Abnormal insurance claim identification method and device, electronic equipment and storage medium

Abstract

The invention discloses an abnormal insurance claim identification method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring a pre-constructed insurance case heterogeneous graph comprising each claim link node and a relation edge between the nodes, and acquiring a target node sequence of a to-be-identified case from the insurance case heterogeneous graph; correspondingly outputting an embedded vector for each node in the target node sequence by using the target neural network; calculating a comprehensive suspicious degree value for the target node sequence according to a predefined node suspicious degree index, and constructing a target sequence vector for the target node sequence according to the comprehensive suspicious degree value and the embedded vector of each node in the target node sequence; and calculating a local abnormal factor value for the target sequence vector, and performing abnormal identification on the to-be-identified case according to the local abnormal factor value. According to the technical scheme, the manual dependence is reduced, and the interpretability of an identification result is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, electronic device and storage medium for identifying abnormal insurance claims. Background Art

[0002] Traditional insurance claims can be settled by manually collecting relevant application materials or by using big data analysis technology. Taking the field of work-related injury insurance as an example, manual processing can collect application materials such as work-related injury application forms, hospital diagnosis certificates, hospital receipts, accident reports, on-site photos, etc., and then read and analyze them carefully to find possible inconsistencies or contradictions; the implementation of big data analysis technology usually uses complex algorithms and models, which are less interpretable and often difficult for non-professionals to understand. Summary of the invention

[0003] The present invention provides a method, device, electronic device and storage medium for identifying abnormal insurance claims, so as to reduce manual dependence and enhance the interpretability of identification results.

[0004] According to one aspect of the present invention, a method for identifying abnormal insurance claims is provided, the method comprising:

[0005] Obtain a pre-constructed insurance case heterogeneous graph, and obtain a target node sequence of a case to be identified from the insurance case heterogeneous graph, wherein the insurance case heterogeneous graph includes nodes of each claim settlement link and relationship edges between nodes;

[0006] Outputting an embedding vector corresponding to each node in the target node sequence using a target neural network, wherein the target neural network is obtained by pre-training a sample node sequence corresponding to each identified case in the insurance case heterogeneous graph;

[0007] Calculating a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index, and constructing a target sequence vector for the target node sequence according to the comprehensive suspicion value and an embedding vector of each node in the target node sequence;

[0008] A local anomaly factor value is calculated for the target sequence vector, and anomaly identification is performed on the case to be identified according to the local anomaly factor value.

[0009] According to another aspect of the present invention, there is provided a device for identifying abnormal insurance claims, the device comprising:

[0010] A node sequence acquisition module is used to acquire a pre-constructed insurance case heterogeneous graph and acquire a target node sequence of a case to be identified from the insurance case heterogeneous graph, wherein the insurance case heterogeneous graph includes nodes of each claim settlement link and relationship edges between nodes;

[0011] a node embedding vector output module, configured to output an embedding vector corresponding to each node in the target node sequence using a target neural network, wherein the target neural network is obtained by pre-training a sample node sequence corresponding to each identified case in the insurance case heterogeneous graph;

[0012] A sequence vector construction module, used to calculate a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index, and to construct a target sequence vector for the target node sequence according to the comprehensive suspicion value and an embedding vector of each node in the target node sequence;

[0013] The anomaly identification module is used to calculate the local anomaly factor value for the target sequence vector and perform anomaly identification on the case to be identified according to the local anomaly factor value.

[0014] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for identifying abnormal insurance claims described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for identifying abnormal insurance claims described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention obtains a pre-constructed insurance case heterogeneous graph, and obtains a target node sequence of the case to be identified from the insurance case heterogeneous graph, the insurance case heterogeneous graph includes nodes of each claim link and relationship edges between nodes; uses a target neural network to output an embedding vector corresponding to each node in the target node sequence, and the target neural network is obtained by pre-training the sample node sequence corresponding to each identified case in the insurance case heterogeneous graph; calculates a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index, and constructs a target sequence vector for the target node sequence according to the comprehensive suspicion value and the embedding vector of each node in the target node sequence; calculates a local anomaly factor value for the target sequence vector, and performs anomaly identification on the case to be identified according to the local anomaly factor value. Due to the technical means of constructing a heterogeneous graph, calculating an embedding vector, a sequence vector, and calculating a local anomaly factor value, the problem of excessive reliance on manual labor and poor interpretability of the results in the prior art is solved, the manual dependence is reduced, and the interpretability of the identification results is enhanced.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a method for identifying abnormal insurance claims provided by an embodiment of the present invention;

