaction relationships between different accounts, the correlation between user accounts and between user accounts and transactions can be mined from multiple dimensions, improving the accuracy of identifying the risk level of user accounts and enabling reasonable handling of user accounts based on the identification results.

[0140] The method provided in this application, after constructing graph data, can simplify the graph data from multiple dimensions such as the number of nodes, the number of edges, and node characteristics, so as to reduce the graph data, save computing resources, and improve the efficiency and accuracy of user account identification.

[0141] The method described in the above embodiments will be further described in detail below.

[0142] In this embodiment, the method of this application embodiment will be described in detail using a financial risk control scenario applied to social applications as an example.

[0143] like Figure 2a and Figure 2b As shown, the specific process of a user account processing method is as follows:

[0144] 210. Construct graph data based on historical transaction data.

[0145] For example, in financial risk control scenarios, irregular transactions are characterized by early morning transactions or transactions with amounts in multiples of 100. This allows us to obtain historical transaction data for transactions occurring in the early morning or with amounts in multiples of 100, and to construct graph data. The graph data uses financial relationships as edges, and the node features are information related to the characteristics of the irregular transactions.

[0146] Due to the massive user base and complex relationship networks of social applications, the graph data they construct has the following characteristics: 1. Efficiency: This social application has 800 million daily active users and involves over 1 billion related edges. The graph data is too large, and computing resources cannot support it, making processing efficiency impossible to guarantee. 2. High accuracy requirements: The accuracy rate for identifying user account risks needs to be above 90%. 3. Strong resistance to attacks: Currently, user accounts that have engaged in illegal transactions are relatively easy to detect using single dimensions such as text or high-risk suspicious dimensions such as receiving payments in whole hundred dollars at midnight. It is necessary to combine more multi-dimensional information to uncover deeply hidden user accounts that have engaged in illegal transactions.

[0147] Therefore, after obtaining graph data, it can be optimized from multiple dimensions such as the number of nodes, the number of edges, and node characteristics to reduce the amount of graph data, save computing resources, and improve the efficiency and accuracy of user account recognition.

[0148] 220. In the graph data, identify the node corresponding to the target user account as the node to be deleted.

[0149] For example, such as Figure 2c As shown, the graph data can be optimized. All user accounts in social applications can be filtered based on preset account criteria such as transaction amount, number of transactions, and number of counterparties (number of other user accounts). User accounts that do not meet the characteristics of users who have engaged in illegal transactions can be filtered out. For example, user accounts with too small a transaction amount, too few transactions, or too few counterparties will not be user accounts that have engaged in illegal transactions. This can significantly reduce the original 800 million user accounts to 100 million user accounts.

[0150] 230. In graph data, if the association relationship meets the preset association relationship, the edge corresponding to the association relationship is determined as the edge to be deleted.

[0151] For example, such as Figure 2c As shown, edge optimization can be performed on the graph data. The graph data obtained in step 210 (the original graph) has nearly 1.2 billion+ edges, but many of them are unimportant, such as a casual daily purchase or a random transaction between strangers. Therefore, we can filter out truly meaningful edges (edges with high correlation) by transaction characteristics (historical transaction data), duration of adding friends, mutual friends, mutual groups, same ID, same device, interception information, etc. For example, we can delete edges with low correlation, so that the number of edges retained in the optimized graph is reduced to 200 million.

[0152] 240. In node features, sub-features whose index values ​​meet preset index value conditions are identified as features to be deleted.

[0153] For example, such as Figure 2c As shown, feature optimization can be performed on graph data. The node features in the graph data have over 500 dimensions of candidate features. These candidate features can be filtered using metrics such as IV value, GINI coefficient, and Pearson coefficient, retaining the most significant approximately 100 dimensions. It should be noted that this application does not restrict the order of steps 210 to 240; the order can be adjusted according to actual needs.

[0154] 250. Delete the nodes and edges to be deleted from the graph data, and delete the features to be deleted from the node features.

