Blacklist mining method and device, and computer readable storage medium

Abstract

The application discloses a black list mining method and device and a computer readable storage medium. The method comprises the following steps: obtaining customer information of a plurality of customers, constructing at least one knowledge graph according to the customer information, and the plurality of customers comprising black list customers and non-black list customers; extracting customer features of each customer according to the knowledge graph, wherein the customer features comprise graph embedding features, graph structure features and customer risk features; training a single classification black list identification model based on the customer features of the plurality of customers; using the trained single classification black list identification model to predict whether a to-be-tested customer belongs to a black list, and updating a historical black list according to a prediction result. The application combines knowledge graphs, feature engineering, machine learning, artificial intelligence and other technical methods to identify hidden black list customers, automatically expand the black list, obtain a new black list, help enterprises to manage business risks and improve risk management capabilities, and reduce manpower.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of risk monitoring, in particular to a black list mining method and device and computer readable storage medium. BACKGROUND

[0002] Currently, most financial institutions use black lists for risk management. If a customer hits the black list, the business will be rejected.

[0003] In the prior art, the black list is usually constructed and maintained by human experience, which not only consumes a large amount of manpower and time cost and is low in efficiency, but also is low in accuracy due to strong subjectivity. SUMMARY

[0004] To solve the above problems, the present application provides a black list mining method, device and computer readable storage medium.

[0005] In a first aspect, the present application provides a black list mining method, comprising:

[0006] obtaining customer information of a plurality of customers, and constructing at least one knowledge graph according to the customer information, wherein the plurality of customers include black list customers and non-black list customers;

[0007] extracting customer features of each of the customers according to the knowledge graph, wherein the customer features include graph embedding features, graph structure features and customer risk features;

[0008] training a single classification black list identification model based on the customer features of the plurality of customers;

[0009] using the trained single classification black list identification model to predict whether a to-be-tested customer belongs to a black list, and updating a historical black list according to a prediction result.

[0010] In a second aspect, the present application further provides a black list mining device, comprising:

[0011] an obtaining unit configured to obtain customer information of a plurality of customers, and construct at least one knowledge graph according to the customer information, wherein the plurality of customers include black list customers and non-black list customers;

[0012] an extracting unit configured to extract customer features of each of the customers according to the knowledge graph, wherein the customer features include graph embedding features, graph structure features and customer risk features;

[0013] a training unit configured to train a single classification black list identification model based on the customer features of the plurality of customers;

[0014] A prediction unit is configured to use the trained single-class blacklist identification model to predict whether a to-be-tested client belongs to a blacklist, and update the historical blacklist according to a prediction result.

[0015] In a third aspect, an electronic device is provided, including: a processor; and a memory arranged to store computer-executable instructions that, when executed, cause the processor to perform the above-described blacklist mining method.

[0016] In a fourth aspect, a computer-readable storage medium is provided, which stores one or more programs, and the one or more programs, when executed by an electronic device including a plurality of applications, cause the electronic device to perform the above-described blacklist mining method.

[0017] The above-described at least one technical solution adopted by the embodiments of the present application can achieve the following beneficial effects:

[0018] The present application obtains client information of a plurality of clients, constructs at least one knowledge graph according to the client information, wherein the plurality of clients include blacklist clients and non-blacklist clients; extracts client features of each of the clients according to the knowledge graph, the client features including graph embedding features, graph structure features, and client risk features; then, trains a single-class blacklist identification model based on the client features of the plurality of clients; finally, uses the trained single-class blacklist identification model to predict whether a to-be-tested client belongs to a blacklist, and updates a historical blacklist according to a prediction result. The present application combines knowledge graphs, feature engineering, machine learning, artificial intelligence, and other technical methods to identify hidden blacklist clients, automatically expand the blacklist, obtain a new blacklist, help enterprises to manage business risks and improve risk management capabilities, reduce labor and time costs, and improve the accuracy of the blacklist. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate embodiments of the present application and the description thereof, which serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0020] Figure 1 A flowchart of a blacklist mining method according to one embodiment of the present application is shown;

[0021] Figure 2 A schematic diagram of a knowledge graph according to one embodiment of the present application is shown;

[0022] Figure 3 A structural schematic diagram of a blacklist mining device according to one embodiment of the present application is shown.