[0023] Figure 2 A flow chart of a complete abnormal behavior identification method in the field of work-related injury insurance is provided for an embodiment of the present invention;

[0024] Figure 3 A schematic diagram of the structure of an abnormal insurance claim identification device provided by an embodiment of the present invention;

[0025] Figure 4 It is a schematic diagram of the structure of an electronic device for implementing the method for identifying abnormal insurance claims according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Figure 1 The flowchart of a method for identifying abnormal insurance claims provided by an embodiment of the present invention is applicable to the case of identifying abnormal insurance claims. The method can be executed by an abnormal insurance claim identification device, which can be implemented in the form of hardware and / or software, and can be configured in a server. Figure 1 As shown, the method includes:

[0029] S110, obtaining a pre-constructed insurance case heterogeneous graph, and obtaining a target node sequence of the case to be identified from the insurance case heterogeneous graph, wherein the insurance case heterogeneous graph includes nodes of each claim settlement link and relationship edges between nodes.

[0030] The insurance case heterogeneous graph can be constructed based on a large amount of insurance claim case data collected, and its essence is a graph data structure with multiple node types or multiple edge types. The nodes of the insurance case heterogeneous graph can be various claim link nodes, and the edges of the insurance case heterogeneous graph can be node relationship edges of the claim link.

[0031] Taking the work injury insurance scenario as an example, the insurance case heterogeneous graph can be constructed in the following ways:

[0032] Step 1: Data preparation:

[0033] The data that needs to be prepared may include insurance data, work-related accident report data, claim record data, and medical diagnosis data.

[0034] Among them, insurance data may include information such as the insured person (individual or enterprise), insurance time, insurance details and insurance history (insurance type and insurance period, etc., which can be used to avoid repeated reporting of the same incident in different places). Work-related accident report data may include information such as the type of accident, the time and location of the accident. Claim record data may include information such as the claim amount, claim time and processing status. Medical diagnosis data may include information such as medical institution information, treating doctor information, diagnosis and treatment status. The above data sources can be collected from multiple units such as social insurance units, medical institutions, public security, etc., and secure encryption technology can be used for data aggregation and storage.

[0035] Step 2: Data preprocessing:

[0036] The aggregated insurance data can be subjected to data preprocessing operations, for example, data standardization processing of null values, missing values, and duplicate values.

[0037] Step 3: Construct a heterogeneous graph to form a heterogeneous graph of work-related injury insurance cases. The graph contains multiple types of nodes, each of which represents an entity. The edges between nodes represent the complex relationships between different nodes. The specific nodes and edges are constructed as follows:

[0038] (1) Node construction (each node can have a node ID and a node type label)

[0039] The node types can be:

[0040] ① Insured party node: The insured party can refer to individuals or enterprises that purchase work-related injury insurance and may file a work-related injury claim. In this heterogeneous graph, each insured party can be represented as an independent node.

[0041] ② Medical institution nodes: Medical institutions are places that provide medical services, diagnose and treat work-related injuries. Different medical institutions (such as hospitals, clinics, etc.) can serve as different types of nodes to distinguish their size, expertise, and reputation.

[0042] ③ Doctor node: Doctors are key figures in diagnosing and treating work-related injuries. In a heterogeneous graph, each doctor can be used as a node, and information such as their professional background, experience, and social relationship with the insured party can be used as node attributes.

[0043] ④Medical expense record node: Medical expense record may refer to the corresponding medical expenses incurred by the insured party after seeing a doctor, and may include information such as the symptoms of treatment and the corresponding treatment costs.

[0044] ⑤ Work-related accident node: A work-related accident can be a specific event that leads to a work-related injury claim. In a heterogeneous graph, each work-related accident can be regarded as a node, which contains key information such as the type of accident, time of occurrence, and location.

[0045] ⑥Claim record node: The claim record can be a detailed record of the claim filed by the insured party due to a work-related accident. Each claim record can be used as a node, containing information such as claim amount, claim time, and processing status.

[0046] ⑦ Work-related injury insurance node: Each work-related injury insurance can be used as a node, which can contain information such as payment amount and payment time.

[0047] (2) Side construction

[0048] ① Insurance participation relationship: The relationship between the insured party and the work-related injury insurance can be represented as an edge. This edge can contain additional information such as insurance type and insurance period.

[0049] ② Treatment relationship: When the insured party receives treatment at a medical institution, a treatment relationship is formed between the insured party and the medical institution. This edge can indicate which medical institution the insured party received treatment at, as well as the start and end time of the treatment.

