Risk determination method and device, equipment and storage medium

Abstract

The invention provides a risk determination method and device, equipment and a storage medium, which can be applied to the technical field of information security, the technical field of finance or other related fields. The method comprises the following steps: acquiring initial transfer data related to asset transfer; performing information extraction on the initial transfer data to obtain target transfer data; importing the target transfer data into a graph database, and outputting an asset transfer knowledge graph; and determining each transfer record in the initial transfer data by using the asset transfer knowledge graph, and determining suspicious transfer records of different risk levels.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, financial technology or other related fields, and in particular to a risk determination method, apparatus, device, medium and program product. Background Art

[0002] In related technologies, transactions can be conducted through quick payment and other methods, making transactions more frequent and convenient. However, this also makes the asset transfer path more complicated, resulting in risks such as information leakage, and it is difficult to ensure the security of information during the transaction. During the transaction process, in order to ensure information security, the transaction situation needs to be supervised. However, in the current process of handling the transaction situation, due to the lack of some transaction information, the missing part of the information may lead to information security risks in the transaction process during the supervision of the transaction situation.

[0003] Therefore, how to quickly and effectively determine the transaction status to ensure information security during the transaction process is a technical problem that needs to be solved in related technologies. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a risk determination method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, there is provided a risk determination method, comprising:

[0006] Obtaining initial transfer data related to asset transfers;

[0007] Extract information from the initial transfer data to obtain the target transfer data;

[0008] Import the target transfer data into the graph database and output the asset transfer knowledge graph;

[0009] Using the asset transfer knowledge graph, each transfer record in the initial transfer data is judged to identify suspicious transfer records of different risk levels.

[0010] According to an embodiment of the present disclosure, information extraction is performed on the initial transfer data to obtain the target transfer data, including:

[0011] Perform text extraction on the initial transfer data to obtain the text extraction result;

[0012] According to the data characteristics of asset transfer records, construct an ontology architecture corresponding to the asset transfer knowledge graph; and

[0013] According to the ontology architecture, the text extraction results are extracted to obtain the target transfer data.

[0014] According to an embodiment of the present disclosure, the ontology architecture includes an ontology entity architecture and an ontology relationship architecture, and the target transfer data includes target entity data and target relationship data. According to the ontology architecture, the text extraction result is extracted to obtain the target transfer data, including:

[0015] According to the ontology entity architecture, entity extraction is performed on the text extraction results to obtain target entity data; and

[0016] According to the ontology relational architecture, relation extraction is performed on the text extraction results to obtain the target relational data.

[0017] According to an embodiment of the present disclosure, the asset transfer knowledge graph is used to judge each transfer record in the initial transfer data, and to determine suspicious transfer records of different risk levels, including:

[0018] For each transfer record in the initial transfer data, determine the user handover information corresponding to the transfer record based on the asset transfer knowledge graph;

[0019] When the amount of transferred assets between the transferor and the direct recipient in the user handover information is greater than the target threshold, the respective borrowing and lending situations of the transferor and the direct recipient are determined according to the user handover information to obtain a first determination result;

[0020] If the first determination result indicates that the transferor or the direct recipient has a loan situation, the transfer record is determined as a high-risk suspicious transfer record;

[0021] When the first determination result indicates that there is no loan situation between the transferor and the direct recipient, the transfer record is determined as a medium-risk suspicious transfer record.

[0022] According to an embodiment of the present disclosure, the risk determination method further includes:

[0023] Determining the asset transfer status of the direct recipient within a preset time period to obtain a second determination result; and

[0024] When the second determination result indicates that the direct recipient has transferred assets within a preset time limit, determination operations are performed on the transferred asset amounts, borrowing and lending conditions, and asset transfer conditions of the direct recipient and the indirect recipient.

[0025] According to an embodiment of the present disclosure, the risk determination method further includes:

[0026] Determine the users of the head-end account and the terminal account in the target asset transfer path determined by the target transfer record to obtain a third determination result, wherein the target transfer record represents a non-high-risk suspicious transfer record determined by performing determination operations on the amount of transferred assets, the borrowing and lending conditions, and the asset transfer conditions; and

[0027] When the third determination result indicates that the first account and the second account belong to the same user, the target transfer record is determined as a high-risk suspicious transfer record.

[0028] According to an embodiment of the present disclosure, the risk management method further includes:

[0029] Determine a handling strategy corresponding to each suspicious transfer record based on the risk level corresponding to each suspicious transfer record.

[0030] A second aspect of the present disclosure provides a risk determination device, comprising:

[0031] An acquisition module, used to obtain initial transfer data related to asset transfer;

[0032] An extraction module is used to extract information from the initial transfer data to obtain the target transfer data;

[0033] The output module is used to import the target transfer data into the graph database and output the asset transfer knowledge graph;

[0034] The judgment module is used to use the asset transfer knowledge graph to judge each transfer record in the initial transfer data and determine suspicious transfer records of different risk levels.

[0035] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above method.

[0036] The fourth aspect of the present disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above method.