[0023] Figure 4 Fig. 1 is a structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described below in detail with the embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0025] The technical solutions provided by the embodiments of the present application will be described below in detail with the drawings.

[0026] Currently, most financial institutions use blacklists for risk management. If a customer hits the blacklist, the business will be rejected. The blacklist is usually constructed by human experience. Artificially constructing a blacklist is inefficient and requires professionals to constantly monitor business risks. In order to reduce labor costs, discover customers with high risks that are not easily discovered by humans.

[0027] To this end, the present application provides a blacklist mining method, Figure 1 Fig. 1 shows a flowchart of a blacklist mining method according to the present application, from Figure 1 It can be seen that the present application at least includes steps S110-S140:

[0028] Step S110: Obtain customer information of a plurality of customers, and construct at least one knowledge graph according to the customer information, wherein the plurality of customers include blacklist customers and non-blacklist customers.

[0029] The overall concept of the present application is to identify potential blacklist customers based on knowledge graphs, feature engineering and machine learning and other artificial intelligence methods, automatically expand the blacklist, obtain a new blacklist, manage business risks for enterprises and reduce labor costs.

[0030] First, obtain customer information of a large number of customers, and establish a knowledge graph according to the large amount of customer information.

[0031] Among these large number of customers, there are customers already maintained in the existing blacklist (referred to as historical blacklist), referred to as blacklist customers; there are also ordinary customers not in the blacklist, referred to as non-blacklist customers.

[0032] In some embodiments of the present application, the customer information of the customer includes at least one of customer personal information, historical underwriting risk data, historical claim risk data, credit risk data, and credit investigation data; at least one knowledge graph is constructed according to the customer information, including: converting the customer information into triple form data, the triple form being: [entity, relationship, entity] or [entity, attribute, attribute value]; wherein at least one of a person, an enterprise, and a policy is taken as an entity, the relationship including at least one of a relationship between persons, an investment relationship between enterprises, and a subordinate relationship between a person and a policy; a knowledge graph is drawn according to the triple form data and stored in a graph database, wherein a first graph in the knowledge graph is a node, a second graph is an attribute set, and an edge between the first graphs is a relationship.

[0033] That is, after obtaining customer personal information, historical underwriting risk data, historical claim risk data, internal black list, overdue premium receivable situation, and other credit risk data, and external credit investigation data, a knowledge graph is constructed.

[0034] The customer personal information at least includes but is not limited to: customer name, mobile phone number, ID number (for enterprise customers, it is a unified social credit code) and other data. The historical underwriting data or the historical claim data at least includes but is not limited to: policy number, risk label corresponding to the policy and other data. The risk label data corresponding to the policy includes but is not limited to: backdated policy, post-claim underwriting, inconsistency between the information of compulsory insurance and commercial vehicle insurance, supplementary record, and repeated payee label data. The internal credit risk data is the collected black list customer data and the data of customers whose overdue premium receivable exceeds half a year. The external credit investigation data is the credit investigation status of the customer.

[0035] After obtaining a large amount of multi-party data, it is converted into a triple form of [entity, relationship, entity] or [entity, attribute, attribute value] and stored in a graph database. The person, the enterprise, and the policy can be taken as an entity, the relationship can be reflected in the relationship between persons, such as a kinship relationship, a colleague relationship, a shared mobile phone number, and an investment relationship between enterprises; the relationship between a person and a policy can include a policyholder, an insured person, and the like.

[0036] The attribute is an attribute of the entity, for example, the entity of a person at least includes name, mobile phone number, ID number, and risk label attribute, and the value corresponding to each attribute is an attribute value. The entity of a policy at least includes a policy number and a policy risk label attribute. The entity of an enterprise includes an enterprise name, a unified social credit code, and a risk label attribute. Figure 2 A schematic diagram of a knowledge graph according to an embodiment of the present application is shown as Figure 2 shown, wherein the circle represents a node, the square represents an attribute set of the node, and the edge between the nodes represents a relationship.