[0155] like Figure 2c As shown, by deleting nodes and edges to be deleted from the graph data, and deleting features to be deleted from the node features, the graph data and node features are updated to obtain optimized graph data, and the updated graph data and node features are used in subsequent processing.

[0156] 260. Using an attention network, based on attention weights, the node features of a node are weighted to obtain node features with attention.

[0157] Before step 260, a preset neural network model can be obtained. The preset neural network model may include an attention network, a feature fusion network, and a classification network. The attention network can be used to calculate the weights of node features based on attention weights to obtain node features with attention. The feature fusion network can be used to fuse edge features with node features to obtain node features with edge features. The classification network can be used to combine node features with attention and node features with edge features to determine the risk level of a user account.

[0158] For example, an attention network can be a GAT (Graph Attention Network) model. The GAT model is an attention-based graph convolutional architecture that can classify nodes in graph-structured data. Each node's features can be input into the GAT model. By following a self-attention strategy, the GAT model involves neighboring nodes in computing the latent representation of each central node, outputting attention-enabled node features for that node. The GAT model is anisotropic, considering the weights of its neighbors, and can be used for directed graphs.

[0159] When processing node features using attention networks, the network only utilizes the connectivity between nodes and does not fully utilize edge features. Furthermore, the GAT model only uses first-order neighbors and does not utilize higher-order neighbors. When using second-order or higher neighbors, over-smoothing can easily occur.

[0160] 270. By using a feature fusion network, edge features and node features are fused to obtain node features with edge features.

[0161] For example, the feature fusion network can be the EdgePropGCN model. The EdgePropGCN model can fully utilize the features of multi-dimensional edges, overcoming the limitations of the GAT model, which can only use binary edge features, and the GCN model, which can only use one-dimensional edge features. The EdgePropGCN model can encode the features of multi-dimensional edges for directed edges, thus it can process directed graph data.

[0162] Node features are processed through feature fusion networks. Feature fusion networks rely on the diversity and effectiveness of edge features. However, they do not perform as well as attention networks for feature attribute mining.

[0163] 280. By using a classification network, combined with the node features of attention and the node features of edge features of the corresponding user account, and risk evidence, determine the risk level of the user account.

[0164] Since attention networks and feature fusion networks each have their own advantages and disadvantages in processing node features, attention networks can deeply mine communication or transaction information between user accounts based on attention, while feature fusion networks can enhance the ability of node features to express transaction relationships by utilizing edge features, and can deeply mine transaction links. The two work together to mine the correlation between user accounts and between user accounts and transactions from multiple dimensions, thereby improving the accuracy of identifying the risk level of user accounts.

[0165] For example, the classification network can be the Xgoost model. For each node, the node feature vector with attention output from the attention network, the node feature vector with edge features output from the feature fusion network, and the risk feature vector of risk evidence can be concatenated and input into the Xgboost model. The Xgboost model can combine these three features for comprehensive evaluation to obtain the final comprehensive score, and the score result can be used as the risk level of the user account.

[0166] 290. Handle user accounts according to their risk level.

[0167] For example, the Xgboost model output can include a score for the risk level of a user account and a score for the level of evidence of the risk. Based on these scores, the risk level of the user account and the level of evidence of the risk are determined. Different processing methods can be formulated based on the risk level of the user account and the level of evidence of the risk. Figure 1f As shown, high-risk user accounts and those with high-risk evidence are subject to high-risk handling measures, such as account termination or long-term transaction restrictions. Low-risk user accounts, on the other hand, can be continuously monitored, and identification of accounts engaging in illegal transactions can be achieved by combining other dimensions. For low-risk user accounts with low-risk evidence, since their overall scores are significantly lower than the average, they possess whitelist attributes. Therefore, these user accounts can be added to the whitelist. Furthermore, the features corresponding to these user accounts (such as those within the whitelist) can be used as training samples to train a pre-defined neural network model, thereby optimizing the model and enabling it to better distinguish low-risk user accounts with low-risk evidence.