[0050] ③ Diagnosis relationship: The doctor diagnoses the insured party’s work injury, forming a diagnosis relationship. This edge connects the insured party and the doctor, and can contain additional information such as the diagnosis result and diagnosis time.

[0051] ④ Claim association: The association between claim records and work-related accidents, insured parties, medical institutions and doctors can be represented as multiple edges. For example, a claim record can be connected to the corresponding work-related accident, indicating that the claim is based on the accident; the claim record can also be connected to the insured person, indicating that the claim is made by the insured person; at the same time, the claim record can also be connected to the medical institution and doctor who provided treatment to show the association between treatment and claim.

[0052] ⑤ Professional affiliation: The relationship between doctors and medical institutions is one of work unit affiliation, and this edge connects doctors and their medical institutions.

[0053] ⑥ Relationship between industrial accident and occurrence: The industrial accident node can be connected to the insured party, indicating that the insured party has had the industrial accident.

[0054] ⑦ Association of medical expense records: There is a direct connection between the medical expense records and the insured party and the doctor. The expense records generated by the doctor issuing relevant medical records belong to the insured party.

[0055] In this embodiment, the insurance case heterogeneous graph can be constructed by a party with abnormal insurance claim identification needs (for example, an insurance company or an insurance institution such as a human-set-up bureau), and the insurance case heterogeneous graph can be updated in time when there is a new insurance case. Therefore, all nodes corresponding to the case to be identified can be found in the insurance case heterogeneous graph to form a node sequence (i.e., the target node sequence) to determine whether the case to be identified has an insurance fraud risk.

[0056] In an optional implementation, obtaining a target node sequence of a case to be identified from a heterogeneous graph of insurance cases may include: obtaining a predefined wandering meta-path, a preset path starting point first condition, and a preset wandering end first condition; querying a first path starting point from the heterogeneous graph of insurance cases according to the preset path starting point first condition; wandering in the heterogeneous graph of insurance cases according to the first path starting point, the predefined wandering meta-path, and the preset wandering end first condition to obtain a target node sequence of the case to be identified.

[0057] Among them, the predefined walk meta-path can refer to a path that can capture the complex relationship between nodes in a heterogeneous graph, that is, to find the path corresponding to each node of the insurance case from the heterogeneous graph of insurance cases, for example, "insured party-work-related accident-medical institution-doctor-medical expense record-claim record", this meta-path directly connects the insured party, the work-related accident that occurred, the resulting medical institution and doctor, the corresponding medical expense record and the corresponding claim record. By analyzing this path, it can be checked whether each claim record matches its corresponding work-related accident and whether the description of the work-related accident is true and credible. For example, it can be checked whether the medical expense record is related to the work-related accident and the rationality of the medical expenses. If it is found that there are abnormal similarities between the work-related accident and claim records of multiple insured parties, or there are obvious falsehoods or contradictions in the description of the work-related accident, there may be insurance fraud. If it is found that there are abnormalities such as overtreatment, false diagnosis or unnecessary examinations in the medical expense record, there may be insurance fraud with inflated claim amounts.

[0058] The first condition of the preset path starting point may refer to a walking starting condition set in the walking process of the insurance case heterogeneous graph. The setting of the first condition of the preset path starting point may be used to ensure that the starting point of each random walk is the node of the designated insured party. For example, Zhang San is currently the object to be risk assessed. In order to find the related information of Zhang San's work-related injury insurance, "Zhang San" can be set in the first condition of the preset path starting point.

[0059] The preset first walking end condition may refer to a walking end condition set during the walking process of the insurance case heterogeneous graph, and the preset first walking end condition may be a judgment condition for determining to end the search for the work injury data related to "Zhang San". The preset first walking end condition may include a preset walking length (10-50 edges), walking times (10-100 times), or inability to continue walking, etc.

[0060] In this embodiment, it is possible to start according to the first condition of the preset path starting point, wander in the insurance case heterogeneous graph according to the predefined wandering meta-path, end the wandering according to the first condition of the preset wandering end, and obtain a target node sequence of at least one case to be identified corresponding to the insured party set in the first condition of the preset path starting point.

[0061] S120, using a target neural network to output an embedding vector corresponding to each node in a target node sequence, wherein the target neural network is obtained by pre-training a sample node sequence corresponding to each identified case in the insurance case heterogeneous graph.