[0037] It should be noted that the knowledge graph is usually multiple, because the information of the customers is massive, and only a plurality of persons or enterprises having a certain association can be included in one knowledge graph, and all customers cannot be covered, so that some customers associated form a knowledge graph, and massive customers form multiple knowledge graphs.

[0038] The formed indication graph is stored in a special graph database for use.

[0039] Step S120: extracting customer features of each customer according to the knowledge graph, the customer features including graph embedding features, graph structure features, and customer risk features.

[0040] Then, a corresponding customer feature vector is extracted from each customer in the knowledge graph, and the customer feature vector includes at least one of the graph embedding features, the graph structure features, and the customer risk features of the customer itself.

[0041] Specifically, for the graph embedding features, in some embodiments of the present application, the extracting customer features of each customer according to the knowledge graph includes: for a customer, generating a random walk path with a preset path length with the customer as a source point by using a RandomWalk algorithm, and traversing the random walk path to obtain a node sequence of the customer; training a skip-gram model by using node sequences of a plurality of customers; and extracting features of the knowledge graph by using the trained skip-gram model to obtain graph embedding features of each customer in a preset dimension.

[0042] That is, the graph embedding features can be extracted by using a DeepWalk model, and the steps of extracting features by using the DeepWalk model are as follows:

[0043] First, a random walk path with a specified path length t is generated with each customer as a source point by using a RandomWalk algorithm. RandomWalk is a depth-first traversal algorithm that can repeatedly access visited nodes, and a node is randomly sampled from neighbors of a current access starting node as a next access node, and the process is repeated until the length of the access sequence meets a preset condition t, and a walk sequence with a length of t, i.e., a node sequence of the customer, is obtained through this step. Second, after the node sequence of the customer is constructed, a skip-gram model is used to obtain graph embedding features of each customer. The skip-gram model is trained based on n customers and random walk sequences with a length of t in advance, and the trained skip-gram model is used to obtain graph embedding features of each customer. In some embodiments, the graph embedding features of each customer are d-dimensional, and d is, for example, 256.

[0044] For the graph structure features, in some embodiments of the present application, the extracting the customer features of each of the customers according to the knowledge graph comprises: extracting the graph structure features of each of the customers through a graph algorithm interface provided by the graph database, the graph structure features comprising at least one of the following: degree, in-degree, out-degree, eigenvector centrality, clustering coefficient, eccentricity, betweenness centrality, and closeness centrality; wherein the degree represents the sum of all edges connected to a node; the in-degree represents the sum of all edges pointing to a node; the out-degree represents all edges pointing from a node to other nodes; the eigenvector centrality represents the importance of a node based on its connections; the clustering coefficient represents the overall indication of node clustering and characterizes the embedding of a node in its neighbors; the eccentricity represents the distance from a given starting node to its most distant node; the betweenness centrality represents the frequency of a node appearing in the shortest paths in the network; and the closeness centrality represents the average distance from a given starting node to all other nodes.

[0045] Table 1 shows 8 features in the graph structure features and their meanings, and for these 8 features, the graph algorithm interface (graph algorithm API) provided by the graph database can be used, but is not limited thereto.

[0046] Table 1

[0047]

[0048]

[0049] For the customer risk features of the customers themselves, in some embodiments of the present application, the extracting the customer features of each of the customers according to the knowledge graph comprises: extracting the customer risk features of each of the customers from the second graph, the customer risk features comprising at least one of the following: whether the customer is a dishonest customer, whether the overdue premium receivable exceeds a threshold, and risk label statistical data of the customer as an insured person or a policyholder involved in a policy; wherein the risk label statistical data comprises at least one of the following: the number of times of reverse signing of a policy, the number of times of fraud insurance by using an old high-end car, the number of times of reporting a case after canceling at the end of the year, the number of times of abnormal time of loss, the overdue premium rate, the maximum number of overdue days, and the overdue premium amount.