[0037] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0038] According to the risk determination method, device, equipment, medium and program product provided by the present disclosure, information is extracted from the acquired initial transfer data related to the asset transfer to obtain target transfer data that is more relevant to the asset transfer, and the extracted target transfer data is imported into the graph database. As a result, the amount of transfer data imported into the graph database is reduced, the computer processing efficiency is improved, and the more relevant target transfer data is imported into the graph database, so that an accurate and effective asset transfer knowledge graph can be quickly obtained. Based on this, all information related to the transfer record can be obtained through the edges and nodes of the constructed asset transfer knowledge graph, so that the transfer record can be quickly and effectively judged to determine suspicious transfer records of different risk levels, reducing the information security risk in the transaction process caused by missing information, thereby improving the information security in the transaction process. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0040] Figure 1 The application scenario diagram of the risk determination method according to the embodiment of the present disclosure is schematically shown;

[0041] Figure 2 A flow chart schematically shows a risk determination method according to an embodiment of the present disclosure;

[0042] Figure 3 A flowchart for determining the risk level of a suspicious transfer record according to an embodiment of the present disclosure is schematically shown;

[0043] Figure 4 A schematic diagram of a suspicious transfer record monitor according to an embodiment of the present disclosure is schematically shown;

[0044] Figure 5 A schematic diagram schematically illustrates a risk determination method according to an embodiment of the present disclosure;

[0045] Figure 6 The flowchart of the information processing method according to the embodiment of the present disclosure is schematically shown;

[0046] Figure 7 A schematic diagram schematically shows a suspicious transfer record determination device according to an embodiment of the present disclosure;

[0047] Figure 8 A structural block diagram of a risk determination device according to an embodiment of the present disclosure is schematically shown; and

[0048] Fig. 9 A block diagram of an electronic device suitable for implementing a risk determination method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0049] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0050] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0051] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0052] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0053] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0054] In the process of implementing this disclosure, it is found that the current supervision and reporting of suspicious transactions is still mainly based on manual review, resulting in the loss of some transaction information and low processing efficiency. Therefore, how to quickly and effectively determine the transaction situation to ensure information security during the transaction process is a technical problem that needs to be solved in the relevant technology.

[0055] In order to at least partially solve the technical problems existing in the related art, an embodiment of the present disclosure provides a risk determination method, including: obtaining initial transfer data related to asset transfer; extracting information from the initial transfer data to obtain target transfer data; importing the target transfer data into a graph database and outputting an asset transfer knowledge graph; using the asset transfer knowledge graph to judge each transfer record in the initial transfer data and determine suspicious transfer records of different risk levels.

[0056] Figure 1 The application scenario diagram of the risk determination method according to an embodiment of the present disclosure is schematically shown.

[0057] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0058] The user may use at least one of the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0059] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0060] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0061] For example, the initial transfer data related to the asset transfer can be obtained through the server 105, and information can be extracted from the initial transfer data to obtain the target transfer data. The target transfer data is then imported into the graph database, and the asset transfer knowledge graph is output. Finally, the asset transfer knowledge graph is used to judge each transfer record in the initial transfer data to determine suspicious transfer records of different risk levels.

[0062] It should be noted that the risk determination method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the risk determination device provided in the embodiment of the present disclosure can generally be set in the server 105. The risk determination method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the risk determination device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0063] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0064] The following will be based on Figure 1 The scene described by Figure 2 to Figure 7 The risk determination method of the embodiment of the present disclosure is described in detail.

[0065] Figure 2 The flowchart of the risk determination method according to the embodiment of the present disclosure is schematically shown.

[0066] like Figure 2 As shown, the method 200 includes operations S210 to S240.

[0067] In operation S210, initial transfer data related to asset transfer is acquired.

[0068] According to an embodiment of the present disclosure, the initial transfer data may represent data related to asset transfer, and the data type of the initial transfer data may include: asset transfer bank account information, asset transfer account fund information, asset transfer account owner information, transferred asset amount, and asset transfer time.

[0069] According to an embodiment of the present disclosure, the above-mentioned initial transfer data can be obtained through a communication interface, and the initial transfer data can represent semi-structured data stored in a table or other form. In the case of data involving other banks, the initial transfer data related to the asset transfer can also be obtained through blockchain technology.

[0070] In operation S220, information is extracted from the initial transfer data to obtain target transfer data.

[0071] According to an embodiment of the present disclosure, since the obtained initial transfer data is semi-structured, it is necessary to extract information from the initial transfer data to obtain key data for subsequent construction of an asset transfer knowledge graph.

[0072] According to an embodiment of the present disclosure, the target transfer data may represent key data for subsequent construction of an asset transfer knowledge graph, and the data types included in the target transfer data are consistent with the data types included in the initial transfer data.

[0073] In operation S230, the target transfer data is imported into the graph database, and the asset transfer knowledge graph is output.

[0074] According to an embodiment of the present disclosure, the graph database may be Neo4j or other visual graph databases. The target transfer data is imported into the graph database, and the target transfer data can be converted into a node and edge data format that meets the requirements of the knowledge graph, thereby outputting an asset transfer knowledge graph.

[0075] According to the embodiments of the present disclosure, the asset transfer knowledge graph can represent the knowledge graph generated by the graph database with visualization display function. The asset transfer knowledge graph can be used to display information and mapping relationships related to various aspects of asset transfer, and can clearly and intuitively reflect the asset flow information of the starting point, end point and intermediate path of the asset transfer.

[0076] In operation S240, the asset transfer knowledge graph is used to judge each transfer record in the initial transfer data to determine suspicious transfer records of different risk levels.

[0077] According to the embodiments of the present disclosure, the structural relationship between asset transfer records can be quickly understood through the asset transfer knowledge graph, so that the risk level of each transfer record in the initial transfer data can be automatically determined by using the asset transfer knowledge graph. Among them, the risk level of suspicious transfer records can include: low risk, medium risk, high risk, etc.

