Risk account mining method and device, electronic equipment, medium and program product

Abstract

The invention provides a risk account mining method and device based on a knowledge graph, electronic equipment, a medium and a computer program product. The method and the device can be used in the technical field of big data and finance. The method comprises the steps that authorization of a user to enterprise information is acquired, and the enterprise information comprises enterprise account information and enterprise relation information; after authorization of the user to the enterprise information is obtained, a knowledge graph is constructed according to the enterprise information, nodes of the knowledge graph are constructed according to the enterprise account information, and directed edges of the knowledge graph are constructed according to the enterprise relation information; a target starting point, a target ending point and m circulation paths between the target starting point and the target ending point are determined in the knowledge graph, and m is an integer larger than or equal to 1; calculating a risk characteristic value from the target starting point to the target ending point according to the m circulation paths; and determining risk accounts on m circulation paths from the target starting point to the target ending point according to the risk characteristic values.

Description

Technical Field

[0001] The present disclosure relates to the field of big data and financial technology, and more specifically, to a risk account mining method, device, electronic device, medium and computer program product based on knowledge graph. Background Art

[0002] my country has invested a lot of resources in engineering construction, education and medical fields, and risk cases such as misappropriation and transfer of funds are frequent and high-profile. The existing solutions of banks usually analyze the fund transactions of corporate accounts by combining business experience and early warning models, and use transaction data to analyze the correlation between accounts. The above solutions have problems such as low recognition accuracy and incomplete recognition, and cannot accurately and completely obtain the multi-level correlation of accounts and characterize the correlation between accounts. Summary of the invention

[0003] In view of this, the present disclosure provides a risk account mining method, device, electronic device, computer-readable storage medium and computer program product based on a knowledge graph that has high mining accuracy and comprehensive identification of risk accounts.

[0004] One aspect of the present disclosure provides a risk account mining method based on a knowledge graph, comprising: obtaining user authorization for enterprise information, wherein the enterprise information includes enterprise account information and enterprise relationship information; after obtaining the user's authorization for the enterprise information, constructing a knowledge graph according to the enterprise information, wherein the nodes of the knowledge graph are constructed according to the enterprise account information, and the directed edges of the knowledge graph are constructed according to the enterprise relationship information; determining a target starting point and a target end point in the knowledge graph, as well as m circulation paths between the target starting point and the target end point, wherein m is an integer greater than or equal to 1; calculating a risk characteristic value from the target starting point to the target end point according to the m circulation paths; and determining the risk accounts on the m circulation paths between the target starting point and the target end point according to the risk characteristic values.

[0005] According to the risk account mining method based on the knowledge graph of the embodiment of the present disclosure, the user's authorization for enterprise information is obtained; after obtaining the user's authorization for enterprise information, a knowledge graph is constructed based on the enterprise information; the target starting point and target end point, as well as m circulation paths between the target starting point and the target end point are determined in the knowledge graph; based on the m circulation paths, the risk characteristic value from the target starting point to the target end point is calculated; based on the risk characteristic value, the risk account on the m circulation paths between the target starting point and the target end point can be determined. The risk account mining method of the present disclosure is simple and easy to implement, and at the same time, it can accurately and completely obtain the multi-level association relationship of accounts and characterize the account association relationship. Therefore, the method of the present disclosure has high accuracy in mining risk accounts and comprehensive identification.

[0006] In some embodiments, the step of calculating the risk characteristic value from the target starting point to the target end point based on the m flow paths includes: determining the weight value of each of the m flow paths based on the path characteristics of each of the m flow paths; calculating the reachability probability of the target starting point reaching the target end point through each of the flow paths; and calculating the risk characteristic value from the target starting point to the target end point based on the weight values ​​and the reachability probabilities of the m flow paths.

[0007] In some embodiments, the step of determining the weight value of each of the m flow paths based on the path characteristics of each of the flow paths includes: determining the weight value of each of the m flow paths using a logistic regression classification model based on the path characteristics of each of the flow paths.

[0008] In some embodiments, the step of calculating the reachability probability of the target starting point reaching the target end point through each of the flow paths includes: calculating the reachability probability of the target starting point reaching the target end point through each of the flow paths according to a random walk algorithm.

[0009] In some embodiments, the path feature includes at least one of the number of nodes, node weights, and edge weights on the circulation path.