[0050] The risk features of the customers themselves include but are not limited to whether the customer is a dishonest customer, whether the overdue premium receivable exceeds half a year, and risk label statistical data of the customer as an insured person or a policyholder involved in a policy. The risk label statistical data of the customer involved in a policy here can include the number of times of reverse signing of a policy, the number of times of fraud insurance by using an old high-end car, the number of times of reporting a case after canceling at the end of the year, the number of times of abnormal time of loss, the overdue premium rate, the maximum number of overdue days, the overdue premium amount, and the like. For these features, the relevant data can be read and summarized in the attribute set, and the summary can be obtained.

[0051] Step S130: training a single-class blacklist identification model based on the customer features of the plurality of customers.

[0052] After collecting the above three types of features of all customers, a model is trained using a single-class classification algorithm, and the model is denoted as a single-class blacklist identification model. Single-class classification refers to training data having only one type of data, and the model is trained based on the data, and then it is determined whether a to-be-tested sample belongs to the type. In this application, a single-class classification algorithm is selected to identify hidden blacklist customers. Therefore, the model is trained based on the features of known blacklist customers, and the trained model is used to determine other customers not in the blacklist. If it is determined that the customers belong to the same type, the customers are added to the blacklist.

[0053] In some embodiments of the present application, the training of the single-class blacklist identification model based on the customer features of the plurality of customers includes: constructing a training set based on the customer features of at least part of the blacklist customers, and constructing a test set based on the customer features of at least part of the blacklist customers and at least part of the non-blacklist customers; training the single-class blacklist identification model based on the training set to obtain a threshold T; based on the threshold T, taking sensitivity as an evaluation index, cross-validating the trained single-class blacklist identification model based on the test set, and performing back propagation according to the validation result to obtain the trained single-class blacklist identification model.

[0054] That is, a training set and a test set are constructed based on all the features of the extracted blacklist customers and other non-blacklist customers. The training set only includes customers hitting the blacklist, and the test set includes at least part of the blacklist customers and at least part of the non-blacklist customers.

[0055] The single-class blacklist identification model constructed based on the single-class classification algorithm of K-nearest neighbors is trained based on the training data of the training set. The single-class classification algorithm can include but is not limited to OneClass KNN, OC-KNN, etc. Then, the single-class blacklist identification model is verified based on the test set to improve the accuracy.

[0056] The following single classification blacklist identification model is constructed based on the OC-KNN algorithm; the single classification blacklist identification model is trained based on the training set, including: setting the parameters K and the excluded sample proportion γ of the single classification blacklist identification model; determining the K-neighbor distance of each sample in the training set according to the Euclidean distance formula, wherein the K-neighbor distance is the average value of the K-neighbor distances of a sample; the K-neighbor distances of all training samples in the training set are arranged in descending order; the K-neighbor distance of the sample located at the γxm sample in the arrangement result is selected and set as a threshold T, wherein m is a preset value. Based on the test set, the trained single classification blacklist identification model is cross-validated with sensitivity as the evaluation index based on the threshold T, and the validation result is back-propagated, including: determining the K-neighbor distance of each test sample in the test set, if the K-neighbor distance of a test sample is less than the threshold T, it is attributed to the target class; the sensitivity of the multiple test samples attributed to the target class is determined, and when the sensitivity is maximum, the corresponding parameters K and the excluded sample proportion γ are used as the final single classification blacklist identification model of the single classification blacklist identification model.

[0057] The specific process of model training using the OC-KNN algorithm is as follows:

[0058] S1: Set the parameters K and the excluded sample proportion γ of the model;

[0059] S2: Calculate the K-neighbor distance of each training sample in the training set according to the Euclidean distance formula, and the K-neighbor distance is the average value of the K-neighbor distances of the sample;

[0060] S3: The K-neighbor distances of all training samples in the training set are arranged in descending order;

[0061] S4: Find the K-neighbor distance of the sample located at the γxm sample in the arrangement, and set it as a threshold T;

[0062] S5: Calculate the K-neighbor distance of each test sample in the test set, if the K-neighbor distance of a test sample is less than the threshold T, it is the target class (blacklist customer).