[0078] According to an embodiment of the present disclosure, information is extracted from the acquired initial transfer data related to the asset transfer to obtain target transfer data that is more relevant to the asset transfer, and the extracted target transfer data is imported into the graph database. As a result, the amount of transfer data imported into the graph database is reduced, the computer processing efficiency is improved, and the more relevant target transfer data is imported into the graph database, so that an accurate and effective asset transfer knowledge graph can be quickly obtained. Based on this, all information related to the transfer record can be obtained through the edges and nodes of the constructed asset transfer knowledge graph, so that the transfer record can be quickly and effectively judged to determine suspicious transfer records of different risk levels, reducing the information security risk in the transaction process caused by missing information, thereby improving the information security in the transaction process.

[0079] According to an embodiment of the present disclosure, information extraction is performed on the initial transfer data to obtain target transfer data, including: performing text extraction on the initial transfer data to obtain text extraction results; constructing an ontology architecture corresponding to the asset transfer knowledge graph based on data characteristics of the asset transfer record; and extracting the text extraction results based on the ontology architecture to obtain target transfer data.

[0080] According to an embodiment of the present disclosure, text extraction may represent text extraction of initial transfer data based on a text extraction model, wherein the text extraction model may select TextRank (extractive text summarization algorithm).

[0081] According to an embodiment of the present disclosure, the text extraction model is used to extract text from the initial transfer data. Sentences can be first processed according to punctuation marks "," or "," and keyword text can be extracted from each sentence obtained after sentence processing according to parts of speech such as nouns and verbs.

[0082] For example, nouns in the text extraction results may include "user A" and "user B", and verbs may include "asset transfer out" and "asset transfer in".

[0083] According to the embodiments of the present disclosure, based on the data characteristics of asset transfer records, an ontology architecture corresponding to the asset transfer knowledge graph can be designed and constructed. The data characteristics of asset transfer records can represent the data types related to asset transfer records, which may include: entity categories, entity attributes, relationship categories, relationship attributes, etc.

[0084] According to an embodiment of the present disclosure, text extraction is performed on the initial transfer data to obtain a text extraction result, and the text extraction result is re-extracted according to the constructed ontology architecture to obtain target transfer data that can be used to construct an asset transfer knowledge graph. Since the initial transfer data is extracted twice, data that is irrelevant to the construction of the asset transfer knowledge graph can be reduced, making the obtained target transfer data more relevant to the asset transfer, so that an accurate and effective asset transfer knowledge graph can be quickly constructed based on the target transfer data.

[0085] According to an embodiment of the present disclosure, the text extraction result is extracted according to the ontology architecture to obtain the target transfer data, including: performing entity extraction on the text extraction result according to the ontology entity architecture to obtain the target entity data; performing relationship extraction on the text extraction result according to the ontology relationship architecture to obtain the target relationship data.

[0086] According to an embodiment of the present disclosure, the ontology architecture may include an ontology entity architecture and an ontology relationship architecture. The target transfer data may include target entity data and target relationship data.

[0087] Among them, entity categories may include user entity, bank account entity, enterprise entity, and asset transfer record entity; user entity may include user name, enterprise, and user number; bank account entity may include bank account number, account balance, loan status, and loan amount; enterprise entity may include enterprise name and enterprise number; asset transfer record entity may include transferred asset amount, transferred asset time, and transfer record number.

[0088] Among them, relationship categories may include holding accounts, affiliated enterprises, asset transfers out, asset transfers in, belonging to the same enterprise, and the existence of indirect asset transfers.

[0089] According to an embodiment of the present disclosure, the relationship head entity can represent the initiator of the corresponding relationship, and the relationship tail entity can represent the receiver of the corresponding relationship. The relationship head entity and the relationship tail entity can represent the direction mode of the relationship, that is, the relationship head entity can point to the relationship tail entity through the direction.

[0090] It should be noted that the entity categories and entity attributes involved in the embodiments of the present disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, and do not violate public order and good morals.

[0091] According to an embodiment of the present disclosure, the ontology entity architecture corresponding to the asset transfer knowledge graph may be as shown in Table 1.

[0092] Table 1

[0093]

[0094] It should be noted that the relationship categories, relationship head entities, relationship tail entities and relationship attributes involved in the embodiments of the present disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, and do not violate public order and good morals.

[0095] According to an embodiment of the present disclosure, the ontology relationship architecture corresponding to the asset transfer knowledge graph may be as shown in Table 2.

[0096] Table 2

[0097] Relationship Category Relationship Header Entity Relationship end entity Relationship properties Holding Account user Bank Account Account opening time Affiliated companies user enterprise Job Position Asset transfer out user Asset transfer records - Asset transfer Asset transfer records user - Belong to the same company user user Company number There is an indirect transfer of assets user user Indirect transfer record number

[0098] According to the embodiments of the present disclosure, according to the ontology entity architecture, that is, Table 1, the text extraction results can be subjected to entity extraction by combining manual supervision with the entity extraction model CRF+LSTM (sequence labeling + entity recognition) to obtain target entity data. According to the ontology relationship architecture, that is, Table 2, the text extraction results can be subjected to relationship extraction by combining manual supervision with the relationship extraction model SoftMax+BERT (linear classification + language representation) to obtain target relationship data between entities.

