Time sequence diagram data risk control method and device, medium and equipment

Abstract

The invention discloses a time sequence diagram data risk control method and device, a medium and equipment, in response to a risk control request of a user, time sequence diagram data at the current moment and a target node of a user to be subjected to risk control in the time sequence diagram data are determined, the node of the time sequence diagram data is determined based on user data, and the edge is determined based on a relationship between users. And the nodes and the edges carry time information of data updating. And determining a sub-graph of the target node from the time sequence graph data. And inputting the sub-graphs carrying the time information into the trained risk control model, obtaining time features through a time encoder in the risk control model, and obtaining graph data features through a graph data encoder in the risk control model. And inputting the time feature and the graph data feature into a decoder in a risk control model to obtain a risk classification result of the target node and a prediction result of a connection relationship between the target node and each node in the time sequence graph data. And performing risk control on the user to be subjected to risk control according to the risk classification result and the prediction result.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, medium and equipment for risk control of timing diagram data. Background Art

[0002] At present, with the rapid development of cutting-edge technologies such as big data, cloud computing and artificial intelligence, the interactive scenarios of users on Internet platforms have become increasingly diverse, and the resulting personal data has also shown explosive growth. Among the large amount of data generated on Internet platforms, many are user data with time. In order to better utilize the large amount of user data generated on Internet platforms, provide better services to users and control the risk of user operations, it is very important to effectively process user data.

[0003] In the prior art, for static graph data consisting of user accounts as nodes and the relationships between nodes as edges, PyTorch and PyTorch Geometric (PyG) based on PyTorch can be used to conduct in-depth research and processing of static graph data. However, in the face of time-series graph data whose nodes and edges will change over time, the use of PyTorch and PyG is stretched and cannot be applied to the large-scale time-series graph data generated on current Internet platforms.

[0004] To this end, this specification provides a timing diagram data risk control method, device, medium and equipment. Summary of the invention

[0005] This specification provides a time series data risk control method, device, medium and equipment to partially solve the above-mentioned problems existing in the prior art.

[0006] This manual adopts the following technical solutions:

[0007] This specification provides a time series data risk control method, including:

[0008] In response to the user's risk control request, determine the time series graph data at the current moment and the target node corresponding to the user to be risk controlled in the time series graph data, wherein the nodes of the time series graph data are determined based on the user data, the edges are determined based on the relationship between users, and the nodes and edges carry the time information of data update;

[0009] Determine a subgraph of the target node from the timing graph data;

[0010] Input the subgraph carrying time information into the trained risk control model, obtain the time feature through the time encoder in the risk control model, and obtain the graph data feature through the graph data encoder in the risk control model;

[0011] Input the time feature and the graph data feature into the decoder in the risk control model to obtain the risk classification result of the target node and the prediction result of the connection relationship between the target node and each node in the time series graph data;

[0012] Risk control is performed on the user to be risk controlled according to the prediction node and the risk classification result.

[0013] Optionally, the risk control model is trained using the following method, wherein:

[0014] Determine historical risk control users and historical risk control moments based on historical risk control business;

[0015] Determine the time series graph data at the historical risk control moment as training graph data, and determine the nodes of the historical risk control users at the historical risk control moment as training nodes;

[0016] Taking the training node as the center, determining the training subgraph of the training node from the training graph data as a training sample, and determining the future node connection status of the training node after the historical risk control moment as a historical prediction result, and taking the historical risk control result of the training node and the historical prediction result as annotations;

[0017] Inputting the time information of the training sample into the time encoder in the risk control model to be trained to obtain a time feature, and inputting the training sample into the graph data encoder in the risk control model to be trained to obtain a graph data feature;

[0018] Inputting the time features and graph data features of the training samples into the encoder in the risk control model to be trained to obtain the risk control results and prediction results of the training nodes;

[0019] The risk control model to be trained is trained according to the difference between the risk control result and the prediction result of the annotation and the training node.

[0020] Optionally, taking the training node as the center, determining the training subgraph of the training node from the training graph data as a training sample, and determining the future node connection status of the training node after the historical risk control moment as a historical prediction result, and taking the historical risk control result of the training node and the historical prediction result as annotations, specifically including:

[0021] Determine a preset number of nodes that the training node is not connected to before the historical risk control moment from the training graph data, and use the connection status of the nodes that the training node is not connected to with the training node after the historical risk control moment as the historical prediction result;

[0022] Using the historical risk control results of the training node and the historical prediction results as annotations;

[0023] Taking the training node as the center, a training subgraph of the training node is determined from the training graph data, and training samples are determined according to nodes that are not connected between the training subgraph and the training node.