[0168] As can be seen from the above, the embodiments of this application can construct graph data based on user transactions according to financial relationships. After obtaining the graph data, it can be simplified from multiple dimensions such as the number of nodes, the number of edges, and node features to reduce the graph data size, save computing resources, and improve the efficiency and accuracy of user account identification. By combining a preset neural network model with attention networks and feature fusion networks, the attention network can deeply mine communication or transaction information between user accounts based on attention, while the feature fusion network can enhance the expressive ability of node features to represent transaction relationships by utilizing edge features. This allows for in-depth mining of transaction links. The two work together to mine the correlation between user accounts and between user accounts and transactions from multiple dimensions, improving the accuracy of identifying the risk level of user accounts, so that user accounts can be reasonably processed based on the identification results.

[0169] Therefore, the method provided in this application embodiment can play a better role in processing user accounts that have committed illegal transactions, improve the processing rate of high-risk and medium-risk user accounts by 30%, and greatly enhance the ability to identify user accounts that have committed illegal transactions in a hidden manner. Furthermore, by exploring the correlation between user accounts and between user accounts and transactions from multiple dimensions, the risk level of a user account can be accurately identified even when the node or edge features of the user account are limited, such as in the following special scenarios: 1. The qualitative evidence for this account is not abundant, but the qualitative evidence for the counterparty (the account trading with this account) is relatively abundant; 2. The qualitative evidence for this account is abundant, but the transaction confrontation is strong (large amounts or non-integer transactions and a small number of transactions, etc.), the main account is difficult to identify, but the counterparty has a high concentration of suspiciousness (few violation features); 3. Both this account and the counterparty's transactions have limited qualitative evidence, the transactions are suspicious but have not reached the processing threshold; 4. The qualitative evidence for this account and first-order counterparties is insufficient, but second-order counterparties can identify multiple first-order counterparties; 5. The counterparty account that sent the illegal transaction does not have obvious violation features, but is the main trading counterparty; 6. Both this account and the counterparty's transactions have limited qualitative evidence, the transactions are suspicious (with a few violation features) but have not reached the processing threshold, but the transaction features are suspicious, such as multiple interceptions or suspicious transactions.

[0170] To better implement the above methods, this application also provides a user account processing device, which can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, or personal computer; the server can be a single server or a server cluster composed of multiple servers.

[0171] For example, in this embodiment, the method of this application embodiment will be described in detail by taking the user account processing device specifically integrated into an electronic device as an example.

[0172] For example, such as Figure 3 As shown, the user account processing device may include an acquisition unit 310, an attention unit 320, a fusion unit 330, a determination unit 340, and a processing unit 350, as follows:

[0173] (a) Acquisition Unit 310

[0174] It can be used to obtain graph data, which includes multiple nodes and edges connecting the nodes. Nodes represent user accounts, and edges represent transaction relationships between user accounts.

[0175] In some implementations, the acquisition unit 310 may also be used for:

[0176] Obtain transaction data from historical transactions;

[0177] Determine the transaction relationships between user accounts from transaction data;

[0178] Graph data is constructed using user accounts as nodes and transaction relationships as edges.

[0179] In some implementations, the acquisition unit 310 may also be used for:

[0180] The node corresponding to the target user account is identified as the node to be deleted. The target user account is a user account that meets the preset account conditions.

[0181] In the graph data, delete the node to be deleted.

[0182] In some implementations, the acquisition unit 310 may also be used for:

[0183] Determine the relationship between the two nodes connected by the edge;

[0184] If the association relationship meets the preset association relationship, the edge corresponding to the association relationship will be determined as the edge to be deleted. The preset association relationship is used to indicate a low degree of association.

[0185] In graph data, delete the edge to be deleted.

[0186] In some implementations, node features may include at least one sub-feature, and the acquisition unit 310 may also be used for:

[0187] Based on a preset index calculation strategy, sub-features are calculated to obtain at least one index value.

[0188] Sub-features whose index values ​​meet preset index value conditions are identified as features to be deleted.

[0189] In graph data, delete the features to be deleted from the node features.

[0190] (ii) Attention Unit 320

[0191] It can be used to calculate the weights of node features based on attention weights, so as to obtain node features with attention, where the node features are the feature data of user accounts.