[0099] Among them, the combination of manual supervision and extraction model can be characterized as follows: first, data can be manually extracted as a training set to train the extraction model and obtain a trained extraction model; the trained extraction model is used to extract the text extraction results. The first extracted result may not be so accurate. For example, there may be more or fewer words. In this case, the extracted results need to be manually screened and purified, and then the extraction model is trained until the extraction accuracy of the retrained extraction model meets the requirements. There is no need to manually adjust the extraction results.

[0100] For example, the target entity data may include "12345678", and "12345678" represents the user ID data extracted from the text extraction result.

[0101] According to an embodiment of the present disclosure, the extracted target entity data and target relationship data are stored in a graph database to form a visual graph database to output an asset transfer knowledge graph.

[0102] According to an embodiment of the present disclosure, the target transfer data may include asset transfer bank account information, asset transfer account fund information, asset transfer account owner information, transferred asset amount, and asset transfer time.

[0103] According to an embodiment of the present disclosure, the asset transfer bank account information may include the bank account information of the asset transferor and the asset transferee and the association relationship between the transferor and the asset transferee.

[0104] It should be noted that the user names, accounts, counterparty account names, counterparty accounts and relationships involved in the embodiments of the present disclosure are all information and data authorized by the users or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, and do not violate public order and good customs.

[0105] For example, if the bank account information of the asset transferor A is XXX and the bank account information of the asset receiver B is YYY, then the corresponding bank account attribute of the customer with the user name A is set to XXX, and the bank account attribute of the customer with the user name B is set to YYY. The relationship between the customer with the user name A and the customer with the user name B is the asset transfer-in and transfer-out relationship. The extracted asset transfer bank account information can refer to Table 3.

[0106] Table 3

[0107] Username Account Opponent's Account Name Counterparty Account relation User A XXX User D YYY Asset transfer out User B XXX User E YYY Asset transfer User C XXX User F YYY Asset transfer out

[0108] According to an embodiment of the present disclosure, the asset transfer account fund information may include information such as the balance, loan status, etc. of the asset transferor and the recipient.

[0109] It should be noted that the user name, account, account balance, whether to borrow and the amount of borrowing involved in the embodiments of the present disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, and do not violate public order and good customs.

[0110] For example: The extracted asset transfer account fund information can refer to Table 4.

[0111] Table 4

[0112] Username Account Account Balance Whether to borrow Loan Amount User A XXX XXX yes XXX User B XXX XXX no XXX User C XXX XXX no XXX

[0113] According to an embodiment of the present disclosure, the asset transfer account owner information may include the account owner information of the asset transferor and the recipient, such as name, affiliated company, etc., as well as the association relationship between the user and the corresponding company.

[0114] It should be noted that the account holder information of the asset transferor and the recipient involved in the embodiments of the present disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, and do not violate public order and good morals.

[0115] In order to further improve the accuracy of matching users with their companies and avoid the problem of low system matching rate due to simple company names, the abbreviation information in the company name knowledge base can be further expanded. For users who do not provide the full company name in the household information, the company abbreviation can be used for further matching with the information in the company name knowledge base.

[0116] For example: The company to which the household owner Zhang provides is AB, which is not the full name of the company. By matching this abbreviation with the full name of the company in the company name knowledge base, the full name of the company corresponding to AB is obtained, namely, XX City ABC Co., Ltd.

[0117] According to an embodiment of the present disclosure, the amount of transferred assets can represent the specific amount of the asset transfer or the amount of the assessed value, which can be used to subsequently determine whether the amount of transferred assets belongs to a large amount or a small amount of funds, wherein large amounts of funds and small amounts of funds can represent the asset type attributes of the asset transfer relationship corresponding to the amount of transferred assets.

[0118] It should be noted that the user names, counterparty account names, relationships and amounts of transferred assets involved in the embodiments of the present disclosure are all information and data authorized by the users or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, and do not violate public order and good morals.

[0119] For example: Customer Zhang transfers RMB 300,000 to Customer Li, then the specific amount of the asset transfer is RMB 300,000; Customer Wang transfers a property in a certain place to Customer Li, and the market valuation is RMB 2,000,000, then the assessed value of the asset transfer is RMB 2,000,000.

[0120] For example: The amount of transferred assets extracted can refer to Table 5.

[0121] Table 5

[0122] Username Opponent's Account Name relation Amount of assets transferred User A User D Asset transfer out XXX User B User E Asset transfer XXX User C User F Asset transfer out XXX

[0123] According to an embodiment of the present disclosure, the asset transfer time can represent the time information of the asset transfer. For example, if the transfer time from customer A to user B is 6:30 pm on November 5, 2022, the transfer time attribute of the asset transfer from customer A to user B can be set to 202211051830.

[0124] It should be noted that the user names, counterparty account names, relationships and asset transfer times involved in the embodiments of the present disclosure are all information and data authorized by the users or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, and do not violate public order and good customs.

[0125] For example: The time of asset transfer can refer to Table 6.

[0126] Table 6

[0127] Username Opponent's Account Name relation Transfer asset time User A User D Asset transfer out 2010-2-1 09:00:00 User B User E Asset transfer 2010-3-1 09:00:00 User C User F Asset transfer out 2010-4-1 16:00:11

[0128] According to the embodiments of the present disclosure, the text extraction results are extracted according to the ontology entity architecture and the ontology relationship architecture respectively, so that the target entity data and target relationship data that are more relevant to the asset transfer can be obtained, avoiding the acquisition of data in the text extraction results that are irrelevant to the construction of the asset transfer knowledge graph, so that an accurate and effective asset transfer knowledge graph can be quickly constructed based on the target entity data and the target relationship data.