[0063] In some embodiments of the present application, in order to find the optimal model parameters and optimize the effect of the model, the present application uses cross-validation to find the optimal parameters K and γ, and the goal of the model is to predict more accurate blacklist customers, so sensitivity is used as the evaluation index of the model, which represents the proportion of the model prediction that is positive (blacklist customer) among all results with true value positive. The calculation of sensitivity is based on the confusion matrix, and Table 2 shows the confusion matrix.

[0064] Table 2

[0065]

[0066] From Table 1, it can be seen that,

[0067] When the Sensitivity value is maximum, the corresponding parameters K and γ are the optimal parameters, and the model trained based on the parameters is the trained single-class blacklist recognition model.

[0068] Step S140: using the trained single-class blacklist recognition model to predict whether the to-be-tested customer belongs to the blacklist, and updating the historical blacklist according to the prediction result.

[0069] Based on the trained model, the customer to be tested is determined. If the customer belongs to this class, the customer is added to the blacklist to obtain an updated blacklist. The to-be-tested customer can be a non-blacklist customer that does not hit the blacklist, or a new customer. The features are extracted through the process of steps S110-S120, and then the trained model is directly used for determination.

[0070] From Figure 1 It can be seen that, by obtaining customer information of a plurality of customers, at least one knowledge graph is constructed according to the customer information, wherein the plurality of customers include blacklist customers and non-blacklist customers; customer features of each of the customers are extracted according to the knowledge graph, the customer features include graph embedding features, graph structure features, and customer risk features; then, a single-class blacklist recognition model is trained based on the customer features of the plurality of customers; finally, using the trained single-class blacklist recognition model, whether a to-be-tested customer belongs to the blacklist is predicted, and the historical blacklist is updated according to the prediction result. The present application combines knowledge graph, feature engineering, machine learning, artificial intelligence and other technical methods to identify hidden blacklist customers, automatically expand the blacklist, obtain a new blacklist, help enterprises to manage business risks and improve risk management capabilities, while reducing labor and time costs, and improve the accuracy of the blacklist.

[0071] Figure 3 A structural schematic diagram of a blacklist mining device according to an embodiment of the present application is shown, from Figure 3 It can be seen that the blacklist mining device 300 includes:

[0072] The acquisition unit 310 is configured to obtain customer information of a plurality of customers, and construct at least one knowledge graph according to the customer information, wherein the plurality of customers include blacklist customers and non-blacklist customers.

[0073] The extraction unit 320 is configured to extract customer features of each of the customers according to the knowledge graph, wherein the customer features include graph embedding features, graph structure features, and customer risk features.

[0074] The training unit 330 is configured to train the single-class blacklist identification model based on the customer features of the plurality of customers.

[0075] The prediction unit 340 is configured to use the trained single-class blacklist identification model to predict whether a to-be-tested customer belongs to a blacklist, and update the historical blacklist according to a prediction result.

[0076] In some embodiments of the present application, in the above device, the acquisition unit 310 is configured to acquire customer information of a plurality of customers, wherein the customer information includes at least one of customer personal information, historical underwriting risk data, historical claim risk data, credit risk data, and credit investigation data; convert the customer information into triple form data, wherein the triple form is [entity, relationship, entity] or [entity, attribute, attribute value]; wherein at least one of a person, an enterprise, and an insurance policy is taken as an entity, and the relationship includes at least one of a relationship between persons, an investment relationship between enterprises, and a subordinate relationship between a person and an insurance policy; draw a knowledge graph according to the triple form data, and store the knowledge graph in a graph database, wherein a first graph in the knowledge graph is a node, a second graph is an attribute set, and an edge between the first graphs is a relationship.

[0077] In some embodiments of the present application, in the above device, the acquisition unit 310 is configured to, for a customer, use a RandomWalk algorithm to generate a random walk path with a preset path length and taking the customer as a source point, and traverse the random walk path to obtain a node sequence of the customer; use the node sequences of a plurality of customers to train a skip-gram model; and use the trained skip-gram model to extract features of the knowledge graph, to obtain graph embedding features of each of the customers in a preset dimension.

