Target gang identification method and device, electronic equipment, medium and program product

Abstract

The invention provides a target gang identification method and device, electronic equipment, a medium and a computer program product. The method and device can be applied to the technical field of artificial intelligence. The method comprises the steps that after authorization of a user to user information is obtained, a knowledge graph is constructed according to the user information, nodes of the knowledge graph are constructed according to account opening information, and edges of the knowledge graph are constructed according to transaction information; calculating the importance of each node in the knowledge graph according to the degrees of the nodes in the knowledge graph and the number of triangles formed by the edges; determining n target nodes in the knowledge graph according to the importance of each node in the knowledge graph; determining gang members of the target node according to the node attribute of each target node in the n target nodes, the node attribute of the node having the association relationship with the target node and the edge attribute of the association relationship; and identifying the target node and a gang member of the target node as a target gang.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, and more specifically, to a target gang identification method, device, electronic device, medium and computer program product. Background Art

[0002] In financial activities, gang members conceal the source of funds through frequent fund transactions, splitting, and aggregation. Different gang financial activities may present different transaction characteristics or regional characteristics. At present, in the process of monitoring transaction behaviors, financial institutions often monitor and warn single customers, pull transaction details, and manually judge and identify the gang members who may be involved. Due to the different levels of experience of business personnel, the completeness and accuracy of gang member identification vary greatly. As the means of gang financial activities become more and more diversified, on the one hand, it brings a huge workload to business personnel, and on the other hand, it brings challenges to the completeness and accuracy of gang member identification. Therefore, in financial activities, how to identify gang members has become a problem that technicians in this field need to solve urgently. Summary of the invention

[0003] In view of this, the present disclosure provides an efficient and accurate target gang identification method, device, electronic device, computer-readable storage medium and computer program product.

[0004] One aspect of the present disclosure provides a method for identifying a target group, comprising: obtaining authorization from a user for user information, wherein the user information includes account opening information and transaction information; after obtaining authorization from the user for the user information, constructing a knowledge graph based on the user information, wherein the nodes of the knowledge graph are constructed based on the account opening information, and the edges of the knowledge graph are constructed based on the transaction information; calculating the importance of each node in the knowledge graph based on the degree of the node and the number of triangles formed by the edges; determining n target nodes in the knowledge graph based on the importance of each node in the knowledge graph, wherein n is an integer greater than or equal to 1; determining the group members of the target node based on the node attributes of each target node among the n target nodes, the node attributes of nodes having an associated relationship with the target node, and the edge attributes of the associated relationship; and identifying the target node and the group members of the target node as a target group.

[0005] In some embodiments, the step of calculating the importance of each node according to the degree of the node and the number of triangles formed by the edges in the knowledge graph includes: randomly selecting an initial node in the knowledge graph, and determining a local network according to the initial node; calculating the importance of each node in the local network according to the degree of each node in the local network, the degree of each node's neighboring nodes, and the number of triangles formed by the edges between each node and its neighboring nodes and the remaining edges; and randomly selecting a node not covered by the local network in the knowledge graph as an initial node, and repeating the step of determining the local network according to the initial node until the importance of all nodes in the knowledge graph is calculated.

[0006] In some embodiments, the step of randomly selecting an initial node in the knowledge graph and determining a local network based on the initial node includes: randomly selecting an initial node in the knowledge graph and extracting neighbor nodes of the initial node; taking the node with the highest degree among the initial node and the neighbor nodes of the initial node as a key node; and determining a local network with the key node as the center, wherein the local network includes the key node, neighbor nodes and edges associated with the key node.

[0007] In some embodiments, the step of calculating the importance of each node in the local network according to the degree of each node in the local network, the degree of each node's neighboring nodes, and the number of triangles formed by the edge between each node and the neighboring nodes and the remaining edges includes: traversing each node in the local network, determining the g of the node being traversed i neighbor nodes, where the traversed local network includes m nodes, where m is an integer greater than or equal to 2, and g i is an integer greater than or equal to 1, i is an integer greater than or equal to 1 and less than or equal to m; according to the degree of the node being traversed, the degree of each of the neighboring nodes of the node, and the number of triangles formed by the edge between the node and each of the neighboring nodes and the remaining edges, the importance contribution of the edge between the node and each of the neighboring nodes is calculated; and according to the g i The importance contribution and the degree of the node being traversed are used to calculate the importance of the node being traversed.

[0008] In some embodiments, the step of determining n target nodes in the knowledge graph according to the importance of each of the nodes in the knowledge graph includes: calculating the network efficiency of the knowledge graph according to the distance between every two nodes in the knowledge graph and the number of nodes in the knowledge graph to obtain a first network efficiency; traversing each node in the knowledge graph, taking the node being traversed as a pre-selected node, and eliminating the pre-selected nodes in the knowledge graph to form an updated knowledge graph; calculating the network efficiency of the updated knowledge graph according to the distance between every two nodes in the updated knowledge graph and the number of nodes in the updated knowledge graph to obtain a second network efficiency; calculating the influence of the pre-selected node on the knowledge graph according to the first network efficiency and the second network efficiency; and determining the n target nodes in the knowledge graph according to the influence of the pre-selected node and the importance of the pre-selected node.

[0009] In some embodiments, the step of determining n target nodes in the knowledge graph based on the influence of the pre-selected nodes and the importance of the pre-selected nodes includes: taking the pre-selected nodes whose influence is greater than or equal to a preset influence threshold and whose importance is greater than or equal to a preset importance threshold as nodes to be determined, to obtain r nodes to be determined in the knowledge graph, wherein r is an integer greater than or equal to 1; taking the weighted sum of the influence and the importance of each node to be determined to obtain a comprehensive score; and sorting the comprehensive scores of the r nodes to be determined, and taking n of the nodes to be determined as n target nodes.