[0129] Figure 3 The flowchart of determining the risk level of a suspicious transfer record according to an embodiment of the present disclosure is schematically shown.

[0130] like Figure 3 As shown, the method 300 includes operations S310 to S340.

[0131] In operation S310, for each transfer record in the initial transfer data, user handover information corresponding to the transfer record is determined according to the asset transfer knowledge graph.

[0132] According to an embodiment of the present disclosure, the user handover information may include the transferred asset amount, loan status, and asset transfer status of the transferee and transferor involved in each transfer record in the initial transfer data.

[0133] According to the embodiments of the present disclosure, the asset transfer knowledge graph can be used to determine the user handover information corresponding to each transfer record, so as to be used for subsequent judgment and analysis of each transfer record and determine suspicious transfer records of different risk levels.

[0134] In operation S320, when the amount of transferred assets between the transferor and the direct recipient in the user handover information is greater than the target threshold, the respective borrowing and lending situations of the transferor and the direct recipient are determined based on the user handover information to obtain a first determination result.

[0135] According to an embodiment of the present disclosure, the target threshold may represent a pre-set financial threshold of the transferred assets. The direct recipient may represent the account to which the transferor directly transfers in the transfer record without the intervention of a third-party intermediate account.

[0136] According to the embodiments of the present disclosure, before determining whether the amount of transferred assets between the transferor and the direct recipient in the user handover information is greater than the target threshold, it can be determined whether the direct transfer parties of the transfer record belong to the same enterprise. If they belong to the same enterprise, mode 1 is entered; if they belong to different enterprises, mode 2 is entered. The direct transfer parties can represent the transferor and the direct recipient, and the recipient can represent the direct recipient and the indirect recipient.

[0137] According to the embodiments of the present disclosure, mode 1 can be characterized as follows: when the amount of transferred assets between the transferor and the direct recipient is greater than or equal to the target threshold, the transfer record is determined to be a large-amount transfer and is not passed, and it is necessary to determine the respective borrowing and lending situations of the transferor and the direct recipient; when the amount of transferred assets between the transferor and the direct recipient is less than the target threshold, it is a small-amount transfer, and the transfer record can be determined to be a regular transfer record and is passed, and it is not necessary to determine the respective borrowing and lending situations of the transferor and the direct recipient.

[0138] According to the embodiments of the present disclosure, mode 2 can be characterized as follows: when the amount of transferred assets between the transferor and the direct recipient is greater than or equal to the target threshold, it is a large-value transfer, and the transfer record can be determined as a medium-risk suspicious transfer record, which will not be passed, and it is necessary to determine the respective borrowing and lending situations of the transferor and the direct recipient; when the amount of transferred assets between the transferor and the direct recipient is less than the target threshold, it is a small-value transfer, and the transfer record can be determined as a low-risk suspicious transfer record, which will be passed, and it is not necessary to determine the respective borrowing and lending situations of the transferor and the direct recipient.

[0139] According to an embodiment of the present disclosure, when it is necessary to determine the respective borrowing and lending situations of the transferor and the direct recipient, a determination can be made based on the user handover information obtained from the transferred asset knowledge graph to obtain a first determination result.

[0140] In operation S330, when the first determination result indicates that the transferor or the direct recipient has a loan situation, the transfer record is determined as a high-risk suspicious transfer record.

[0141] According to an embodiment of the present disclosure, when the first determination result can indicate that the transferor or the direct recipient has a borrowing situation, the transfer record can be determined as a high-risk suspicious transfer record and rejected.

[0142] In operation S340, when the first determination result indicates that there is no loan situation between the transferor and the direct recipient, the transfer record is determined as a medium-risk suspicious transfer record.

[0143] According to an embodiment of the present disclosure, when the first determination result can indicate that neither the transferor nor the direct recipient has a borrowing situation, the transfer record can be determined as a medium-risk suspicious transfer record and passed.

[0144] According to the embodiments of the present disclosure, based on the asset transfer knowledge graph, the user handover information corresponding to each transfer record can be quickly determined, so that the risk level of each transfer record can be automatically determined based on the user handover information to determine suspicious transfer records of different risk levels, thereby improving the supervision efficiency and accurate verification effect of the superior regulatory authorities.

[0145] According to an embodiment of the present disclosure, the above-mentioned risk determination method also includes: judging the asset transfer situation of the direct recipient within a preset time period to obtain a second judgment result; when the second judgment result indicates that there is an asset transfer of the direct recipient within the preset time period, performing a judgment operation on the transferred asset amount, borrowing situation and asset transfer situation of the direct recipient and the indirect recipient.

[0146] According to an embodiment of the present disclosure, after determining the amount of transferred assets and the borrowing and lending status of the transferor and the direct recipient, it is also necessary to determine the asset transfer status of the direct recipient within a preset time limit.

[0147] Among them, the indirect recipient can represent the recipient with whom the direct recipient has an asset transfer, and the preset time limit is calculated from the time when the direct recipient receives the assets transferred by the transferor.

[0148] According to an embodiment of the present disclosure, when a direct recipient receives assets transferred by a transferor, it is determined whether the direct recipient transfers the assets within a preset time limit starting from the moment the direct recipient receives the transferred assets.

[0149] According to an embodiment of the present disclosure, when the second judgment result can represent that there is an asset transfer by the direct recipient within a preset time limit, an indirect asset transfer relationship can be set between the transferor and the indirect recipient of the transfer record, and the transferred asset amount, borrowing and lending situation and asset transfer situation of the direct recipient and the indirect recipient of the transfer record can be further judged, that is, the direct recipient is taken as the transferor and the indirect recipient is taken as the direct recipient, and the above operations S320 to S340 are performed.