[0192] In some implementations, the attention unit 320 may specifically be used for:

[0193] Based on the node features of the node and the node features of the neighboring nodes, the attention weights of the corresponding neighboring nodes are calculated. The neighboring nodes are the nodes connected to the node in the graph data.

[0194] Based on attention weights, the node features of a node are weighted to obtain node features with attention.

[0195] In some implementations, the attention weights of corresponding neighboring nodes are calculated based on the node features of a node and the node features of its neighboring nodes, which may include:

[0196] Target operations are performed on the node features of a node and the node features of its neighboring nodes to obtain the operation results for the corresponding neighboring nodes.

[0197] The calculation results are normalized to obtain the attention weights of the corresponding adjacent nodes.

[0198] (III) Integration Unit 330

[0199] It can be used to perform feature fusion processing between edge features and node features to obtain node features with edge features, where the edge features are feature data of transaction relationships.

[0200] In some implementations, the fusion unit 330 may specifically be used for:

[0201] The node features of adjacent nodes and the edge features of adjacent edges are aggregated to obtain aggregated features. Adjacent nodes are nodes connected to nodes in the graph data, and adjacent edges are edges connecting adjacent nodes to nodes.

[0202] The first spliced ​​feature is obtained by combining the aggregated features and the node features of the nodes;

[0203] The first concatenated features are weighted and summed to obtain the node features with edge features.

[0204] In some implementations, the node features of adjacent nodes and the edge features of adjacent edges are aggregated to obtain aggregated features, which may include:

[0205] For each neighboring node of a node, the node features of the neighboring nodes and the edge features of the neighboring edges are concatenated to obtain the second concatenated feature.

[0206] All second-joined features are aggregated to obtain aggregated features.

[0207] (iv) Determine Unit 340

[0208] It can be used to combine node features with attention features and node features with edge features to determine the risk level of a user account.

[0209] In some implementations, the determining unit 340 may specifically be used for:

[0210] Evidence of the risks associated with obtaining user accounts;

[0211] Extract at least one initial feature from risk evidence, node features with attention, and node features with edge features;

[0212] Each initial feature is scored to obtain a numerical score;

[0213] By combining all the scores associated with a user account, the risk level of the user account is determined.

[0214] (iv) Processing Unit 350

[0215] It can be used to process user accounts based on risk level.

[0216] In some implementations, the processing unit 350 may specifically be used for:

[0217] Based on the risk level, obtain the handling method for the target account;

[0218] User accounts are handled using the target account handling method.

[0219] In practice, each of the above units can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units, please refer to the previous method embodiments, which will not be repeated here.

[0220] Therefore, the embodiments of this application can integrate the implicit expressions between different user accounts and the transaction relationships between different accounts, and can explore the correlation between user accounts and transactions from multiple dimensions, thereby improving the accuracy of identifying the risk level of user accounts, and allowing user accounts to be handled reasonably based on the identification results.

[0221] This application also provides an electronic device, which can be a terminal, a server, or other similar device. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, personal computer, etc.; the server can be a single server or a server cluster composed of multiple servers, etc.

[0222] In some embodiments, the user account processing device may also be integrated into multiple electronic devices, such as multiple servers, with multiple servers implementing the user account processing method of this application.

[0223] In this embodiment, a server will be used as an example for detailed description. For example, ... Figure 4 As shown, it illustrates a schematic diagram of the server structure involved in an embodiment of this application. Specifically:

[0224] The server may include components such as a processor 410 with one or more processing cores, a memory 420 with one or more computer-readable storage media, a power supply 430, an input module 440, and a communication module 450. Those skilled in the art will understand that... Figure 4 The server architecture shown does not constitute a limitation on the server and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. Wherein:

[0225] Processor 410 is the control center of the server, connecting various parts of the server via various interfaces and lines. It performs various server functions and processes data by running or executing software programs and / or modules stored in memory 420, and by calling data stored in memory 420. In some embodiments, processor 410 may include one or more processing cores; in some embodiments, processor 410 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 410.