[0062] Among them, the target neural network can be pre-trained in the following ways: obtain the second condition of the preset path starting point and the second condition of the preset walking end; query the second path starting point from the insurance case heterogeneous graph according to the second condition of the preset path starting point; walk in the insurance case heterogeneous graph according to the second path starting point, the predefined walking meta-path and the preset walking end second condition to obtain the sample node sequence corresponding to each identified case; use each sample node sequence to train the original neural network to obtain the target neural network.

[0063] The second condition of the preset path starting point can be used to ensure that the starting point of each random walk in the insurance case heterogeneous graph is a node of the insured party, and the condition may not include the insured party to be identified corresponding to the case to be identified. The second condition of the preset walk end can be a judgment condition for determining the end of searching for insurance data related to the non-insured party to be identified. The second condition of the preset walk end can include a preset walk length, a walk number, or an inability to continue walking, etc.

[0064] In this embodiment, it is possible to start according to the second condition of the preset path starting point, wander in the insurance case heterogeneous graph according to the predefined wandering meta-path, end the wandering according to the preset wandering end second condition, and obtain node sequences of multiple identified cases as sample node sequences, thereby training the original neural network according to the sample node sequence to obtain the target neural network.

[0065] Optionally, the original neural network is trained using each sample node sequence to obtain a target neural network, which may include: using the original neural network to obtain the context node of the current processing node in the current processing sample node sequence, and outputting a corresponding embedding vector for the current processing node based on the context node; using the current processing node and the corresponding context node as a pair of positive samples, and selecting corresponding negative samples for the positive samples, and updating the embedding vector corresponding to the current processing node by optimizing the likelihood ratio between the positive samples and the negative samples; and obtaining the target neural network when each current processing node in each sample node sequence has been learned using the original neural network.

[0066] The original neural network may be a network that performs embedding calculations on a heterogeneous graph of insurance cases, such as using a Skip-Gram model.

[0067] Specifically, for each node in the sample node sequence, it can be regarded as a central node, and the nodes around it can be regarded as context nodes (determined by the window size of the Skip-Gram model). The window size is an important hyperparameter, which defines how many nodes are selected on both sides of the current processing node (central node) as context nodes. Exemplarily, if the window size is k, then for the current processing node, the model will consider the k nodes before and after the node (a total of 2k nodes) as the context nodes related to it. Use the above training data as the input of the Skip-Gram model to train the model. After the training is completed, the model will output a low-dimensional embedding vector for each node in the sample node sequence. These embedding vectors can capture the structural and semantic information of the nodes in the network and can be used for subsequent analysis. In the training process, in order to improve the training efficiency and reduce the amount of calculation, negative sampling technology can be used: in the negative sampling process, for each central node and context node pair (positive sample), multiple non-existent node pairs (negative samples) are randomly selected as comparisons. The embedding vector is updated by optimizing the likelihood ratio between positive samples and negative samples.

[0068] In this embodiment, the target node sequence is input into the target neural network, and an embedding vector can be output for each node therein. The embedding vector of each node in the target node sequence can be a representation of the semantic information of each node. The embedding vector of each node can be expressed in combination with its context node, so that its structure and semantic information in the insurance case heterogeneous graph can be captured, and its semantic information can be accurately expressed in vector form.

[0069] S130, calculating a comprehensive suspicion value for the target node sequence according to the predefined node suspicion index, and constructing a target sequence vector for the target node sequence according to the comprehensive suspicion value and the embedding vector of each node in the target node sequence.

[0070] The predefined node suspicion index can be a parameter defined for the insurance claim process node to measure the abnormality of the node. For example, for the work-related injury insurance scenario, a suspicion index can be set for each insured party node (such as the frequency of work-related injury insurance declaration), a suspicion index can be set for each medical expense record node (abnormal medical expenses), and a suspicion index can be set for each work-related accident node (time of occurrence of unconventional accidents).

[0071] The comprehensive suspicion value may be the suspicion level of the target node sequence determined after comprehensively considering the suspicion levels of each node in the target node sequence.

[0072] In an optional implementation, calculating a comprehensive suspicion value for a target node sequence based on predefined node suspicion indicators may include: obtaining a predefined node suspicion indicator of a specified type of node in the target node sequence based on the occupational category corresponding to the case to be identified; quantifying the node suspicion indicator of the specified type of node in the target node sequence based on the quantization rules of the predefined node suspicion indicator; and determining the sum of the quantized values ​​of the node suspicion indicators of the specified type of nodes in the target node sequence as the comprehensive suspicion value of the target node sequence.