[0150] According to an embodiment of the present disclosure, when the second determination result includes that there is no asset transfer by the direct recipient within a preset time limit, the determination results of the above operations S320 to S340 shall prevail.

[0151] For example, there is a transfer record in which employee A of company X first initiates a large transfer to employee B of the same company, and employee B initiates a large transfer to user C of another company who has a loan situation within a short period of time. There is a large transaction between employee A and employee B of the same company, and there is no loan situation between employee A and employee B; but employee B initiates a large transfer to user C of another company who has a loan situation within a short period of time, then the transfer records involving employee A, employee B and employee C can be determined as high-risk suspicious transfer records.

[0152] For example, there is a transfer record in which employee A of company X first initiates a large transfer to employee B of the same company. Employee B does not transfer any assets within a preset time limit. The transfer record involving employee A and employee B can be determined as a medium-risk suspicious transfer record.

[0153] According to an embodiment of the present disclosure, after determining the transferred asset amount and borrowing and lending status of the transferor and the direct recipient, it is also necessary to determine the asset transfer status of the direct recipient. If the direct recipient has transferred assets within a preset time limit, the determination operation of the transferred asset amount, borrowing and lending status and asset transfer status of the direct recipient and the indirect recipient is performed to make the determination of the risk level of the transfer record more accurate.

[0154] According to an embodiment of the present disclosure, the above-mentioned risk determination method also includes: determining the users to which the head-end account and the end-end account in the target asset transfer path determined by the target transfer record belong, and obtaining a third determination result; when the third determination result indicates that the first account and the second account belong to the same user, determining the target transfer record as a high-risk suspicious transfer record.

[0155] According to an embodiment of the present disclosure, the target transfer record may represent a non-high-risk suspicious transfer record determined by executing a determination operation on the amount of transferred assets, borrowing and lending conditions, and asset transfer conditions, that is, after determining the transferred asset finance, borrowing and lending conditions, and asset transfer conditions, the determination result may be a transfer record of a regular transfer record, a low-risk suspicious transfer record, and a medium-risk suspicious transfer record.

[0156] According to an embodiment of the present disclosure, the target asset transfer path may represent an asset transfer path determined by the transferor, the direct recipient, and the indirect recipient involved in the target transfer record.

[0157] For the target asset transfer path, the first account can represent the transferor account of the target asset transfer path, and the last account can represent the final recipient account of the target asset transfer path.

[0158] According to an embodiment of the present disclosure, when the head-end account and the terminal account in the target asset transfer path belong to the same user, the target transfer record can be re-determined as a high-risk suspicious transfer record and not passed; when the head-end account and the terminal account in the target asset transfer path belong to different users, the target transfer record can be re-determined as a regular transfer record and passed.

[0159] For example, there is a target transfer record in which employee A of company X initiates a large transfer to user D of a different company. User D initiates a large transfer to other bank accounts of employee A within a certain period of time. Since the first and last accounts of the asset transfer path of the target transfer record belong to the same user, the target transfer record can be determined as a high-risk suspicious transfer record.

[0160] According to an embodiment of the present disclosure, for non-high-risk suspicious transfer records determined through determination operations of the amount of transferred assets, loan status, and asset transfer status, it is necessary to determine the users of the head-end account and the terminal account in the target asset transfer path, so as to make the determination of the risk level more accurate.

[0161] According to an embodiment of the present disclosure, the above-mentioned risk determination method further includes: determining a processing strategy corresponding to each suspicious transfer record according to the risk level corresponding to each suspicious transfer record.

[0162] According to an embodiment of the present disclosure, a processing strategy may represent different processing schemes set for suspicious transfer records of different risk levels.

[0163] For example: high-risk suspicious transfer records should be reported to the superior regulatory authorities in a timely manner for verification; medium-risk suspicious transfer records are only reported to the superior regulatory authorities periodically, or displayed in reports when the superior regulatory authorities actively inquire; low-risk suspicious transfer records are not compulsorily reported to the superior regulatory authorities, and are only displayed in reports when the superior regulatory authorities actively inquire.

[0164] According to the embodiments of the present disclosure, different processing strategies can be set for suspicious transfer records according to different risk levels, which can help superior regulatory authorities to quickly understand the risk level of asset transfer records to a certain extent, thereby improving the regulatory efficiency and accurate verification effect of superior regulatory authorities.

[0165] Figure 4 A schematic diagram of a suspicious transfer record monitor according to an embodiment of the present disclosure is schematically shown.

[0166] like Figure 4 As shown, the suspicious transfer record monitor 410 of this embodiment can obtain initial transfer data related to the asset transfer, including asset transfer bank account information 420, asset transfer account fund information 430, asset transfer account owner information 440, transferred asset amount 450 and asset transfer time 460.

[0167] Figure 5 A system diagram for implementing a risk determination method according to an embodiment of the present disclosure is schematically shown.

[0168] like Figure 5 As shown, the system 500 includes a communication interface 510, an information processing device 520, a suspicious transfer record determination device 530, and a suspicious transfer record marking device 540. The system 500 may represent a suspicious transfer record monitor 410, that is, the suspicious transfer record monitor 410 may include a communication interface 510, an information processing device 520, a suspicious transfer record determination device 530, and a suspicious transfer record marking device 540.