[0010] In some embodiments, the step of calculating the risk characteristic value from the target starting point to the target end point based on the weight values ​​and the reachable probabilities of the m circulation paths includes: multiplying the weight value and the reachable probability of each circulation path to obtain a sub-risk characteristic value of each circulation path; and adding the sub-risk characteristic values ​​of the m circulation paths to obtain the risk characteristic value from the target starting point to the target end point.

[0011] In some embodiments, the step of determining the risk accounts on the m circulation paths between the target starting point and the target end point based on the risk characteristic value includes: comparing the risk characteristic value with a pre-set risk threshold, and when the risk characteristic value is greater than or equal to the risk threshold, treating the accounts on the m circulation paths between the target starting point and the target end point corresponding to the risk characteristic value as risk accounts.

[0012] In some embodiments, when the risk characteristic value is greater than or equal to the risk threshold, the method further includes: comparing the weight value of each of the m flow paths with a pre-set weight threshold, and when the weight value is greater than or equal to the weight threshold, identifying the flow path as a critical path.

[0013] Another aspect of the present disclosure provides a risk account mining device based on a knowledge graph, comprising: an acquisition module, the acquisition module is used to execute the acquisition of user authorization for enterprise information, wherein the enterprise information includes enterprise account information and enterprise relationship information; a construction module, the construction module is used to execute the construction of a knowledge graph according to the enterprise information after obtaining the user's authorization for the enterprise information, wherein the nodes of the knowledge graph are constructed according to the enterprise account information, and the directed edges of the knowledge graph are constructed according to the enterprise relationship information; a first determination module, the first determination module is used to execute the determination of a target starting point and a target end point in the knowledge graph, and m circulation paths between the target starting point and the target end point, wherein m is an integer greater than or equal to 1; a calculation module, the calculation module is used to execute the calculation of the risk characteristic value from the target starting point to the target end point according to the m circulation paths; and a second determination module, the second determination module is used to execute the determination of the risk accounts on the m circulation paths between the target starting point and the target end point according to the risk characteristic value.

[0014] Another aspect of the present disclosure provides an electronic device, comprising one or more processors and one or more memories, wherein the memories are used to store executable instructions, and when the executable instructions are executed by the processors, the above-mentioned method is implemented.

[0015] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0016] Another aspect of the present disclosure provides a computer program product, comprising a computer program, wherein the computer program comprises computer executable instructions, and the instructions are used to implement the method as described above when executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 An exemplary system architecture to which the method and apparatus according to an embodiment of the present disclosure can be applied is schematically shown;

[0019] Figure 2 A flowchart of a risk account mining method based on a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A schematic diagram of a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4A flowchart schematically shows the steps of calculating the risk characteristic value from the target starting point to the target end point according to m circulation paths according to an embodiment of the present disclosure;

[0022] Figure 5 A flowchart schematically shows the steps of calculating the risk characteristic value from the target starting point to the target end point according to the weight values ​​and reachability probabilities of m circulation paths according to an embodiment of the present disclosure;

[0023] Figure 6 A flowchart of a risk account mining method based on a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 7 A block diagram of a risk account mining device based on a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0025] Figure 8 A block diagram of an electronic device according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0027] In the technical solution of this disclosure, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and they do not violate public order and good morals. In the technical solution of this disclosure, the acquisition, collection, storage, use, processing, transmission, provision, disclosure and application of data are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and they do not violate public order and good morals.

[0028] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0029] When using expressions such as "at least one of A, B or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of the said features.

[0030] my country has invested a lot of resources in engineering construction, education and medical fields, and risk cases such as misappropriation and transfer of funds are frequent and high-profile. The existing solutions of banks usually analyze the fund transactions of corporate accounts by combining business experience and early warning models, and use transaction data to analyze the correlation between accounts. The above solutions have problems such as low recognition accuracy and incomplete recognition, and cannot accurately and completely obtain the multi-level correlation of accounts and characterize the correlation between accounts.