[0073] Among them, the target node sequence corresponds to the occupational category of the case to be identified, which has an impact on the definition standard of the node suspicion index, that is, the definition of suspicion index of different occupational categories is different. For example, the frequency of reporting work-related injury insurance for construction workers can be higher than that of office workers, and the time of occurrence of unconventional accidents for construction workers and general office workers may be staggered. In this embodiment, the occupational category corresponding to the case to be identified can refer to the national occupational classification standard and be divided into eight categories, such as (1) heads of state organs, party and mass organizations, enterprises, and institutions; (2) professional and technical personnel; (3) office staff and related personnel; (4) commercial and service personnel; (5) agricultural, forestry, animal husbandry, fishery, and water conservancy production personnel; (6) production and transportation equipment operators and related personnel; (7) soldiers; (8) others.

[0074] The quantification rules of the predefined node suspicion index may refer to the standardized rules for the suspicion index values ​​of nodes in the insurance claim process. For example, for the work injury insurance scenario:

[0075] (1) Insured party node (frequency of work-related injury insurance reporting): The multiple of the average number of reports can be calculated as a quantitative value. For example, if the average number of reports of all insured party nodes is 5 times / year, and the number of reports of the insured party node of the current case to be identified is 15 times / year, then the quantitative value of its reporting frequency can be 3 (15 / 5). It should be noted that if the average number of reports cannot be divided evenly, it can be rounded off by means such as rounding.

[0076] (2) Medical expense record node (abnormal medical expense): its standard score z-score value can be calculated as a quantitative value, that is, the standard deviation of all medical expense nodes is calculated, and then the average medical expense is calculated, and finally the difference between the medical expense of the current case to be identified and the average medical expense is calculated divided by the standard deviation. It should be noted that if the standard deviation cannot be divided evenly, it can also be rounded off by other means.

[0077] (3) Work-related accident node (time of occurrence of non-routine accidents): Regular working hours can be defined as 8:00 a.m. to 6:00 p.m. Within this time interval, the quantitative value is recorded as 0. Outside this time interval, the quantitative value is increased by 1 every hour. For example, at 12:00 p.m., its quantitative value is recorded as 6. For example, at 6:30 p.m., its quantitative value can be recorded as 0.5. It should be noted that if it is less than half an hour, it can be calculated as half an hour. If it is more than half an hour but less than one hour, it can be calculated as one hour.

[0078] The above quantification rules for pre-defined node suspicion index values ​​are merely examples and are not limited in this embodiment.

[0079] In this embodiment, based on the occupational category corresponding to the case to be identified, the predefined node suspicion index of the specified type of node in the corresponding target node sequence (for some nodes, the suspicion index may be defined or not, for example, the medical institution node or the doctor node) is obtained, and it is quantified according to the corresponding quantization rule, so as to add the quantized value of the suspicion index of each node in the target node sequence to obtain the comprehensive suspicion value of the target node sequence. It should be noted that for the node in the target node sequence that does not have a suspicion index defined, it may not participate in the calculation of the comprehensive suspicion value, or its suspicion value may be recorded as 0 before participating in the calculation of the comprehensive suspicion value.

[0080] In an optional implementation, constructing a target sequence vector for the target node sequence based on the comprehensive suspicion value and the embedding vector of each node in the target node sequence may include: concatenating the embedding vector of each node in the target node sequence, and multiplying the concatenated embedding vector by the comprehensive suspicion value to obtain the target sequence vector of the target node sequence.

[0081] For example, the target node sequence is represented as Q1 = {q1, q2, q3, q4, ..., q n}, where q represents each node in the target node sequence. Assuming that the embedding vector corresponding to each node is a, the node embedding vector of Q1 is {a1, a2, a3, a4, …, a n}, assuming that the comprehensive suspiciousness value calculated by the target node sequence Q1 is S, then the target sequence vector corresponding to the target node sequence Q1 is A=S(a1+a2+a3+a4+…+a n ).

[0082] S140, calculating a local anomaly factor value for the target sequence vector, and performing anomaly identification on the case to be identified according to the local anomaly factor value.

[0083] The local anomaly factor value may be a parameter used to measure the degree of anomaly of a target sequence vector in a set of multiple sequence vectors.

[0084] In an optional implementation, a local anomaly factor value is calculated for a target sequence vector, and an anomaly is identified for a case to be identified based on the local anomaly factor value. This may include: using a local anomaly factor algorithm to calculate a local anomaly factor value for a target sequence vector under the occupational category corresponding to the case to be identified; and identifying an anomaly for the case to be identified based on the local anomaly factor value.