[0169] According to an embodiment of the present disclosure, initial transfer data can be received through the communication interface 510; the received initial transfer data can be sorted and processed through the information processing device 520, that is, the above-mentioned operations S220 and S230 are executed to obtain an asset transfer knowledge graph; in the suspicious transfer record determination device 530, the asset transfer knowledge graph can be used to monitor and determine suspicious transfer records, that is, the above-mentioned operation S240 is executed; in the suspicious transfer record marking device 540, the transfer record that triggers the suspicious transfer record condition can be marked as suspicious and reported to the superior regulatory department.

[0170] Figure 6 The flowchart of the information processing method according to the embodiment of the present disclosure is schematically shown.

[0171] like Figure 6 As shown, the method 600 includes operations S610 to S660.

[0172] In operation S610, text extraction is performed.

[0173] According to an embodiment of the present disclosure, text extraction is performed on semi-structured data.

[0174] In operation S620, an ontology framework is constructed.

[0175] In operation S630, entity extraction is performed.

[0176] In operation S640, relationship extraction is performed.

[0177] In operation S650, the extraction result is stored in the graph database.

[0178] In operation S660, the asset transfer knowledge graph is output.

[0179] According to an embodiment of the present disclosure, the method 600 may be executed in the information processing device 520 , and the operations S610 to S660 are equivalent to the operations S220 and S230 .

[0180] Figure 7 The following is a schematic diagram of a suspicious transfer record determination device according to an embodiment of the present disclosure.

[0181] like Figure 7 As shown, the suspicious transfer record determination device 710 of this embodiment may include a model definition module 720, a parameter preset module 730, an asset transfer path monitoring module 740 and a suspicious transfer record determination module 750, wherein the suspicious transfer record determination device 710 is equivalent to the above Figure 5 The suspicious transfer record determining device 540.

[0182] According to an embodiment of the present disclosure, the model definition module 720 can be used to define the meaning and function of the suspicious transfer record determination device 710, which can include defining the suspicious transfer record determination device 530 to mainly monitor the user handover information of the direct recipient and the indirect recipient of the transfer record, and determine whether the purpose of the transfer record is formal or whether it is used for private purposes based on the financial situation of the user's enterprise and the transfer account, and monitor suspicious transfer records that may be used for informal purposes, and report them to the superior regulatory department for verification in a timely manner.

[0183] According to an embodiment of the present disclosure, the parameter preset module 730 may be used to perform the above-mentioned operations S310 to S340, as well as an operation of determining the asset transfer status of the direct recipient within a preset time limit.

[0184] According to an embodiment of the present disclosure, when the parameter preset module 730 passes the characterization of the transfer record, the asset transfer path monitoring module 740 can be used to determine the users to whom the head-end account and the terminal account in the target asset transfer path determined by the target transfer record belong, and obtain a third determination result.

[0185] According to an embodiment of the present disclosure, the suspicious transfer record determination module 750 can be used to determine the processing strategy corresponding to each suspicious transfer record according to the risk level corresponding to each suspicious transfer record. Among them, different suspicious transfer record determination modules 750 can be set according to the enterprise. Based on the above risk determination method, the present disclosure also provides a risk determination device. Figure 8 The device is described in detail.

[0186] Figure 8 The structure block diagram of the risk determination device according to the embodiment of the present disclosure is schematically shown.

[0187] like Figure 8 As shown, the risk determination device 800 of this embodiment includes an acquisition module 810 , an extraction module 820 , an output module 830 and a determination module 840 .

[0188] The acquisition module 810 is used to acquire initial transfer data related to the asset transfer. In one embodiment, the acquisition module 810 can be used to perform the operation S210 described above, which will not be described in detail here.

[0189] The extraction module 820 is used to extract information from the initial transfer data to obtain the target transfer data. In one embodiment, the extraction module 820 can be used to perform the operation S220 described above, which will not be described in detail here.

[0190] The output module 830 is used to import the target transfer data into the graph database and output the asset transfer knowledge graph. In one embodiment, the output module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0191] The determination module 840 is used to use the asset transfer knowledge graph to determine each transfer record in the initial transfer data and determine suspicious transfer records of different risk levels. In one embodiment, the determination module 840 can be used to perform the operation S240 described above, which will not be repeated here.

[0192] According to an embodiment of the present disclosure, the extraction module 820 includes a first extraction submodule, a construction submodule and a second extraction submodule.

[0193] The first extraction submodule is used to perform text extraction on the initial transfer data to obtain a text extraction result.

[0194] The construction submodule is used to construct an ontology architecture corresponding to the asset transfer knowledge graph based on the data characteristics of the asset transfer record.

[0195] The second extraction submodule is used to extract the text extraction results according to the ontology architecture to obtain the target transfer data.

[0196] According to an embodiment of the present disclosure, the second extraction submodule includes a first extraction unit and a second extraction unit.

[0197] The first extraction unit is used to perform entity extraction on the text extraction result according to the ontology entity architecture to obtain target entity data.

[0198] The second extraction unit is used to perform relation extraction on the text extraction result according to the ontology relation architecture to obtain target relation data.

[0199] According to an embodiment of the present disclosure, the determination module 840 includes a first determination submodule, a first determination submodule, a second determination submodule, and a third determination submodule.

[0200] The first determination submodule is used to determine the user handover information corresponding to each transfer record in the initial transfer data according to the asset transfer knowledge graph.