[0010] In some embodiments, the step of determining the gang members of the target node according to the node attributes of each target node among the n target nodes, the node attributes of the nodes associated with the target node, and the edge attributes of the associated relationship includes: determining the next-level associated nodes of each target node, matching the node attributes of the target node, the node attributes of each next-level associated node, and the edge attributes between the target node and the next-level associated node with a pre-built gang evaluation system library to obtain user feature scores and transaction feature scores, wherein the gang evaluation system library includes a mapping relationship between the matching degree between the user features of the node attributes of the upper and lower associated nodes and the user feature scores, and also includes a mapping relationship between the transaction features of the edge attributes of the upper and lower associated nodes and the transaction feature scores; calculating the target node according to the user feature scores and the transaction feature scores. The intimacy between the node and the next-level associated node; the next-level associated node whose intimacy is greater than or equal to a preset intimacy threshold is identified as a gang member; the next-level associated node of the gang member node is determined, and the node attributes of the gang member node, the node attributes of each of the next-level associated nodes and the edge attributes between the gang member node and the next-level associated node are matched with a pre-constructed gang evaluation system library to obtain a user feature score and a transaction feature score; according to the user feature score and the transaction feature score, the intimacy between the gang member node and the next-level associated node is calculated; the next-level associated node whose intimacy is greater than or equal to a preset intimacy threshold is identified as a gang member, and the step of determining the next-level associated node of the gang member node is repeated until all the gang member nodes have no next-level associated nodes.

[0011] In some embodiments, the user characteristics include at least one of industry, occupation, address, office address, account IP, login device IP, mobile phone number characteristics and information mastery level; and / or the transaction characteristics include at least one of transaction amount per unit time, number of transactions per unit time, transaction time, transaction location, transaction channel, product risk, quick inflow and outflow of funds, fund dispersion and fund concentration.

[0012] Another aspect of the present disclosure provides a target group identification device, including: an acquisition module, the acquisition module is used to execute the acquisition of user authorization for user information, wherein the user information includes account opening information and transaction information; a construction module, the construction module is used to execute the construction of a knowledge graph according to the user information after obtaining the user's authorization for the user information, wherein the nodes of the knowledge graph are constructed according to the account opening information, and the edges of the knowledge graph are constructed according to the transaction information; a calculation module, the calculation module is used to execute the calculation of the knowledge graph according to the degree of the nodes in the knowledge graph and the number of triangles formed by the edges. The importance of each of the nodes in the knowledge graph; a first determination module, the first determination module is used to determine n target nodes in the knowledge graph according to the importance of each of the nodes in the knowledge graph, wherein n is an integer greater than or equal to 1; a second determination module, the second determination module is used to determine the group members of the target node according to the node attributes of each target node in the n target nodes, the node attributes of the nodes having an association relationship with the target node, and the edge attributes of the association relationship; and an identification module, the identification module is used to identify the target node and the group members of the target node as a target group.

[0013] Another aspect of the present disclosure provides an electronic device, comprising one or more processors and one or more memories, wherein the memories are used to store executable instructions, and when the executable instructions are executed by the processors, the above-mentioned method is implemented.

[0014] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0015] Another aspect of the present disclosure provides a computer program product, comprising a computer program, wherein the computer program comprises computer executable instructions, and the instructions are used to implement the method as described above when executed.

[0016] According to the embodiments of the present disclosure, after obtaining the user's authorization for user information, a knowledge graph is constructed based on the user information; the importance of each node in the knowledge graph can be calculated based on the degree of the node in the knowledge graph and the number of triangles formed by the edges; the n target nodes in the knowledge graph can be determined based on the importance of each node in the knowledge graph; the group members of the target node can be determined based on the node attributes of each target node in the n target nodes, the node attributes of the nodes that have an association relationship with the target node, and the edge attributes of the association relationship; thus, the target node and the group members of the target node can be identified as the target group. Compared with manual judgment and identification of group members, the target group identification method disclosed in the present disclosure has a high degree of automation and intelligence, is simple and easy to implement, and saves computing resources. Using the method disclosed in the present disclosure to identify groups that conduct special financial activities can improve the efficiency and accuracy of identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 An exemplary system architecture to which the method and apparatus according to an embodiment of the present disclosure can be applied is schematically shown;

[0019] Figure 2 A flowchart of a target gang identification method according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart schematically shows a method for calculating the importance of each node according to the degree of the node and the number of triangles formed by the edges in the knowledge graph according to an embodiment of the present disclosure;

[0021] Figure 4 A flowchart schematically shows the steps of randomly selecting an initial node in a knowledge graph and determining a local network based on the initial node according to an embodiment of the present disclosure;

[0022] Figure 5 A schematic diagram of a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 6 A schematic diagram of a local network according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 7 A flowchart schematically illustrates the steps of calculating the importance of each node in a local network according to the degree of each node in the local network, the degree of each node's neighboring nodes, and the number of triangles formed by the edge between each node and the neighboring nodes and the remaining edges according to an embodiment of the present disclosure;

[0025] Figure 8 A flowchart schematically illustrates the steps of determining n target nodes in a knowledge graph according to the importance of each node in the knowledge graph according to an embodiment of the present disclosure;

[0026] Fig. 9 A flowchart schematically illustrates the steps of determining n target nodes in a knowledge graph according to the influence of pre-selected nodes and the importance of pre-selected nodes according to an embodiment of the present disclosure;

[0027] Fig.10 A flowchart schematically illustrates the steps of determining gang members of a target node according to the node attributes of each target node among n target nodes, the node attributes of nodes having an association relationship with the target node, and the edge attributes of the association relationship according to an embodiment of the present disclosure;

[0028] Fig.11 A block diagram of a target gang identification device according to an embodiment of the present disclosure is schematically shown;

[0029] Fig.12 A block diagram of an electronic device according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0030] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0031] In the technical solution of this disclosure, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and they do not violate public order and good morals. In the technical solution of this disclosure, the acquisition, collection, storage, use, processing, transmission, provision, disclosure and application of data are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and they do not violate public order and good morals.

[0032] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0033] When using expressions such as "at least one of A, B or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of the said features.

[0034] In financial activities, gang members conceal the source of funds through frequent fund transactions, splitting, and aggregation. Different gang financial activities may present different transaction characteristics or regional characteristics. At present, in the process of monitoring transaction behaviors, financial institutions often monitor and warn single customers, pull transaction details, and manually judge and identify the gang members who may be involved. Due to the different levels of experience of business personnel, the completeness and accuracy of gang member identification vary greatly. As the means of gang financial activities become more and more diversified, on the one hand, it brings a huge workload to business personnel, and on the other hand, it brings challenges to the completeness and accuracy of gang member identification. Therefore, in financial activities, how to identify gang members has become a problem that technicians in this field need to solve urgently.