[0031] The embodiments of the present disclosure provide a method, device, electronic device, computer-readable storage medium and computer program product for risk account mining based on knowledge graph. The method for risk account mining based on knowledge graph includes: obtaining user authorization for enterprise information, wherein enterprise information includes enterprise account information and enterprise relationship information; after obtaining user authorization for enterprise information, constructing a knowledge graph based on enterprise information, wherein nodes of the knowledge graph are constructed based on enterprise account information, and directed edges of the knowledge graph are constructed based on enterprise relationship information; determining a target starting point and a target end point in the knowledge graph, as well as m circulation paths between the target starting point and the target end point, wherein m is an integer greater than or equal to 1; calculating the risk characteristic value from the target starting point to the target end point based on the m circulation paths; and determining the risk accounts on the m circulation paths between the target starting point and the target end point based on the risk characteristic value.

[0032] It should be noted that the knowledge graph-based risk account mining method, device, electronic device, computer-readable storage medium and computer program product disclosed in the present invention can be used in the field of big data technology, and can also be used in any field outside the field of big data technology, such as the financial field. The field of the present invention is not limited here.

[0033] Figure 1 The exemplary system architecture 100 to which the risk account mining method, apparatus, electronic device, computer-readable storage medium and computer program product based on knowledge graph can be applied according to an embodiment of the present disclosure is schematically shown. It should be noted that: Figure 1What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0034] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0035] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0036] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0037] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the risk account mining method based on the knowledge graph provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the risk account mining device based on the knowledge graph provided in the embodiment of the present disclosure can generally be set in the server 105. The risk account mining method based on the knowledge graph provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the risk account mining device based on the knowledge graph provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0039] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0040] The following will be based on Figure 1 The scene described by Figure 2 to Figure 6 The risk account mining method based on knowledge graph in an embodiment of the present disclosure is described in detail.

[0041] Figure 2 The flowchart of the risk account mining method based on knowledge graph according to an embodiment of the present disclosure is schematically shown.

[0042] like Figure 2 As shown, the risk account mining method based on knowledge graph of this embodiment includes operations S210 to S250.

[0043] In operation S210, the user's authorization for enterprise information is obtained, wherein the enterprise information includes enterprise account information and enterprise relationship information. It is understandable that the enterprise account information may include at least one of the enterprise name, unified social credit code and organization code, and the enterprise account information may also include at least one of the legal representative, establishment time, registered capital and enterprise type. The enterprise relationship information may include at least one of the investment relationship, transfer relationship, holding relationship and guarantee relationship.

[0044] In operation S220, after obtaining the user's authorization for the enterprise information, a knowledge graph is constructed based on the enterprise information, wherein the nodes of the knowledge graph are constructed based on the enterprise account information, and the directed edges of the knowledge graph are constructed based on the enterprise relationship information.

[0045] In operation S230, the target starting point and the target end point are determined in the knowledge graph, as well as m flow paths between the target starting point and the target end point, where m is an integer greater than or equal to 1. It can be understood that the enterprise corresponding to the target starting point is the target research object of the enterprise relationship flow. The enterprise relationship stops spreading when it flows to the target end point. For example, in Figure 3 In the knowledge graph shown, node 1 is used as the target starting point and node 12 is used as the target end point. There are four flow paths from node 1 to node 12, namely, path 1-2-4-6-12, 1-2-4-7-8-12, 1-3-5-10-12 and 1-3-5-11-12.

[0046] In operation S240 , a risk characteristic value from the target starting point to the target end point is calculated according to the m circulation paths.

[0047] As a possible implementation method, Figure 4As shown, operation S240 is a step of calculating the risk characteristic value from the target starting point to the target end point according to m circulation paths, including operations S241 to S243.

[0048] In operation S241 , a weight value of each of the m circulation paths is determined according to a path feature of each circulation path.

[0049] In some specific examples, the step of determining the weight value of each circulation path in the m circulation paths according to the path characteristics of each circulation path in operation S241 includes operation S2411: determining the weight value of each circulation path in the m circulation paths by using a logistic regression classification model according to the path characteristics of each circulation path. Operation S2411 can facilitate the determination of the weight value of each circulation path in the m circulation paths according to the path characteristics of each circulation path.

[0050] In some examples, the path features may include at least one of the number of nodes, node weights, and edge weights on the circulation path. The node weights may be obtained based on the node attributes, and the edge weights may be obtained based on the edge attributes. The node attributes may include the number of affiliated enterprises of the legal representative, the time of establishment, the registered capital, and the type of enterprise, etc., and the edge attributes may include the investment amount, the transfer amount, the size of the holding enterprise, and the guarantee amount, etc. By making the path features include at least one of the number of nodes, node weights, and edge weights on the circulation path, the weight value of each circulation path in the m circulation paths may be more accurately calculated using the logistic regression classification model.