[0226] The memory 420 can be used to store software programs and modules. The processor 410 executes various functional applications and data processing by running the software programs and modules stored in the memory 420. The memory 420 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the server, etc. In addition, the memory 420 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 420 may also include a memory controller to provide the processor 410 with access to the memory 420.

[0227] The server also includes a power supply 430 that supplies power to the various components. In some embodiments, the power supply 430 can be logically connected to the processor 410 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 430 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0228] The server may also include an input module 440, which can be used to receive input numeric or character information, and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0229] The server may also include a communication module 450. In some embodiments, the communication module 450 may include a wireless module, through which the server can perform short-range wireless transmission, thereby providing users with wireless broadband internet access. For example, the communication module 450 can be used to help users send and receive emails, browse web pages, and access streaming media.

[0230] Although not shown, the server may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 410 in the server loads the executable files corresponding to the processes of one or more applications into the memory 420 according to the following instructions, and the processor 410 runs the applications stored in the memory 420 to realize various functions, as follows:

[0231] Obtain graph data, which includes multiple nodes and edges connecting the nodes. Nodes represent user accounts, and edges represent transaction relationships between user accounts. Based on attention weights, calculate the weights of node features to obtain attention-based node features, which are the feature data of user accounts. Perform feature fusion processing between edge features and node features to obtain edge-based node features, which are the feature data of transaction relationships. Combine the attention-based node features and edge-based node features to determine the risk level of user accounts. Process user accounts according to their risk levels.

[0232] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0233] As can be seen from the above, this application can integrate the implicit expressions between different user accounts and the transaction relationships between different accounts. It can explore the correlation between user accounts and between user accounts and transactions from multiple dimensions, improve the accuracy of identifying the risk level of user accounts, and make reasonable handling of user accounts based on the identification results.

[0234] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0235] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute steps in any of the user account processing methods provided in embodiments of this application. For example, the instructions can execute the following steps:

[0236] Obtain graph data, which includes multiple nodes and edges connecting the nodes. Nodes represent user accounts, and edges represent transaction relationships between user accounts. Based on attention weights, calculate the weights of node features to obtain attention-based node features, which are the feature data of user accounts. Perform feature fusion processing between edge features and node features to obtain edge-based node features, which are the feature data of transaction relationships. Combine the attention-based node features and edge-based node features to determine the risk level of user accounts. Process user accounts according to their risk levels.

[0237] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0238] According to one aspect of this application, a computer program product or computer program is provided, comprising a computer program / instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer program / instructions from the computer-readable storage medium and executes the computer program / instructions, causing the computer device to perform the methods provided in the various optional implementations of the above embodiments.

[0239] Since the instructions stored in the storage medium can execute the steps of any of the user account processing methods provided in the embodiments of this application, the beneficial effects that any of the user account processing methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0240] The foregoing has provided a detailed description of a user account processing method, apparatus, electronic device, medium, and program product provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A user account processing method, characterized by, include: Obtain graph data, which includes multiple nodes and edges connecting the nodes. The nodes represent user accounts, and the edges represent transaction relationships between the user accounts. Based on attention weights, the node features of the node are weighted to obtain node features with attention, and the node features are the feature data of the user account. The edge features and node features are fused to obtain node features with edge features, including: for each neighboring node of the node, concatenating the node features of the neighboring node and the edge features of the neighboring edge to obtain a second concatenated feature; aggregating all the second concatenated features to obtain an aggregated feature; the neighboring node is a node connected to the node in the graph data, and the neighboring edge is an edge connecting the neighboring node and the node; concatenating the aggregated feature and the node features of the node to obtain a first concatenated feature; and performing a weighted summation on the first concatenated feature to obtain node features with edge features, where the edge features are feature data of the transaction relationship, including at least one of transfer time, transfer amount, number of transfers, whether the transfer was blocked, and the association relationship between user accounts; By combining the node features with attention characteristics and the node features with edge characteristics, the risk level of the user account is determined. The user account will be processed according to the risk level.