[0078] In some embodiments of the present application, in the above device, the acquisition unit 310 is configured to extract the graph structure features of each customer through a graph algorithm interface provided by the graph database, the graph structure features including at least one of degree, in-degree, out-degree, eigenvector centrality, clustering coefficient, eccentricity, betweenness centrality, and closeness centrality; wherein the degree represents the sum of all edges connected to a node; the in-degree represents the sum of all edges pointing to a node; the out-degree represents all edges pointing to other nodes from a node; the eigenvector centrality represents the importance of a node based on its connections; the clustering coefficient represents the overall indication of node clustering and characterizes the embedding of a node in its neighbors; the eccentricity represents the distance from a given starting node to its most distant node; the betweenness centrality represents the frequency of a node appearing in the shortest paths in the network; and the closeness centrality represents the average distance from a given starting node to all other nodes.

[0079] In some embodiments of the present application, in the above device, the acquisition unit 310 is configured to extract the customer risk features of each customer from the second graph, the customer risk features including whether the customer is a dishonest customer, whether the overdue premium exceeds a threshold value, and risk label statistical data of the customer as an insured or a policyholder involved in a policy; wherein the risk label statistical data includes at least one of the number of times of signing a policy in reverse, the number of times of fraudulently claiming insurance by using an old high-end car, the number of times of reporting a case after canceling the policy at the end of the year, the number of times of abnormal claim time, the overdue premium rate, the maximum overdue days, and the overdue premium amount.

[0080] In some embodiments of the present application, in the above device, the training unit 330 is configured to construct a training set based on the customer features of at least part of the blacklist customers, and construct a test set based on the customer features of at least part of the blacklist customers and at least part of the non-blacklist customers; train the single-class blacklist identification model based on the training set to obtain a threshold T; perform cross-validation on the trained single-class blacklist identification model based on the test set with the threshold T as a reference and with sensitivity as an evaluation index, and perform back propagation according to the validation result to obtain the trained single-class blacklist identification model.

[0081] In some embodiments of the present application, in the above device, the single-class blacklist identification model is constructed based on an OC-KNN algorithm; the training unit 330 is configured to set the parameter K and the excluded sample proportion γ of the single-class blacklist identification model; determine the K-nearest neighbor distance of each sample in the training set according to the Euclidean distance formula, wherein the K-nearest neighbor distance is the average value of the K-nearest neighbor distances of a sample; arrange the K-nearest neighbor distances of all training samples in the training set in descending order; and set the K-nearest neighbor distance of the γxm sample in the arrangement result as the threshold T, wherein m is a preset value.

[0082] In some embodiments of the present application, in the above device, the training unit 330 is configured to determine the K-nearest neighbor distance of each test sample in the test set, and if the K-nearest neighbor distance of a test sample is less than the threshold T, the test sample is classified as the target class; determine the sensitivity of a plurality of test samples classified as the target class, and when the sensitivity is maximum, the corresponding parameters K and the excluded sample ratio γ are taken as the final single-class blacklist identification model of the single-class blacklist identification model.

[0083] It should be noted that the above blacklist mining device can implement the above blacklist mining method, and will not be described in detail.

[0084] Figure 4 is a structural schematic diagram of an electronic device according to an embodiment of the present disclosure. Please refer to Figure 4 At the hardware level, the electronic device includes a processor, and optionally further includes an internal bus, a network interface, and a memory. The memory can include a memory such as a random-access memory (RAM), and can also include a non-volatile memory such as at least one disk memory. Of course, the electronic device can also include other hardware required by the business.

[0085] The processor, the network interface, and the memory can be connected to each other through the internal bus, which can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, and a control bus. For ease of representation, Figure 4 In the figure, only one bidirectional arrow is used to represent the bus, but it does not mean that there is only one bus or only one type of bus.

[0086] The memory is used to store programs. Specifically, the program can include program code, and the program code includes computer operation instructions. The memory can include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0087] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs, and forms the blacklist mining device at the logical level. The processor executes the program stored in the memory, and is specifically configured to execute the above method.

[0088] The above as described in the present applicationFigure 3 The method performed by the blacklist mining apparatus disclosed in the embodiments can be applied to a processor or implemented by the processor. The processor can be an integrated circuit chip with processing capability. In the implementation process, each step of the method can be completed by integrated logic circuits or instructions in the form of software in the processor. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. It can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Each method, step and logic block diagram disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above blacklist mining method.