[0051] In operation S242 , the reachability probability of the target starting point reaching the target end point through each flow path is calculated.

[0052] In some specific examples, operation S242 of calculating the reachability probability of the target starting point reaching the target end point through each circulation path includes operation S2421: calculating the reachability probability of the target starting point reaching the target end point through each circulation path according to the random walk algorithm. Operation S2421 can facilitate the calculation of the reachability probability of the target starting point reaching the target end point through each circulation path.

[0053] It is understandable that random walk rules can be predefined, for example, in a directed graph (knowledge graph), a neighbor node is randomly selected from the current node for transfer. Starting from the target starting point, the node transfer is continuously performed according to the defined random walk rules until the node is transferred to the target end point, the number of times each node is visited is counted, and the access frequency of the node is recorded. According to the access frequency of the node, the reachability probability of the target starting point to reach the target end point through each flow path can be calculated.

[0054] In operation S243 , a risk characteristic value from the target starting point to the target end point is calculated according to the weight values ​​and reachability probabilities of the m circulation paths.

[0055] As some possible implementation methods, such as Figure 5 As shown, operation S243 is a step of calculating the risk characteristic value from the target starting point to the target end point according to the weight values ​​and reachability probabilities of the m circulation paths, including operation S2431 and operation S2432.

[0056] In operation S2431, the weight value and the reachability probability of each circulation path are multiplied to obtain a sub-risk characteristic value of each circulation path.

[0057] In operation S2432, the sub-risk characteristic values ​​of the m circulation paths are added together to obtain a risk characteristic value from the target starting point to the target end point.

[0058] Operations S2431 and S2432 can facilitate the calculation of the risk characteristic value from the target starting point to the target end point according to the weight values ​​and reachability probabilities of the m circulation paths.

[0059] Operations S241 to S243 can be used to easily calculate the risk characteristic value from the target starting point to the target end point according to the m circulation paths.

[0060] In operation S250, risk accounts on m circulation paths between the target starting point and the target end point are determined according to the risk characteristic values.

[0061] As a possible implementation method, operation S250 is a step of determining risk accounts on m circulation paths between a target starting point and a target end point according to risk characteristic values, including operation S251.

[0062] In operation S251, the risk characteristic value is compared with a preset risk threshold value. When the risk characteristic value is greater than or equal to the risk threshold value, the account on the m circulation paths between the target starting point and the target end point corresponding to the risk characteristic value is taken as a risk account. Operation S251 can facilitate the determination of the risk account on the m circulation paths between the target starting point and the target end point according to the risk characteristic value.

[0063] According to the risk account mining method based on the knowledge graph of the embodiment of the present disclosure, the user's authorization for enterprise information is obtained; after obtaining the user's authorization for enterprise information, a knowledge graph is constructed based on the enterprise information; the target starting point and target end point, as well as m circulation paths between the target starting point and the target end point are determined in the knowledge graph; based on the m circulation paths, the risk characteristic value from the target starting point to the target end point is calculated; based on the risk characteristic value, the risk account on the m circulation paths between the target starting point and the target end point can be determined. The risk account mining method of the present disclosure is simple and easy to implement, and at the same time, it can accurately and completely obtain the multi-level association relationship of accounts and characterize the account association relationship. Therefore, the method of the present disclosure has high accuracy in mining risk accounts and comprehensive identification.

[0064] According to some embodiments of the present disclosure, Figure 6 As shown, when the risk characteristic value is greater than or equal to the risk threshold, the risk account mining method based on the knowledge graph may further include operation S001.

[0065] In operation S001, the weight value of each circulation path in the m circulation paths is compared with a preset weight threshold value, and when the weight value is greater than or equal to the weight threshold value, the circulation path is identified as a critical path. Among them, the critical path is a path with a higher risk. After finding the critical path, the staff can be prompted to focus on the critical path, which can assist the staff in obtaining the funds transfer process.

[0066] Based on the above-mentioned risk account mining method based on knowledge graph, the present disclosure also provides a risk account mining device based on knowledge graph. Figure 7 A risk account mining device based on knowledge graph is described in detail.