[0201] The first determination submodule is used to determine the respective loan situations of the transferor and the direct recipient according to the user handover information when the amount of transferred assets between the transferor and the direct recipient in the user handover information is greater than the target threshold, and obtain a first determination result.

[0202] The second determination submodule is used to determine the transfer record as a high-risk suspicious transfer record when the first determination result indicates that the transferor or the direct recipient has a loan situation.

[0203] The third determination submodule is used to determine the transfer record as a medium-risk suspicious transfer record when the first determination result indicates that there is no loan situation between the transferor and the direct recipient.

[0204] According to an embodiment of the present disclosure, the determination module 840 further includes a second determination submodule and a third determination submodule.

[0205] The second determination submodule is used to determine the asset transfer status of the direct recipient within a preset time limit to obtain a second determination result.

[0206] The third determination submodule is used to perform determination operations on the transferred asset amount, loan status and asset transfer status of the direct recipient and the indirect recipient when the second determination result indicates that the direct recipient has transferred assets within a preset time limit.

[0207] According to an embodiment of the present disclosure, the determination module 840 further includes a fourth determination submodule and a fourth determination submodule.

[0208] The fourth determination submodule is used to determine the users to which the head-end account and the terminal account in the target asset transfer path determined by the target transfer record belong, and obtain a third determination result.

[0209] The fourth determination submodule is configured to determine the target transfer record as a high-risk suspicious transfer record when the third determination result indicates that the first account and the second account belong to the same user.

[0210] According to an embodiment of the present disclosure, the risk determination device 800 of this embodiment further includes a determination module.

[0211] The determination module is used to determine a processing strategy corresponding to each suspicious transfer record according to the risk level corresponding to each suspicious transfer record.

[0212] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 810, the extraction module 820, the output module 830 and the determination module 840 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 810, the extraction module 820, the output module 830 and the determination module 840 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the acquisition module 810, the extraction module 820, the output module 830 and the determination module 840 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0213] Fig. 9 A block diagram of an electronic device suitable for implementing a risk determination method according to an embodiment of the present disclosure is schematically shown.

[0214] like Fig. 9As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0215] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0216] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the input / output (I / O) interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0217] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0218] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0219] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the risk determination method provided by the embodiment of the present disclosure.

[0220] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0221] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0222] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0223] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0224] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0225] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0226] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A risk determination method comprising: Obtaining initial transfer data related to asset transfers; Extracting information from the initial transfer data to obtain target transfer data; Import the target transfer data into a graph database and output an asset transfer knowledge graph; The asset transfer knowledge graph is used to judge each transfer record in the initial transfer data to determine suspicious transfer records of different risk levels.

2. The method according to claim 1, wherein: The extracting information from the initial transfer data to obtain target transfer data includes: Performing text extraction on the initial transfer data to obtain a text extraction result; According to the data characteristics of the asset transfer record, construct an ontology architecture corresponding to the asset transfer knowledge graph; and The text extraction result is extracted according to the ontology architecture to obtain the target transfer data.

3. The method according to claim 2, wherein: The ontology architecture includes an ontology entity architecture and an ontology relationship architecture, the target transfer data includes target entity data and target relationship data, and the text extraction result is extracted according to the ontology architecture to obtain the target transfer data, including: According to the ontology entity architecture, performing entity extraction on the text extraction result to obtain the target entity data; and According to the ontology relationship architecture, relationship extraction is performed on the text extraction result to obtain the target relationship data.

4. The method according to claim 1, wherein: The using of the asset transfer knowledge graph to judge each transfer record in the initial transfer data and determine suspicious transfer records of different risk levels includes: For each transfer record in the initial transfer data, determining user handover information corresponding to the transfer record according to the asset transfer knowledge graph; When the amount of transferred assets between the transferor and the direct recipient in the user handover information is greater than the target threshold, the respective borrowing and lending situations of the transferor and the direct recipient are determined according to the user handover information to obtain a first determination result; If the first determination result indicates that the transferor or the direct recipient has a borrowing situation, determining the transfer record as a high-risk suspicious transfer record; When the first determination result indicates that there is no loan situation between the transferor and the direct recipient, the transfer record is determined as a medium-risk suspicious transfer record.

5. The method according to claim 4, further comprising: Determining the asset transfer status of the direct recipient within a preset time limit to obtain a second determination result; as well as When the second determination result indicates that the direct recipient has transferred assets within the preset time limit, determination operations are performed on the transferred asset amounts, borrowing and lending conditions, and asset transfer conditions of the direct recipient and the indirect recipient.

6. The method according to claim 5, further comprising: Determine the users of the head-end account and the terminal account in the target asset transfer path determined by the target transfer record to obtain a third determination result, wherein the target transfer record represents a non-high-risk suspicious transfer record determined by performing determination operations on the amount of transferred assets, the borrowing and lending conditions, and the asset transfer conditions; and When the third determination result indicates that the first account and the second account belong to the same user, the target transfer record is determined as a high-risk suspicious transfer record.

7. The method according to claim 1, further comprising: According to the risk level corresponding to each of the suspicious transfer records, a processing strategy corresponding to each of the suspicious transfer records is determined.

8. A risk determination device, comprising: An acquisition module, used to obtain initial transfer data related to asset transfer; An extraction module, used to extract information from the initial transfer data to obtain target transfer data; An output module, used to import the target transfer data into a graph database and output an asset transfer knowledge graph; The determination module is used to use the asset transfer knowledge graph to determine each transfer record in the initial transfer data and determine suspicious transfer records of different risk levels.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 7.

Images