[0085] In this embodiment, the abnormal degree identification standards of insurance cases under different occupational categories are different. Therefore, the sequence vectors of multiple other insurance cases under the occupational category (which can be the sequence vectors of multiple identified cases in the insurance case heterogeneous graph) can be combined, and the local anomaly factor algorithm can be used to calculate the distance from the target sequence vector to the k nearest neighbors in the sequence vector set under the occupational category, calculate the reachable distance, and calculate the local reachability density (LRD) of the target sequence vector, which is the inverse of the average reachable distance from the target sequence vector to its k-nearest neighbors, calculate the LOF of the target sequence vector as the ratio of the average LRD of its neighbors to its own LRD, and other operations to calculate the local anomaly factor value for the target sequence vector. The higher the value, the higher the possibility and risk value of abnormal claims in the target node sequence corresponding to the target sequence vector, and then the detailed data of each claim link node corresponding to the target node sequence can be found to assist in the investigation of abnormal insurance claims behavior.

[0086] The technical solution of the embodiment of the present invention obtains a pre-constructed insurance case heterogeneous graph, and obtains a target node sequence of the case to be identified from the insurance case heterogeneous graph, the insurance case heterogeneous graph includes nodes of each claim link and relationship edges between nodes; uses a target neural network to output an embedding vector corresponding to each node in the target node sequence, and the target neural network is obtained by pre-training the sample node sequence corresponding to each identified case in the insurance case heterogeneous graph; calculates a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index, and constructs a target sequence vector for the target node sequence according to the comprehensive suspicion value and the embedding vector of each node in the target node sequence; calculates a local anomaly factor value for the target sequence vector, and performs anomaly identification on the case to be identified according to the local anomaly factor value. Due to the technical means of constructing a heterogeneous graph, calculating an embedding vector, a sequence vector, and calculating a local anomaly factor value, the problem of excessive reliance on manual labor and poor interpretability of the results in the prior art is solved, the manual dependence is reduced, and the interpretability of the identification results is enhanced.

[0087] In order to enable those skilled in the art to better understand the method for identifying abnormal insurance claims in this embodiment, Figure 2 A flow chart of a complete abnormal behavior identification method in the field of work-related injury insurance is provided for an embodiment of the present invention.

[0088] Prepare insurance case data, clean it and perform other preprocessing operations before constructing a heterogeneous graph; use Metapath2Vec to perform graph embedding calculations on the heterogeneous graph; define the suspicion index of the node and formulate quantitative rules for the suspicion index; construct a sequence vector of the node sequence formed by walking the heterogeneous graph; calculate the local anomaly factor (LOF) value of the sequence vector according to the occupational category to which the node sequence belongs. For each occupational category, take the node sequence corresponding to the sequence vector with a higher LOF value, and determine that the work-related injury reporting case corresponding to the node sequence has a higher risk of insurance fraud.

[0089] Figure 3 A schematic diagram of the structure of an abnormal insurance claim identification device provided by an embodiment of the present invention. Figure 3 As shown, the device includes: a node sequence acquisition module 310, a node embedding vector output module 320, a sequence vector construction module 330 and an abnormality identification module 340. Among them:

[0090] A node sequence acquisition module 310 is used to acquire a pre-constructed insurance case heterogeneous graph and acquire a target node sequence of a case to be identified from the insurance case heterogeneous graph, wherein the insurance case heterogeneous graph includes nodes of each claim settlement link and relationship edges between nodes;

[0091] A node embedding vector output module 320, configured to output an embedding vector corresponding to each node in the target node sequence using a target neural network, wherein the target neural network is obtained by pre-training a sample node sequence corresponding to each identified case in the insurance case heterogeneous graph;

[0092] A sequence vector construction module 330 is used to calculate a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index, and to construct a target sequence vector for the target node sequence according to the comprehensive suspicion value and the embedding vector of each node in the target node sequence;

[0093] The anomaly identification module 340 is used to calculate a local anomaly factor value for the target sequence vector, and perform anomaly identification on the case to be identified according to the local anomaly factor value.