[0035] The embodiments of the present disclosure provide a method, device, electronic device, computer-readable storage medium and computer program product for identifying a target group. The method for identifying a target group includes: obtaining authorization from a user for user information, wherein the user information includes account opening information and transaction information; after obtaining authorization from the user for the user information, constructing a knowledge graph according to the user information, wherein the nodes of the knowledge graph are constructed according to the account opening information, and the edges of the knowledge graph are constructed according to the transaction information; calculating the importance of each node in the knowledge graph according to the degree of the node in the knowledge graph and the number of triangles formed by the edges; determining n target nodes in the knowledge graph according to the importance of each node in the knowledge graph, wherein n is an integer greater than or equal to 1; determining the group members of the target node according to the node attributes of each target node in the n target nodes, the node attributes of the nodes having an association relationship with the target node and the edge attributes of the association relationship; and identifying the target node and the group members of the target node as the target group.

[0036] It should be noted that the target group identification method, device, electronic device, computer-readable storage medium and computer program product disclosed in the present invention can be used in the field of artificial intelligence technology, and can also be used in any field outside the field of artificial intelligence technology, such as the financial field. The field of the present invention is not limited here.

[0037] Figure 1 The exemplary system architecture 100 to which the target gang identification method, apparatus, electronic device, computer-readable storage medium and computer program product according to the embodiments of the present disclosure can be applied is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0038] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0039] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0040] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0041] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0042] It should be noted that the target group identification method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the target group identification device provided in the embodiment of the present disclosure can generally be set in the server 105. The target group identification method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the target group identification device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0043] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0044] The following will be based on Figure 1 The scene described by Figure 2 to Figure 10 The target group identification method of the embodiment of the present disclosure is described in detail.

[0045] Figure 2 The flowchart of the target group identification method according to the embodiment of the present disclosure is schematically shown.

[0046] like Figure 2 As shown, the target group identification method of this embodiment includes operations S210 to S260.

[0047] In operation S210, the user's authorization for user information is obtained, wherein the user information includes account opening information and transaction information. It is understandable that the user can be an individual user or a corporate user. The account opening information may include the user's name and the company name. The account opening information may also include the ID number, organization code, occupation, industry, address, office address, account IP, login device IP, mobile phone number, etc. The transaction information may include the transaction amount per unit time, the number of transactions per unit time, the transaction time, the place where the transaction occurs, the transaction channel, the product risk, and the quick in and out of funds.

[0048] In operation S220, after obtaining the user's authorization for the user information, a knowledge graph is constructed based on the user information, wherein the nodes of the knowledge graph are constructed based on the account opening information, and the edges of the knowledge graph are constructed based on the transaction information.

[0049] In operation S230, the importance of each node in the knowledge graph is calculated based on the degree of the node and the number of triangles formed by the edges in the knowledge graph.

[0050] As a possible implementation method, Figure 3As shown, operation S230 is a step of calculating the importance of each node according to the degree of the node and the number of triangles formed by the edges in the knowledge graph, including operations S231 to S233.

[0051] In operation S231, an initial node is randomly selected in the knowledge graph, and a local network is determined based on the initial node.

[0052] As a specific implementation method, Figure 4 As shown, operation S231 randomly selects an initial node in the knowledge graph, and determines the steps of the local network based on the initial node, including operations S2311 to S2313.

[0053] In operation S2311, an initial node is randomly selected in the knowledge graph, and neighbor nodes of the initial node are extracted.

[0054] In operation S2312, the node with the highest degree among the initial node and the neighboring nodes of the initial node is taken as a key node.

[0055] In operation S2313 , a local network is determined with the key node as the center, wherein the local network includes the key node, neighbor nodes and edges associated with the key node.

[0056] Below Figure 5 Taking the knowledge graph of as an example, operations S2311 to S2313 are described in detail. Assume that node V1 is randomly selected as the initial node, and the neighbor nodes of node V1 are nodes V2, V3, V4, V5 and V6. Calculate the degrees of V1, V2, V3, V4, V5 and V6, and rank the degrees of V1, V2, V3, V4, V5 and V6 in descending order. Assuming that the degree of V6 ranks first, node V6 is taken as the key node. With node V6 as the center, determine the local network as follows: Figure 6 Through operations S2311 to S2313, it is easy to randomly select an initial node in the knowledge graph and determine a local network based on the initial node.

[0057] In operation S232, the importance of each node in the local network is calculated according to the degree of each node in the local network, the degree of each node's neighbor node, and the number of triangles formed by the edge between each node and the neighbor node and the remaining edges.

[0058] As a possible implementation method, Figure 7 As shown, operation S232 is a step of calculating the importance of each node in the local network according to the degree of each node in the local network, the degree of each node's neighbor node, and the number of triangles formed by the edge between each node and the neighbor node and the remaining edges, including operations S2321 to S2323.

[0059] In operation S2321, each node in the local network is traversed to determine the g of the node being traversed. i neighbor nodes, where the traversed local network includes m nodes, where m is an integer greater than or equal to 2, and g i is an integer greater than or equal to 1, and i is an integer greater than or equal to 1 and less than or equal to m.

[0060] by Figure 6 Taking the local network in as an example, assume that the node being traversed is V6, and the three neighbor nodes of V6 are V1, V7 and V8 respectively.

[0061] In operation S2322, the importance contribution of the edge between the node and each neighbor node is calculated based on the degree of the node being traversed, the degree of each neighbor node of the node, and the number of triangles formed by the edge between the node and each neighbor node and the remaining edges.

[0062] In some examples, the importance contribution of the node being traversed can be obtained by formulas (1) to (4). Vp represents the node being traversed, Vq represents the neighbor node of Vp, and F Vp，Vq Indicates the importance contribution of the edge between Vp and Vq.

[0063]

[0064] L=(d p -m-1)·{d q -m-1) (4)

[0065] Among them, d p represents the degree of node Vp, d q represents the degree of node Vq, e pq represents the edge between Vp and Vq, and m represents the edge e pq The number of triangles formed by the remaining sides.