2. The user account processing method of claim 1, wherein, The step of calculating the weights of the node features based on attention weights to obtain node features with attention includes: Based on the node features of the node and the node features of the neighboring nodes, the attention weights of the corresponding neighboring nodes are calculated, where the neighboring nodes are the nodes in the graph data that are connected to the node. Based on the attention weights, the node features of the node are weighted to obtain node features with attention.

3. The user account processing method of claim 2, wherein, The calculation of attention weights for neighboring nodes based on the node features and the node features of neighboring nodes includes: Target operation is performed on the node features of the node and the node features of the adjacent nodes to obtain the operation result corresponding to the adjacent nodes; The calculation result is normalized to obtain the attention weights corresponding to the adjacent nodes.

4. The user account processing method of claim 1, wherein, Before acquiring the graph data, the process also includes: Obtain transaction data from historical transactions; Determine the transaction relationships between the user accounts from the transaction data; The graph data is constructed using the user accounts as nodes and the transaction relationships as edges.

5. The user account processing method of claim 1, wherein, Before acquiring the graph data, the process also includes: The node corresponding to the target user account is identified as the node to be deleted, and the target user account is a user account that meets the preset account conditions; In the graph data, delete the node to be deleted.

6. The user account processing method of claim 1, wherein, Before acquiring the graph data, the process also includes: Determine the association relationship between the two nodes connected by the edge; If the association relationship satisfies a preset association relationship, the edge corresponding to the association relationship is determined as an edge to be deleted. The preset association relationship is used to indicate a low degree of association. In the graph data, delete the edge to be deleted.

7. The user account processing method of claim 1, wherein The node features include at least one sub-feature, and before acquiring the graph data, the process further includes: Based on a preset index calculation strategy, the sub-features are calculated to obtain at least one index value. The sub-features whose index values ​​satisfy preset index value conditions are identified as features to be deleted; In the graph data, delete the feature to be deleted from the node features.

8. The user account processing method of claim 1, wherein, The process of determining the risk level of a user account by combining the attention-based node features and the edge-based node features includes: Obtain evidence of the risk associated with the user account; Extract at least one initial feature from the risk evidence, the attention-enabled node features, and the edge-enabled node features; Each of the initial features is scored to obtain a score value; The risk level of the user account is determined by combining all the scores corresponding to the user account.

9. The user account processing method according to any one of claims 1 to 8, wherein The process of handling the user account according to the risk level includes: Based on the risk level, obtain the target account handling method; The user account is processed using the target account processing method.

10. A user account processing apparatus, characterized by comprising: include: An acquisition unit is used to acquire graph data, which includes multiple nodes and edges connecting the nodes. The nodes represent user accounts, and the edges represent transaction relationships between the user accounts. An attention unit is used to calculate the weights of the node features of the node based on attention weights, so as to obtain node features with attention, wherein the node features are the feature data of the user account. A fusion unit is used to perform feature fusion processing on the edge features of the edges and the node features to obtain node features with edge features. This includes: for each neighboring node of the node, concatenating the node features of the neighboring node and the edge features of the adjacent edges to obtain a second concatenated feature; aggregating all the second concatenated features to obtain an aggregated feature; the neighboring node is a node connected to the node in the graph data, and the adjacent edge is an edge connecting the neighboring node and the node; concatenating the aggregated feature and the node features of the node to obtain a first concatenated feature; and performing a weighted summation on the first concatenated feature to obtain node features with edge features, where the edge features are feature data of the transaction relationship, including at least one of transfer time, transfer amount, number of transfers, whether the transfer was blocked, and the association relationship between user accounts. A determining unit is used to combine the attention-based node features and the edge-based node features to determine the risk level of the user account; The processing unit is used to process the user account according to the risk level.

11. An electronic device, comprising: The device includes a processor and a memory, the memory storing multiple instructions; the processor loads instructions from the memory to perform the steps of the user account processing method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the steps of the user account processing method according to any one of claims 1 to 9.

13. A computer program product comprising computer programs / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the user account processing method according to any one of claims 1 to 9.

Images