[0094] The technical solution of the embodiment of the present invention obtains a pre-constructed insurance case heterogeneous graph, and obtains a target node sequence of the case to be identified from the insurance case heterogeneous graph, the insurance case heterogeneous graph includes nodes of each claim link and relationship edges between nodes; uses a target neural network to output an embedding vector corresponding to each node in the target node sequence, and the target neural network is obtained by pre-training the sample node sequence corresponding to each identified case in the insurance case heterogeneous graph; calculates a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index, and constructs a target sequence vector for the target node sequence according to the comprehensive suspicion value and the embedding vector of each node in the target node sequence; calculates a local anomaly factor value for the target sequence vector, and performs anomaly identification on the case to be identified according to the local anomaly factor value. Due to the technical means of constructing a heterogeneous graph, calculating an embedding vector, a sequence vector, and calculating a local anomaly factor value, the problem of excessive reliance on manual labor and poor interpretability of the results in the prior art is solved, the manual dependence is reduced, and the interpretability of the identification results is enhanced.

[0095] Optionally, the node sequence acquisition module 310 may be specifically used for:

[0096] Obtain a predefined walking meta-path, a preset path starting point first condition, and a preset walking end first condition;

[0097] According to the first condition of the preset path starting point, query the first path starting point from the insurance case heterogeneous graph;

[0098] According to the first path starting point, the predefined walking meta-path and the preset walking end first condition, the insurance case heterogeneous graph is walked to obtain the target node sequence of the case to be identified.

[0099] Optionally, the target neural network may be pre-trained in the following manner:

[0100] Obtain the second condition of the preset path starting point and the second condition of the preset wandering end;

[0101] According to the second condition of the preset path starting point, query the second path starting point from the insurance case heterogeneous graph;

[0102] Walk in the insurance case heterogeneous graph according to the second path starting point, the predefined walking meta-path and the preset walking end second condition to obtain a sample node sequence corresponding to each identified case;

[0103] The original neural network is trained using each of the sample node sequences to obtain the target neural network.

[0104] Optionally, the abnormal insurance claim identification device may include a target neural network training module for:

[0105] Using the original neural network to obtain a context node of a current processing node in a current processing sample node sequence, and outputting a corresponding embedding vector for the current processing node according to the context node;

[0106] Taking the current processing node and the corresponding context node as a pair of positive samples, selecting a corresponding negative sample for the positive sample, and updating the embedding vector corresponding to the current processing node by optimizing the likelihood ratio between the positive sample and the negative sample;

[0107] When each current processing node in each sample node sequence is learned using the original neural network, the target neural network is obtained.

[0108] Optionally, the sequence vector construction module 330 may be specifically used for:

[0109] According to the occupation category corresponding to the case to be identified, obtaining a predefined node suspicion index of a specified type of node in the target node sequence;

[0110] Quantifying the node suspicion index of the specified type of nodes in the target node sequence according to the predefined node suspicion index quantification rule;

[0111] The sum of the node suspicion index quantization values ​​of the specified type of nodes in the target node sequence is determined as the comprehensive suspicion value of the target node sequence.

[0112] Optionally, the sequence vector construction module 330 may be further used for:

[0113] The embedding vectors of each node in the target node sequence are concatenated, and the concatenated result of the embedding vectors is multiplied by the comprehensive suspicion value to obtain a target sequence vector of the target node sequence.

[0114] Optionally, the abnormality identification module 340 may be specifically used for:

[0115] Under the occupational category corresponding to the case to be identified, using a local anomaly factor algorithm to calculate a local anomaly factor value for the target sequence vector;

[0116] Anomalies are identified for the case to be identified according to the local anomaly factor value.

[0117] The abnormal insurance claim identification device provided in the embodiment of the present invention can execute the abnormal insurance claim identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0118] Figure 4 A schematic diagram of an electronic device 400 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers or various forms of mobile devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0119] like Figure 4 As shown, the electronic device 400 includes at least one processor 401, and a memory connected to the at least one processor 401 in communication, such as a read-only memory (ROM) 402, a random access memory (RAM) 403, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 401 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 402 or the computer program loaded from the storage unit 408 to the random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 400 can also be stored. The processor 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0120] Multiple components in the electronic device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the electronic device 400 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0121] Processor 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of processor 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Processor 401 executes the various methods and processes described above, such as a method for identifying abnormal insurance claims.

[0122] In some embodiments, the method for identifying abnormal insurance claims may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 400 via the ROM 402 and / or the communication unit 409. When the computer program is loaded into the RAM 403 and executed by the processor 401, one or more steps of the method for identifying abnormal insurance claims described above may be performed. Alternatively, in other embodiments, the processor 401 may be configured to perform the method for identifying abnormal insurance claims in any other appropriate manner (e.g., by means of firmware).