[0066] It is understandable that in Figure 6 In the local network, the degree of each node can be obtained. Therefore, the importance contribution of the edge between V6 and V1 can be calculated by the degree of V6, the degree of V1, and the number of triangles formed by the edge between V1 and V6 and the remaining edges (0), using formulas (1) to (4). The importance contribution of the edge between V6 and V7 can be calculated by the degree of V6, the degree of V7, and the number of triangles formed by the edge between V7 and V6 and the remaining edges (1), using formulas (1) to (4). The importance contribution of the edge between V6 and V8 can be calculated by the degree of V6, the degree of V8, and the number of triangles formed by the edge between V8 and V6 and the remaining edges (1), using formulas (1) to (4).

[0067] In operation S2323, according to g i The importance of the node being traversed is calculated by combining the importance contribution of the node and the degree of the node being traversed. The importance of the node can be expressed as Z Vp Indicates. Z Vp It can be obtained by formula (5).

[0068]

[0069] It is understandable that in Figure 6 In the local network, using formula (5), the importance of node V6 can be calculated through the degree of node V6, the importance contribution of the edge between V6 and V1, the importance contribution of the edge between V6 and V7, and the importance contribution of the edge between V6 and V8.

[0070] Operations S2321 to S2323 can facilitate calculation of the importance of each node in the local network based on the degree of each node in the local network, the degree of each node's neighboring nodes, and the number of triangles formed by the edges between each node and its neighboring nodes and the remaining edges.

[0071] In operation S233, a node not covered by the local network is randomly selected in the knowledge graph as an initial node, and the step of determining the local network based on the initial node is repeated until the importance of all nodes in the knowledge graph is calculated.

[0072] Operations S231 to S233 can facilitate calculation of the importance of each node based on the degree of the node and the number of triangles formed by the edges in the knowledge graph.

[0073] In operation S240, n target nodes in the knowledge graph are determined according to the importance of each node in the knowledge graph, where n is an integer greater than or equal to 1.

[0074] As a possible way to achieve this, Figure 8 As shown, operation S240 is a step of determining n target nodes in the knowledge graph according to the importance of each node in the knowledge graph, including operations S241 to S245.

[0075] In operation S241, the network efficiency of the knowledge graph is calculated according to the distance between every two nodes in the knowledge graph and the number of nodes in the knowledge graph to obtain a first network efficiency.

[0076] In some examples, the network efficiency can be obtained by formula (6). The network efficiency is represented by β.

[0077]

[0078] Among them, K pqRepresents the distance between every two nodes in the knowledge graph, V represents the nodes in the knowledge graph, and N represents the number of nodes in the knowledge graph.

[0079] In operation S242, each node in the knowledge graph is traversed, the node being traversed is used as a pre-selected node, and the pre-selected node is removed from the knowledge graph to form an updated knowledge graph.

[0080] In operation S243, the network efficiency of the updated knowledge graph is calculated according to the distance between every two nodes in the updated knowledge graph and the number of nodes in the updated knowledge graph to obtain the second network efficiency. It can be understood that the first network efficiency β1 of the knowledge graph without removing the pre-selected nodes can be obtained according to formula (6), and the second network efficiency β2 of the knowledge graph after removing the pre-selected nodes can be obtained according to formula (6).

[0081] In operation S244, the influence of the pre-selected nodes on the knowledge graph is calculated according to the first network efficiency and the second network efficiency. The influence of the eliminated nodes on the knowledge graph can be represented by λ. λ can be obtained by formula (7).

[0082]

[0083] In operation S245, n target nodes in the knowledge graph are determined according to the influence of the pre-selected nodes and the importance of the pre-selected nodes.

[0084] Among some possible implementations, Fig. 9 As shown, operation S245 determines the steps of n target nodes in the knowledge graph according to the influence of the pre-selected nodes and the importance of the pre-selected nodes, including operations S2451 to S2453.

[0085] In operation S2451, pre-selected nodes whose influence is greater than or equal to a preset influence threshold and whose importance is greater than or equal to a preset importance threshold are taken as nodes to be determined, and r nodes to be determined of the knowledge graph are obtained, where r is an integer greater than or equal to 1.

[0086] In operation S2452, the influence and importance of each to-be-determined node are weighted and summed to obtain a comprehensive score.

[0087] In operation S2453, the comprehensive scores of the r nodes to be determined are sorted, and n of the nodes to be determined are taken as n target nodes. In some examples, the comprehensive scores of the r nodes to be determined can be arranged in descending order, and the nodes to be determined corresponding to the top n comprehensive scores are taken as n nodes to be determined.

[0088] Operations S2451 to S2453 can facilitate the determination of n target nodes in the knowledge graph based on the influence of the pre-selected nodes and the importance of the pre-selected nodes.

[0089] Operations S241 to S245 can facilitate the determination of n target nodes in the knowledge graph based on the importance of each node in the knowledge graph.

[0090] In operation S250, the gang members of each target node among the n target nodes are determined according to the node attributes of the target node, the node attributes of the nodes having an association relationship with the target node, and the edge attributes of the association relationship.

[0091] As a possible way to achieve this, Fig.10 As shown, operation S250 is a step of determining the gang members of the target node according to the node attributes of each target node among n target nodes, the node attributes of the nodes associated with the target node, and the edge attributes of the associated relationship, including operations S251 to S256.

[0092] In operation S251, the next level associated nodes of each target node are determined, and the node attributes of the target node, the node attributes of each next level associated node, and the edge attributes between the target node and the next level associated node are matched with the pre-built group evaluation system library to obtain the user feature score and the transaction feature score, wherein the group evaluation system library includes the mapping relationship between the matching degree between the user features of the node attributes of the upper and lower level associated nodes and the user feature score, and also includes the mapping relationship between the transaction features of the edge attributes of the upper and lower level associated nodes and the transaction feature score. It can be understood that the next level associated node of the target node is the neighbor node directly connected to the target node. The node attributes can be characterized by the user features, and the edge attributes can be characterized by the transaction features.