[0089] The electronic device can also perform the method performed by the blacklist mining apparatus in the method disclosed in the embodiments, and realize the functions of the blacklist mining apparatus in the method disclosed in the embodiments. The embodiments of the present application will not be repeated here. Figure 3 The electronic device can also perform the method performed by the blacklist mining apparatus in the method disclosed in the embodiments, and realize the functions of the blacklist mining apparatus in the method disclosed in the embodiments. The embodiments of the present application will not be repeated here. Figure 3 The electronic device can also perform the method performed by the blacklist mining apparatus in the method disclosed in the embodiments, and realize the functions of the blacklist mining apparatus in the method disclosed in the embodiments. The embodiments of the present application will not be repeated here.

[0090] The embodiments of the present application also propose a computer readable storage medium storing one or more programs, the one or more programs including instructions that, when executed by an electronic device including a plurality of application programs, can cause the electronic device to perform the method performed by the blacklist mining apparatus in the method disclosed in the embodiments, and specifically for executing the above method. Figure 3 The electronic device can also perform the method performed by the blacklist mining apparatus in the method disclosed in the embodiments, and realize the functions of the blacklist mining apparatus in the method disclosed in the embodiments. The embodiments of the present application will not be repeated here.

[0091] Those skilled in the art will appreciate that embodiments of the application can be readily used as software, hardware, or a combination of software and hardware. In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0092] The present application is described in reference to the flowchart illustrations and / or block diagrams according to the embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing system, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0093] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0094] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0095] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0096] The memory can include non-persistent memory, random access memory (RAM), and / or non-volatile memory, such as read only memory (ROM) or flash memory, among others. The memory is an example of computer-readable media.

[0097] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0098] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but also other elements not explicitly listed, or other elements inherent to such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising the element.

[0099] Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] The above only describes the embodiments of the present application and is not intended to limit the present application. Those skilled in the art can make various modifications and changes to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the scope of the claims of the present application.

Claims

1. A method for mining blacklists, characterized in that, include: Obtain customer information from multiple customers, and construct at least one knowledge graph based on the customer information, wherein the multiple customers include blacklisted customers and non-blacklisted customers; Customer features of each customer are extracted based on the knowledge graph. These customer features include: graph embedding features, graph structure features, and customer risk features. Based on the customer characteristics of the multiple customers, a single-class blacklist identification model is trained, wherein the single-class blacklist identification model is constructed based on the OC-KNN algorithm; A pre-trained single-class blacklist identification model is used to predict whether the customer to be tested belongs to the blacklist, and the historical blacklist is updated based on the prediction results. The training of the single-class blacklist identification model based on the customer characteristics of the multiple customers includes: A training set is constructed based on the customer characteristics of at least some blacklisted customers, and a test set is constructed based on the customer characteristics of at least some blacklisted customers and at least some non-blacklisted customers; Set the parameters K and the exclusion sample ratio γ of the single-class blacklist identification model; According to the Euclidean distance formula, the K nearest neighbor distance of each sample in the training set is determined, wherein the K nearest neighbor distance is the average of the K nearest neighbor distances of a sample; Sort the K-nearest neighbor distances of all training samples in the training set in descending order; The K-nearest neighbor distance of the sample located at the γ×m-th sample in the arrangement result is set as the threshold T, where m is a preset value; Determine the K-nearest neighbor distance of each test sample in the test set. If the K-nearest neighbor distance of a test sample is less than the threshold T, then it is assigned to the target class. The sensitivity of multiple test samples assigned to the target class is determined. The parameter K and the proportion of excluded samples γ corresponding to the maximum sensitivity are used as the final single-class blacklist recognition model.