[0067] Figure 7 The structural block diagram of the risk account mining device based on knowledge graph according to an embodiment of the present disclosure is schematically shown.

[0068] The risk account mining device 10 based on knowledge graph includes an acquisition module 1, a construction module 2, a first determination module 3, a calculation module 4 and a second determination module 5.

[0069] The acquisition module 1 is used to perform operation S210: obtaining the user's authorization for enterprise information, wherein the enterprise information includes enterprise account information and enterprise relationship information.

[0070] Construction module 2 is used to perform operation S220: after obtaining the user's authorization for enterprise information, a knowledge graph is constructed based on the enterprise information, wherein the nodes of the knowledge graph are constructed based on the enterprise account information, and the directed edges of the knowledge graph are constructed based on the enterprise relationship information.

[0071] The first determination module 3 is used to perform operation S230: determine the target starting point and the target end point, and m flow paths between the target starting point and the target end point in the knowledge graph, where m is an integer greater than or equal to 1.

[0072] The calculation module 4 is used to perform operation S240: calculate the risk characteristic value from the target starting point to the target end point according to the m circulation paths.

[0073] The second determination module 5 is used to perform operation S250: determine the risk accounts on the m circulation paths between the target starting point and the target end point according to the risk characteristic value.

[0074] According to some embodiments of the present disclosure, the calculation module includes a determination unit, a first calculation unit and a second calculation unit.

[0075] The determination unit is used to determine the weight value of each flow path in the m flow paths according to the path characteristics of each flow path by using a logistic regression classification model.

[0076] The first calculation unit is used to calculate the reachability probability of the target starting point reaching the target end point through each flow path according to the random walk algorithm.

[0077] The second calculation unit is used to calculate the risk characteristic value from the target starting point to the target end point according to the weight values ​​and reachability probabilities of the m flow paths.

[0078] According to some embodiments of the present disclosure, the second calculation unit includes a first determination element and a second determination element.

[0079] The first determination element is used to multiply the weight value and the reachability probability of each flow path to obtain the sub-risk characteristic value of each flow path.

[0080] The second determining element is used to add up the sub-risk characteristic values ​​of the m circulation paths to obtain the risk characteristic value from the target starting point to the target end point.

[0081] According to some embodiments of the present disclosure, the second determination module includes a mining unit.

[0082] The mining unit is used to compare the risk characteristic value with a preset risk threshold. When the risk characteristic value is greater than or equal to the risk threshold, the accounts on the m circulation paths between the target starting point and the target end point corresponding to the risk characteristic value are regarded as risk accounts.

[0083] According to some embodiments of the present disclosure, when the risk characteristic value is greater than or equal to the risk threshold, the risk account mining device based on the knowledge graph also includes an identification module.

[0084] The identification module is used to compare the weight value of each flow path in the m flow paths with a preset weight threshold, and when the weight value is greater than or equal to the weight threshold, the flow path is identified as a critical path.

[0085] According to the risk account mining device 10 based on the knowledge graph of the embodiment of the present disclosure, the user's authorization for enterprise information is obtained; after obtaining the user's authorization for enterprise information, a knowledge graph is constructed based on the enterprise information; the target starting point and target end point, as well as m circulation paths between the target starting point and the target end point are determined in the knowledge graph; based on the m circulation paths, the risk characteristic value from the target starting point to the target end point is calculated; based on the risk characteristic value, the risk account on the m circulation paths between the target starting point and the target end point can be determined. The risk account mining method disclosed in the present disclosure is simple and easy to implement, and at the same time, it can accurately and completely obtain the multi-level association relationship of accounts and characterize the account association relationship. Therefore, the method disclosed in the present disclosure has high mining accuracy and comprehensive identification of risk accounts.

[0086] In addition, according to an embodiment of the present disclosure, any multiple modules among the acquisition module 1, the construction module 2, the first determination module 3, the calculation module 4 and the second determination module 5 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0087] According to an embodiment of the present disclosure, at least one of the acquisition module 1, the construction module 2, the first determination module 3, the calculation module 4, and the second determination module 5 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in an appropriate combination of any of them.

[0088] Alternatively, at least one of the acquisition module 1, the construction module 2, the first determination module 3, the calculation module 4 and the second determination module 5 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0089] Figure 8 A block diagram of an electronic device suitable for implementing the above method according to an embodiment of the present disclosure is schematically shown.