[0093] In some specific examples, user characteristics may include at least one of industry, occupation, address, office address, account IP, login device IP, mobile phone number characteristics and information mastery. And / or, transaction characteristics may include at least one of transaction amount per unit time, number of transactions per unit time, transaction time, place of transaction, transaction channel, product risk, fast in and out of funds, fund dispersion and fund concentration. It is understandable that by comparing the user characteristic scores and transaction characteristic scores of "at least one of industry, occupation, address, office address, account IP, login device IP, mobile phone number characteristics and information mastery of the superiors and subordinates. And / or, at least one of transaction amount per unit time, number of transactions per unit time, transaction time, place of transaction, transaction channel, product risk, fast in and out of funds, fund dispersion and fund concentration" can be calculated to obtain a better representation effect of intimacy, which can more accurately and efficiently identify gang members.

[0094] In some examples, the group evaluation system library may be as shown in Table 1.

[0095] Table 1

[0096]

[0097]

[0098] The elements in Table 1 are all for illustration and should not be construed as limitations of the present disclosure.

[0099] In operation S252, the intimacy between the target node and the next level associated node is calculated based on the user feature score and the transaction feature score. The intimacy can be represented by Score and can be obtained by formula (8).

[0100]

[0101] Among them, C i represents the feature score of the i-th user, W i represents the weight corresponding to the feature score of the i-th user, T j represents the jth transaction feature score, W j Represents the weight corresponding to the j-th transaction feature score.

[0102] In operation S253, the next level associated nodes whose intimacy is greater than or equal to a preset intimacy threshold are identified as gang members.

[0103] In operation S254, the next-level associated nodes of the gang member node are determined, and the node attributes of the gang member node, the node attributes of each next-level associated node, and the edge attributes between the gang member node and the next-level associated nodes are matched with the pre-built gang evaluation system library to obtain user feature scores and transaction feature scores.

[0104] In operation S255, the intimacy between the gang member node and the next level associated node is calculated based on the user feature score and the transaction feature score.

[0105] In operation S256, the next level associated nodes with intimacy greater than or equal to a preset intimacy threshold are identified as gang members, and the step of determining the next level associated nodes of the gang member nodes is repeated until all gang member nodes have no next level associated nodes.

[0106] Operations S251 to S256 can facilitate the determination of the gang members of the target node according to the node attributes of each target node among n target nodes, the node attributes of the nodes associated with the target node, and the edge attributes of the associated relationship.

[0107] In operation S260, the target node and the gang members of the target node are identified as a target gang.

[0108] According to the target group identification method of the embodiment of the present disclosure, after obtaining the user's authorization for user information, a knowledge graph is constructed according to the user information; the importance of each node in the knowledge graph can be calculated according to the degree of the node in the knowledge graph and the number of triangles formed by the edges; according to the importance of each node in the knowledge graph, the n target nodes in the knowledge graph can be determined; according to the node attributes of each target node in the n target nodes, the node attributes of the nodes with an association relationship with the target node, and the edge attributes of the association relationship, the group members of the target node can be determined; thus, the target node and the group members of the target node can be identified as the target group. Compared with manual judgment and identification of group members, the target group identification method disclosed in the present disclosure has a high degree of automation and intelligence, is simple and easy to implement, and saves computing resources. Using the method disclosed in the present disclosure to identify groups that conduct special financial activities can improve the efficiency and accuracy of identification.

[0109] The target group identification method according to the embodiment of the present disclosure is described in detail below. It is worth noting that the following description is only an exemplary description and is not a specific limitation of the present disclosure.

[0110] At present, when financial institutions monitor transaction behaviors, they often monitor and warn single customers, obtain transaction details, and manually judge and identify the gang members who may be involved. Due to the different levels of experience of business personnel, the completeness and accuracy of gang member identification also vary greatly. As the means of special financial activities become increasingly diversified, on the one hand, it brings a huge workload to business personnel, and on the other hand, it also brings challenges to the complete identification of gang members. The system for executing the target gang identification method disclosed in the present invention includes a parameter setting module, a data acquisition module, a model training module, and a model deployment module.

[0111] The parameter module is mainly used by users to set key parameters in model training, including hyperparameters such as capital flow level, number of key nodes, thresholds, indicator weights, user authority control, and data acquisition period.

[0112] The data acquisition module is mainly used to obtain the initial capital flow diagram, node customer identity information, and node customer transaction information data generated through the knowledge graph.

[0113] The model training module is mainly used to iterate based on pre-set parameters and basic data through the DIL algorithm, network efficiency evaluation algorithm, traversal algorithm, etc., and can be deployed in monthly batches or quarterly batches (flexibly selected according to the model optimization cycle of the financial institution).

[0114] The model deployment module is used to output the model results and deploy them to daily gang member identification.

[0115] The process of identifying core nodes based on the DIL algorithm and network efficiency is as follows.

[0116] (1) Constructing a virtual network: Based on the generated capital flow graph, define the network topology as G = (V, E), the number of network nodes N = |V|, where V = {v1, v2, ..., v q}; The number of edges in the network l = |E|, where E = {e1, e2, ..., e p}.

[0117] (2) The process of node importance calculation is as follows.

[0118] i. Randomly select the initial node of the network in the capital flow graph and extract the set of all its adjacent nodes.

[0119] ii. Calculate the degree of all nodes, select the node with the largest degree as the key node, and extract all adjacent nodes with this node as the center to form the initial network G.

[0120] iii. Calculate the importance I of each node in the local network.

[0121] Definition pq For the edge between nodes Vp and Vq, define e pq Connectivity:

[0122] L=(d p -m-1)·(d q -m-1)

[0123] Among them, dp and dq represent the degrees of nodes Vp and Vq respectively, and m represents the edge e pq The number of triangles formed with the remaining sides.

[0124] Define edge e pq The substitutability index α, edge e pq Importance level I:

[0125]

[0126] iv. Calculate the importance Z of each node in the local network.

[0127] Define Vp to Vq connection pq The importance contribution F of node Vp and the importance Z of node Vp.

[0128]

[0129] v. Select the initial node from the uncovered nodes and repeat steps i-iv until all nodes are traversed.

[0130] (3) The process of network efficiency evaluation is as follows.