2. The method according to claim 1, characterized in that, The step of obtaining customer information from multiple customers and constructing at least one knowledge graph based on the customer information includes: Obtain customer information from multiple customers, wherein the customer information includes at least one of the following: customer personal information, historical underwriting risk data, historical claims risk data, credit risk data, and credit reporting data; The customer information is converted into triplet data, wherein the triplet format is: [entity, relation, entity] or [entity, attribute, attribute value]; wherein at least one of person, enterprise, and insurance policy is used as an entity, and the relation includes at least one of the following: relationship between people, investment relationship between enterprises, and subordinate relationship between person and insurance policy; A knowledge graph is drawn based on the triplet data and stored in a graph database. In the knowledge graph, the first graph is a node, the second graph is an attribute set, and the edges between the first graphs are relationships.

3. The method according to claim 2, characterized in that, The step of extracting customer features for each customer based on the knowledge graph includes: For a customer, the RandomWalk algorithm is used to generate a random walk path with the customer as the source point and a preset path length, and the node sequence of the customer is obtained by traversing the random walk path. The skip-element model is trained using node sequences from multiple clients. The trained jump meta-model is used to extract features from the knowledge graph to obtain graph embedding features of each customer in a preset dimension.

4. The method according to claim 2, characterized in that, The step of extracting customer features for each customer based on the knowledge graph includes: The graph structure features of each client are extracted through the graph algorithm interface provided by the graph database. The graph structure features include at least one of the following: degree, in-degree, out-degree, feature vector centrality, clustering coefficient, eccentricity, betweenness center number, and compact center number. Wherein, the degree represents the sum of all edges connected to a node; the in-degree represents the sum of all edges pointing to a node; the out-degree represents all edges pointing from a node to other nodes; the eigenvector centrality represents the importance of a node based on its connectivity; the clustering coefficient represents the overall indication of node clustering and characterizes a node's embedding into its neighbors; the eccentricity represents the distance from a given starting node to its farthest node; the betweenness centrality measures the frequency with which a node appears on the shortest path in the network; and the compact centrality represents the average distance from a given starting node to all other nodes.

5. The method according to claim 2, characterized in that, The step of extracting customer features for each customer based on the knowledge graph includes: The risk characteristics of each customer are extracted from the second graph. These risk characteristics include: whether the customer is a defaulter, whether the overdue premiums exceed the threshold, and the risk label statistics of the customer as the insured or policyholder involved in the policy. The risk label statistics include at least one of the following: the number of backdated insurance policies, the number of insurance frauds using old high-end vehicles, the number of claims filed after cancellation at the end of the year, the number of abnormal accident times, the overdue premium rate, the maximum number of overdue days, and the overdue premium amount.

6. A blacklist detection device, characterized in that, The device includes: An acquisition unit is used to acquire customer information of multiple customers and construct at least one knowledge graph based on the customer information, wherein the multiple customers include blacklisted customers and non-blacklisted customers; The extraction unit is used to extract customer features of each customer based on the knowledge graph. The customer features include: graph embedding features, graph structure features, and customer risk features. The training unit is used to train a single-class blacklist identification model based on the customer characteristics of the multiple customers, wherein the single-class blacklist identification model is constructed based on the OC-KNN algorithm; The prediction unit is used to predict whether a customer to be tested belongs to the blacklist using a trained single-class blacklist recognition model, and to update the historical blacklist based on the prediction results. The training unit is used for: A training set is constructed based on the customer characteristics of at least some blacklisted customers, and a test set is constructed based on the customer characteristics of at least some blacklisted customers and at least some non-blacklisted customers; Set the parameters K and the exclusion sample ratio γ of the single-class blacklist identification model; According to the Euclidean distance formula, the K nearest neighbor distance of each sample in the training set is determined, wherein the K nearest neighbor distance is the average of the K nearest neighbor distances of a sample; Sort the K-nearest neighbor distances of all training samples in the training set in descending order; The K-nearest neighbor distance of the sample located at the γ×m-th sample in the arrangement result is set as the threshold T, where m is a preset value; Determine the K-nearest neighbor distance of each test sample in the test set. If the K-nearest neighbor distance of a test sample is less than the threshold T, then it is assigned to the target class. The sensitivity of multiple test samples assigned to the target class is determined. The parameter K and the proportion of excluded samples γ corresponding to the maximum sensitivity are used as the final single-class blacklist recognition model.

7. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of applications, cause the electronic device to perform the blacklist mining method according to any one of claims 1 to 5.

Images