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0125] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0130] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying abnormal insurance claims, characterized in that: include: Obtain a pre-constructed insurance case heterogeneous graph, and obtain a target node sequence of a case to be identified from the insurance case heterogeneous graph, wherein the insurance case heterogeneous graph includes nodes of each claim settlement link and relationship edges between nodes; Outputting an embedding vector corresponding to each node in the target node sequence using a target neural network, wherein the target neural network is obtained by pre-training a sample node sequence corresponding to each identified case in the insurance case heterogeneous graph; Calculating a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index, and constructing a target sequence vector for the target node sequence according to the comprehensive suspicion value and an embedding vector of each node in the target node sequence; A local anomaly factor value is calculated for the target sequence vector, and anomaly identification is performed on the case to be identified according to the local anomaly factor value.

2. The method according to claim 1, characterized in that Obtaining a target node sequence of a case to be identified from the insurance case heterogeneous graph includes: Obtain a predefined walking meta-path, a preset path starting point first condition, and a preset walking end first condition; According to the first condition of the preset path starting point, query the first path starting point from the insurance case heterogeneous graph; According to the first path starting point, the predefined walking meta-path and the preset walking end first condition, the insurance case heterogeneous graph is walked to obtain the target node sequence of the case to be identified.

3. The method according to claim 2, characterized in that The target neural network is pre-trained in the following way: Obtain the second condition of the preset path starting point and the second condition of the preset wandering end; According to the second condition of the preset path starting point, query the second path starting point from the insurance case heterogeneous graph; Walk in the insurance case heterogeneous graph according to the second path starting point, the predefined walking meta-path and the preset walking end second condition to obtain a sample node sequence corresponding to each identified case; The original neural network is trained using each of the sample node sequences to obtain the target neural network.

4. The method according to claim 3, characterized in that: The original neural network is trained using each of the sample node sequences to obtain the target neural network, including: Using the original neural network to obtain a context node of a current processing node in a current processing sample node sequence, and outputting a corresponding embedding vector for the current processing node according to the context node; Taking the current processing node and the corresponding context node as a pair of positive samples, selecting a corresponding negative sample for the positive sample, and updating the embedding vector corresponding to the current processing node by optimizing the likelihood ratio between the positive sample and the negative sample; When each current processing node in each sample node sequence is learned using the original neural network, the target neural network is obtained.

5. The method according to claim 1, characterized in that Calculating a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index includes: According to the occupation category corresponding to the case to be identified, obtaining a predefined node suspicion index of a specified type of node in the target node sequence; Quantifying the node suspicion index of the specified type of nodes in the target node sequence according to the predefined node suspicion index quantification rule; The sum of the node suspicion index quantization values ​​of the specified type of nodes in the target node sequence is determined as the comprehensive suspicion value of the target node sequence.

6. The method according to claim 1, characterized in that Constructing a target sequence vector for the target node sequence according to the comprehensive suspicion value and the embedding vector of each node in the target node sequence, including: The embedding vectors of each node in the target node sequence are concatenated, and the concatenated result of the embedding vectors is multiplied by the comprehensive suspicion value to obtain a target sequence vector of the target node sequence.

7. The method according to claim 1, characterized in that Calculating a local anomaly factor value for the target sequence vector, and performing anomaly identification on the case to be identified according to the local anomaly factor value, including: Under the occupational category corresponding to the case to be identified, using a local anomaly factor algorithm to calculate a local anomaly factor value for the target sequence vector; Anomalies are identified for the case to be identified according to the local anomaly factor value.

8. A device for identifying abnormal insurance claims, characterized in that: include: A node sequence acquisition module is used to acquire a pre-constructed insurance case heterogeneous graph and acquire a target node sequence of a case to be identified from the insurance case heterogeneous graph, wherein the insurance case heterogeneous graph includes nodes of each claim settlement link and relationship edges between nodes; a node embedding vector output module, configured to output an embedding vector corresponding to each node in the target node sequence using a target neural network, wherein the target neural network is obtained by pre-training a sample node sequence corresponding to each identified case in the insurance case heterogeneous graph; A sequence vector construction module, used to calculate a comprehensive suspicion value for the target node sequence according to a predefined node suspicion index, and to construct a target sequence vector for the target node sequence according to the comprehensive suspicion value and an embedding vector of each node in the target node sequence; The anomaly identification module is used to calculate the local anomaly factor value for the target sequence vector and perform anomaly identification on the case to be identified according to the local anomaly factor value.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for identifying abnormal insurance claims according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for identifying abnormal insurance claims according to any one of claims 1 to 7 when executed.

Images