[0131] Define network efficiency β:

[0132]

[0133] where k pq Represents the shortest distance between Vp and Vq nodes, and N represents the number of nodes in the network.

[0134] For the above important nodes, we test them and define λ as the decrease in network efficiency after removing a node:

[0135]

[0136] (4) Key Node Sorting

[0137] Nodes with Z ≥ x and L ≥ y are identified as key nodes, and the importance of the nodes is ranked according to the weighted results of Z and L. The top n important nodes are selected, and the value of n can be set according to the risk preference of each financial institution.

[0138] The process of identifying suspicious gangs based on big data is as follows.

[0139] (1) Based on the identified key nodes, pull out their transaction details, transaction subject information, and transaction counterparty information.

[0140] (2) Constructing the evaluation system to identify node attributes is shown in Table 2.

[0141] Table 2

[0142]

[0143]

[0144] (3) Perform weighted calculation on the first-tier counterparty and different dimension features of a key node and calculate its score: Score = C i ·W 1，i +T j ·W 2，j .

[0145] (4) If the cumulative score is greater than or equal to a threshold (which can be set differently according to the risk preferences of different financial institutions), the counterparty is classified as a gang member of key node 1. If the cumulative score is less than the threshold, the node is eliminated.

[0146] (5) Perform the calculations of (1) to (3) for all primary counterparties of the key node in a loop until all nodes are traversed.

[0147] (6) For the nodes that are gang members among the first-level counterparties, pull their transaction details and perform the loop calculations (1) to (3) on their next-level counterparties until all nodes are traversed.

[0148] (7) Perform the loop calculations of (1) to (5) for all key nodes until all important nodes are traversed.

[0149] (8) Take the union of all gang member nodes and output the result.

[0150] The parameter setting process is as follows.

[0151] In the parameter setting module, business personnel are supported to flexibly adjust the number of key nodes N, the importance of different suspicious features Wi,j, and thresholds x and y according to the different characteristics of different suspicious transactions suspected of involving crimes, so as to differentiate the different suspicious transaction behaviors.

[0152] Through the above method, the efficiency and effectiveness of financial institutions in identifying suspicious gangs can be achieved. Its key advantage is that when mining gang members based on massive data of customer information and transaction information, there are extremely high requirements for algorithm computing power and computer performance. The present disclosure first mines key nodes, and then starts from the key nodes and mines gang members based on transaction links, which effectively improves the efficiency of mining gang members. Through the DIL algorithm, local network information mining based on core nodes can effectively improve the algorithm execution efficiency and reduce the algorithm execution time. Different from the traditional suspicious transaction identification method based on transaction information mining, the present disclosure comprehensively considers identity information and transaction information in the process of building an indicator system, further expands the information source, and improves the identification effect of gang members. The number of nodes, indicator weights, etc. are configured through parameters to support flexible adjustment and reduce the model adjustment and version iteration cycle.

[0153] Based on the above target group identification method, the present disclosure also provides a target group identification device. Fig.11 The target gang identification device is described in detail.

[0154] Fig.11 The structure block diagram of the target group identification device according to the embodiment of the present disclosure is schematically shown.

[0155] The target group identification device includes an acquisition module 1, a construction module 2, a calculation module 3, a first determination module 4, a second determination module 5 and an identification module 6.

[0156] The acquisition module 1 is used to perform operation S210: obtaining the user's authorization for user information, wherein the user information includes account opening information and transaction information.

[0157] Construction module 2 is used to perform operation S220: after obtaining the user's authorization for user information, construct a knowledge graph based on the user information, wherein the nodes of the knowledge graph are constructed based on the account opening information, and the edges of the knowledge graph are constructed based on the transaction information.

[0158] The calculation module 3 is used to perform operation S230: calculate the importance of each node in the knowledge graph according to the degree of the node and the number of triangles formed by the edges in the knowledge graph.

[0159] The first determination module 4 is used to perform operation S240: determine n target nodes in the knowledge graph according to the importance of each node in the knowledge graph, where n is an integer greater than or equal to 1.

[0160] The second determination module 5 is used to perform operation S250: determine the gang members of each target node among the n target nodes according to the node attributes of the target node, the node attributes of the nodes associated with the target node, and the edge attributes of the associated relationship.

[0161] The identification module 6 is used to perform operation S260: identifying the target node and the gang members of the target node as a target gang.

[0162] According to some embodiments of the present disclosure, the calculation module includes: a first determination unit, a first calculation unit and a repetition unit.

[0163] The first determination unit is used to randomly select an initial node in the knowledge graph and determine a local network based on the initial node.

[0164] The first calculation unit is used to calculate the importance of each node in the local network according to the degree of each node in the local network, the degree of each node's neighbor node and the number of triangles formed by the edge between each node and the neighbor node and the remaining edges.

[0165] The repetition unit is used to randomly select nodes that are not covered by the local network in the knowledge graph as initial nodes, and repeatedly execute the steps of determining the local network based on the initial nodes until the importance of all nodes in the knowledge graph is calculated.

[0166] According to some embodiments of the present disclosure, the first determining unit includes an extracting element, a first determining element, and a second determining element.

[0167] The extraction component is used to randomly select an initial node in the knowledge graph and extract the neighbor nodes of the initial node.

[0168] The first determining element is used to take the node with the highest degree among the initial node and the neighboring nodes of the initial node as the key node.

[0169] The second determining element is used to determine a local network with the key node as the center, wherein the local network includes the key node, neighboring nodes and edges associated with the key node.

[0170] According to some embodiments of the present disclosure, the first computing unit includes a third determining element, a first computing element, and a second computing element.

[0171] The third determining element is used to traverse each node in the local network and determine the g of the node being traversed. i neighbor nodes, where the traversed local network includes m nodes, where m is an integer greater than or equal to 2, and g i is an integer greater than or equal to 1, and i is an integer greater than or equal to 1 and less than or equal to m.

[0172] The first calculation element is used to calculate the importance contribution of the edge between the node and each neighbor node according to the degree of the node being traversed, the degree of each neighbor node of the node, and the number of triangles formed by the edge between the node and each neighbor node and the remaining edges.

[0173] The second computing element is used to calculate the i The importance contribution and the degree of the node being traversed are used to calculate the importance of the node being traversed.