[0090] like Figure 8As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0091] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0092] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0093] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0094] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0095] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method of the embodiment of the present disclosure.

[0096] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0097] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0098] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0099] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0100] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0101] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0102] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A risk account mining method based on knowledge graph, characterized in that: include: Obtaining user authorization for enterprise information, wherein the enterprise information includes enterprise account information and enterprise relationship information; After obtaining the user's authorization for the enterprise information, construct a knowledge graph according to the enterprise information, wherein the nodes of the knowledge graph are constructed according to the enterprise account information, and the directed edges of the knowledge graph are constructed according to the enterprise relationship information; Determine a target starting point and a target end point in the knowledge graph, as well as m flow paths from the target starting point to the target end point, where m is an integer greater than or equal to 1; Calculate the risk characteristic value from the target starting point to the target end point according to the m circulation paths; and According to the risk characteristic value, the risk accounts on the m circulation paths between the target starting point and the target end point are determined.

2. The risk account mining method based on knowledge graph according to claim 1 is characterized in that: The step of calculating the risk characteristic value from the target starting point to the target end point according to the m circulation paths comprises: Determining a weight value of each of the m circulation paths according to a path feature of each of the circulation paths; Calculating the reachability probability of the target starting point to reach the target end point through each of the flow paths; and The risk characteristic value from the target starting point to the target end point is calculated according to the weight values ​​and the reachable probabilities of the m circulation paths.

3. The risk account mining method based on knowledge graph according to claim 2 is characterized in that: The step of determining a weight value of each of the m flow paths according to the path characteristics of each of the flow paths comprises: According to the path characteristics of each of the flow paths, a logistic regression classification model is used to determine the weight value of each of the m flow paths.

4. The risk account mining method based on knowledge graph according to claim 2 is characterized in that: The step of calculating the reachability probability of the target starting point reaching the target end point through each of the flow paths comprises: According to the random walk algorithm, the reachability probability of the target starting point to reach the target end point through each of the flow paths is calculated.

5. The risk account mining method based on knowledge graph according to claim 2 is characterized in that: The path feature includes at least one of the number of nodes, node weights, and edge weights on the circulation path.

6. The risk account mining method based on knowledge graph according to claim 2 is characterized in that: The step of calculating the risk characteristic value from the target starting point to the target end point according to the weight values ​​and the reachability probabilities of the m flow paths comprises: Multiplying the weight value and the reachability probability of each circulation path to obtain a sub-risk characteristic value of each circulation path; and The sub-risk characteristic values ​​of the m circulation paths are added together to obtain the risk characteristic value from the target starting point to the target end point.

7. The risk account mining method based on knowledge graph according to claim 2 is characterized in that: The step of determining the risk accounts on the m circulation paths between the target starting point and the target end point according to the risk characteristic value comprises: The risk characteristic value is compared with a preset risk threshold value. When the risk characteristic value is greater than or equal to the risk threshold value, the accounts on the m circulation paths between the target starting point and the target end point corresponding to the risk characteristic value are taken as risk accounts.

8. The risk account mining method based on knowledge graph according to claim 7 is characterized in that: When the risk characteristic value is greater than or equal to the risk threshold, the method further includes: The weight value of each of the m flow paths is compared with a preset weight threshold, and when the weight value is greater than or equal to the weight threshold, the flow path is identified as a critical path.

9. A risk account mining device based on knowledge graph, characterized in that: include: An acquisition module, the acquisition module is used to execute the acquisition of the user's authorization for the enterprise information, wherein the enterprise information includes enterprise account information and enterprise relationship information; A construction module, the construction module is used to execute, after obtaining the user's authorization for the enterprise information, to construct a knowledge graph according to the enterprise information, wherein the nodes of the knowledge graph are constructed according to the enterprise account information, and the directed edges of the knowledge graph are constructed according to the enterprise relationship information; A first determination module, the first determination module is used to determine a target starting point and a target end point in the knowledge graph, and m flow paths between the target starting point and the target end point, where m is an integer greater than or equal to 1; a calculation module, the calculation module being used to calculate a risk characteristic value from the target starting point to the target end point according to the m circulation paths; and The second determination module is used to determine the risk accounts on the m circulation paths between the target starting point and the target end point according to the risk characteristic value.

10. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, The method is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images