[0174] According to some embodiments of the present disclosure, the first determining module includes a second calculating unit, a forming unit, a third calculating unit, a fourth calculating unit and a second determining unit.

[0175] The second calculation unit is used to calculate the network efficiency of the knowledge graph according to the distance between every two nodes in the knowledge graph and the number of nodes in the knowledge graph to obtain the first network efficiency.

[0176] The formation unit is used to traverse each node in the knowledge graph, take the node being traversed as a pre-selected node, remove the pre-selected node in the knowledge graph, and form an updated knowledge graph.

[0177] The third calculation unit is used to calculate the network efficiency of the updated knowledge graph according to the distance between every two nodes in the updated knowledge graph and the number of nodes in the updated knowledge graph to obtain the second network efficiency.

[0178] The fourth calculation unit is used to calculate the influence of the pre-selected node on the knowledge graph according to the first network efficiency and the second network efficiency.

[0179] The second determination unit is used to determine n target nodes in the knowledge graph according to the influence of the pre-selected nodes and the importance of the pre-selected nodes.

[0180] According to some embodiments of the present disclosure, the second determining unit includes a fourth determining element, a third calculating element, and a sorting element.

[0181] The fourth determination element is used to select pre-selected nodes whose influence is greater than or equal to a preset influence threshold and whose importance is greater than or equal to a preset importance threshold as nodes to be determined, and obtain r nodes to be determined in the knowledge graph, where r is an integer greater than or equal to 1.

[0182] The third calculation element is used to perform a weighted summation of the influence and importance of each to-be-determined node to obtain a comprehensive score.

[0183] The sorting component is used to sort the comprehensive scores of the r to-be-determined nodes, and take n of the to-be-determined nodes as n target nodes.

[0184] According to some embodiments of the present disclosure, the second determination module includes a third determination unit, a fifth calculation unit, a first identification unit, a fourth determination unit, a sixth calculation unit, and a second identification unit.

[0185] The third determination unit is used to determine the next-level associated nodes of each target node, match the node attributes of the target node, the node attributes of each next-level associated node, and the edge attributes between the target node and the next-level associated nodes with a pre-constructed group evaluation system library to obtain user feature scores and transaction feature scores, wherein the group evaluation system library includes a mapping relationship between the matching degree between user features of node attributes of upper and lower associated nodes and user feature scores, and also includes a mapping relationship between transaction features of edge attributes of upper and lower associated nodes and transaction feature scores.

[0186] The fifth calculation unit is used to calculate the intimacy between the target node and the next level associated node according to the user feature score and the transaction feature score.

[0187] The first identification unit is used to identify the next level associated nodes whose intimacy is greater than or equal to a preset intimacy threshold as gang members.

[0188] The fourth determination unit is used to determine the next-level associated nodes of the gang member nodes, match the node attributes of the gang member nodes, the node attributes of each next-level associated node, and the edge attributes between the gang member nodes and the next-level associated nodes with the pre-built gang evaluation system library to obtain user feature scores and transaction feature scores.

[0189] The sixth calculation unit is used to calculate the intimacy between the gang member node and the next level associated node according to the user feature score and the transaction feature score.

[0190] The second identification unit is used to identify the next level associated nodes with intimacy greater than or equal to a preset intimacy threshold as gang members, and repeatedly execute the step of determining the next level associated nodes of the gang member nodes until all gang member nodes have no next level associated nodes.

[0191] According to the target group identification device 10 of the embodiment of the present disclosure, after obtaining the user's authorization for user information, a knowledge graph is constructed according to the user information; the importance of each node in the knowledge graph can be calculated according to the degree of the node in the knowledge graph and the number of triangles formed by the edges; according to the importance of each node in the knowledge graph, n target nodes in the knowledge graph can be determined; according to the node attributes of each target node in the n target nodes, the node attributes of the nodes with an associated relationship with the target node, and the edge attributes of the associated relationship, the group members of the target node can be determined; thus, the target node and the group members of the target node can be identified as the target group. Compared with manual judgment and identification of group members, the target group identification method disclosed in the present disclosure has a high degree of automation and intelligence, is simple and easy to implement, and saves computing resources. Using the method disclosed in the present disclosure to identify groups that conduct special financial activities can improve the efficiency and accuracy of identification.

[0192] In addition, according to an embodiment of the present disclosure, any multiple modules among the acquisition module 1, the construction module 2, the calculation module 3, the first determination module 4, the second determination module 5 and the identification module 6 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0193] According to an embodiment of the present disclosure, at least one of the acquisition module 1, the construction module 2, the calculation module 3, the first determination module 4, the second determination module 5 and the identification module 6 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware, or in an appropriate combination of any of them.

[0194] Alternatively, at least one of the acquisition module 1, the construction module 2, the calculation module 3, the first determination module 4, the second determination module 5 and the identification module 6 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0195] Fig.12A block diagram of an electronic device suitable for implementing the above method according to an embodiment of the present disclosure is schematically shown.

[0196] like Fig.12 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0197] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0198] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0199] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0200] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0201] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method of the embodiment of the present disclosure.

[0202] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0203] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0204] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0205] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0206] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0207] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0208] The embodiments of the present disclosure are described above. However, these embodiments are only for the purpose of illustration and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A target group identification method, characterized in that: include: Obtaining user authorization for user information, wherein the user information includes account opening information and transaction information; After obtaining the user's authorization for the user information, construct a knowledge graph according to the user information, wherein the nodes of the knowledge graph are constructed according to the account opening information, and the edges of the knowledge graph are constructed according to the transaction information; Calculate the importance of each node in the knowledge graph according to the degree of the node in the knowledge graph and the number of triangles formed by the edges; Determine n target nodes in the knowledge graph according to the importance of each of the nodes in the knowledge graph, where n is an integer greater than or equal to 1; Determine the gang members of each target node according to the node attributes of each target node among the n target nodes, the node attributes of the nodes associated with the target node, and the edge attributes of the associated relationship; and The target node and the gang members of the target node are identified as a target gang.

2. The target group identification method according to claim 1, characterized in that: The step of calculating the importance of each node according to the degree of the node in the knowledge graph and the number of triangles formed by the edges comprises: Randomly selecting an initial node in the knowledge graph, and determining a local network based on the initial node; Calculate the importance of each node in the local network according to the degree of each node in the local network, the degree of each node's neighbor node, and the number of triangles formed by the edge between each node and the neighbor node and the remaining edges; and In the knowledge graph, a node not covered by the local network is randomly selected as an initial node, and the step of determining the local network according to the initial node is repeatedly performed until the importance of all nodes in the knowledge graph is calculated.

3. The target group identification method according to claim 2, characterized in that: The step of randomly selecting an initial node in the knowledge graph and determining a local network according to the initial node comprises: Randomly select an initial node in the knowledge graph and extract neighbor nodes of the initial node; The node with the highest degree among the initial node and the neighboring nodes of the initial node is taken as a key node; and A local network is determined with the key node as the center, wherein the local network includes the key node, neighboring nodes and edges associated with the key node.

4. The target group identification method according to claim 2, characterized in that: The step of calculating the importance of each node in the local network according to the degree of each node in the local network, the degree of each node's neighboring node, and the number of triangles formed by the edge between each node and the neighboring node and the remaining edges comprises: Traverse each node in the local network and determine the g of the node being traversed i neighbor nodes, where the traversed local network includes m nodes, where m is an integer greater than or equal to 2, and g i is an integer greater than or equal to 1, i is an integer greater than or equal to 1 and less than or equal to m; Calculate the importance contribution of the edge between the node and each of the neighbor nodes according to the degree of the node being traversed, the degree of each of the neighbor nodes of the node, and the number of triangles formed by the edge between the node and each of the neighbor nodes and the remaining edges; and According to the g i The importance contribution and the degree of the node being traversed are used to calculate the importance of the node being traversed.

5. The target group identification method according to claim 1, characterized in that: The step of determining n target nodes in the knowledge graph according to the importance of each of the nodes in the knowledge graph comprises: Calculating the network efficiency of the knowledge graph according to the distance between every two nodes in the knowledge graph and the number of nodes in the knowledge graph to obtain a first network efficiency; Traversing each node in the knowledge graph, taking the node being traversed as a pre-selected node, and removing the pre-selected node from the knowledge graph to form an updated knowledge graph; Calculate the network efficiency of the updated knowledge graph according to the distance between every two nodes in the updated knowledge graph and the number of nodes in the updated knowledge graph to obtain a second network efficiency; Calculating the influence of the pre-selected node on the knowledge graph according to the first network efficiency and the second network efficiency; and According to the influence of the pre-selected nodes and the importance of the pre-selected nodes, n target nodes in the knowledge graph are determined.

6. The target group identification method according to claim 5, characterized in that: The step of determining n target nodes in the knowledge graph according to the influence of the pre-selected nodes and the importance of the pre-selected nodes includes: The preselected nodes whose influence is greater than or equal to a preset influence threshold and whose importance is greater than or equal to a preset importance threshold are taken as nodes to be determined, to obtain r nodes to be determined of the knowledge graph, where r is an integer greater than or equal to 1; Taking a weighted sum of the influence and the importance of each of the nodes to be determined to obtain a comprehensive score; and The comprehensive scores of the r nodes to be determined are sorted, and n of the nodes to be determined are taken as n target nodes.

7. The target group identification method according to claim 1, characterized in that: The step of determining the gang members of the target node according to the node attributes of each target node among the n target nodes, the node attributes of the nodes associated with the target node, and the edge attributes of the associated relationship comprises: Determine the next level associated node of each target node, match the node attribute of the target node, the node attribute of each next level associated node and the edge attribute between the target node and the next level associated node with a pre-built group evaluation system library, and obtain the user feature score and the transaction feature score, wherein the group evaluation system library includes the mapping relationship between the matching degree between the user features of the node attributes of the upper and lower level associated nodes and the user feature score, and also includes the mapping relationship between the transaction features of the edge attributes of the upper and lower level associated nodes and the transaction feature score; Calculating the intimacy between the target node and the next level associated node according to the user feature score and the transaction feature score; Identify the next level associated nodes whose intimacy is greater than or equal to a preset intimacy threshold as gang members; Determine the next level associated node of the group member node, match the node attribute of the group member node, the node attribute of each next level associated node and the edge attribute between the group member node and the next level associated node with a pre-built group evaluation system library, and obtain the user feature score and the transaction feature score; Calculating the intimacy between the group member node and the next level associated node according to the user feature score and the transaction feature score; The next level associated nodes whose intimacy is greater than or equal to a preset intimacy threshold are identified as gang members, and the step of determining the next level associated nodes of the gang member nodes is repeated until all the gang member nodes have no next level associated nodes.

8. The target group identification method according to claim 7, characterized in that: The user characteristics include at least one of industry, occupation, address, office address, account IP, login device IP, mobile phone number characteristics and information mastery level; and / or The transaction characteristics include at least one of the transaction amount per unit time, the number of transactions per unit time, the transaction time, the transaction location, the transaction channel, the product risk, the fast inflow and outflow of funds, the dispersion of funds and the concentration of funds.

9. A target group identification device, characterized in that: include: An acquisition module, the acquisition module is used to execute the acquisition of the user's authorization for the user information, wherein the user information includes account opening information and transaction information; A construction module, the construction module is used to execute, after obtaining the user's authorization for the user information, to construct a knowledge graph according to the user information, wherein the nodes of the knowledge graph are constructed according to the account opening information, and the edges of the knowledge graph are constructed according to the transaction information; A calculation module, the calculation module is used to calculate the importance of each node in the knowledge graph according to the degree of the node and the number of triangles formed by the edges in the knowledge graph; A first determination module, the first determination module is used to determine n target nodes in the knowledge graph according to the importance of each node in the knowledge graph, where n is an integer greater than or equal to 1; A second determination module, the second determination module is used to determine the gang members of the target node according to the node attributes of each target node among the n target nodes, the node attributes of the nodes having an association relationship with the target node, and the edge attributes of the association relationship; and An identification module, wherein the identification module is used to identify the target node and the group members of the target node as a target group.

10. An electronic device comprising: one or more processors; a storage device for storing one or more computer programs, The method is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images