[0024] Optionally, taking the training node as the center, determining the training subgraph of the training node from the training graph data as a training sample, and determining the future node connection status of the training node after the historical risk control moment as a historical prediction result, and taking the historical risk control result of the training node and the historical prediction result as annotations, specifically including:

[0025] In the training graph data, determine the nodes that the training node was not connected to before the historical risk control moment and the nodes that were not connected at the historical risk control moment as candidate nodes;

[0026] Selecting a preset number of nodes from the nodes to be selected as selected nodes;

[0027] Taking the training node as the center, determining a training subgraph of the training node from the training graph data, and determining the training sample according to the training subgraph and the selected node;

[0028] The disconnection between the selected node and the training node after the historical risk control moment is used as a historical prediction result, and the historical risk control result of the training node and the historical prediction result are used as annotations of the training sample.

[0029] Optionally, before inputting the subgraph carrying the time information into the trained risk control model, the method further includes:

[0030] Determine, from the timing graph data, a preset number of nodes to which the target node is not connected before the current moment;

[0031] According to the nodes not connected to the target node, a subgraph carrying the nodes not connected to the target node is determined from the timing graph data with the target node as the center.

[0032] Optionally, before inputting the subgraph carrying the time information into the trained risk control model, the method further includes:

[0033] In the time sequence graph data, determine nodes that the target node has not been connected to before the current moment and that are not connected to the target node at the current moment as candidate nodes;

[0034] Selecting a preset number of nodes from the nodes to be selected as selected nodes;

[0035] Taking the target node as the center, a subgraph carrying the selected node is determined from the timing graph data.

[0036] Optionally, the time feature and the graph data feature are input into a decoder in the risk control model to obtain a prediction result of the connection relationship between the target node and each node in the time series graph data, specifically including:

[0037] Input the time feature and the graph data feature into a decoder in the risk control model to obtain a node feature, where the node feature is a feature of a node that has a newly added connection relationship with the target node after the current moment;

[0038] Based on the node features and the matching results of the features of the nodes in the time series graph data at the current moment that have no connection relationship with the target node, the prediction result of the connection relationship between the target node and each node in the time series graph data is determined.

[0039] Optionally, performing risk control on the user to be risk controlled according to the prediction result and the risk classification result specifically includes:

[0040] According to the prediction result, determining a node connected to the target node as a node to be checked;

[0041] According to a preset risk node library, determine whether the node to be inspected matches a node in the risk node library, and determine whether the risk classification result is risky;

[0042] If any of the items is yes, risk control is performed on the user to be risk controlled;

[0043] If both are negative, no risk control will be performed on the user to be risk controlled.

[0044] Optionally, the method further includes:

[0045] The timing diagram data, the target node, and the subgraph of the target node at the current moment are displayed to the user, and according to the risk control result of the target node, the risk control subgraph of the target node is displayed to the user.

[0046] This specification provides a time series data risk control device, including:

[0047] A determination module, configured to determine, in response to a user's risk control request, the time sequence graph data at the current moment and a target node corresponding to the user to be risk controlled in the time sequence graph data, wherein the nodes of the time sequence graph data are determined based on user data, the edges are determined based on the relationship between users, and the nodes and edges carry time information of data update;

[0048] A sampling module, used for determining a subgraph of the target node from the timing graph data;

[0049] An encoding module, used to input the subgraph carrying time information into the trained risk control model, obtain time features through the time encoder in the risk control model, and obtain graph data features through the graph data encoder in the risk control model;

[0050] A decoding module is used to input the time features and the graph data features into a decoder in the risk control model to obtain the risk classification result of the target node and the prediction result of the connection relationship between the target node and each node in the time series graph data.

[0051] The risk control module is used to perform risk control on the user to be risk controlled according to the prediction node and the risk classification result.

[0052] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned timing diagram data risk control method is implemented.

[0053] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a timing diagram data risk control method when executing the program.

[0054] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0055] The timing graph data risk control method provided in this specification responds to the user's risk control request, determines the timing graph data at the current moment and the target node of the user to be risk controlled in the timing graph data, the nodes of the timing graph data are determined based on the user data, the edges are determined based on the relationship between users, and the nodes and edges carry the time information of the data update. Determine the subgraph of the target node from the timing graph data. Input the subgraph carrying the time information into the trained risk control model, obtain the time feature through the time encoder in the risk control model, and obtain the graph data feature through the graph data encoder in the risk control model. Input the time feature and the graph data feature into the decoder in the risk control model to obtain the risk classification result of the target node and the prediction result of the connection relationship between the target node and each node in the timing graph data. According to the risk classification result and the prediction result, risk control is performed on the user to be risk controlled.

[0056] The subgraph is obtained by sampling the time-series graph data. By inputting the subgraph carrying time information into the risk control model, the risk control model can output the risk classification result of the target node according to the characteristics of the existing nodes and edges of the subgraph. In addition, the risk control model can also predict the nodes that the target node may connect to in the future by analyzing the time evolution based on the time information of the subgraph. According to the risk classification result of the target node and the prediction of the nodes that may be connected in the future, the risk control of the target node represented by the target node can be carried out efficiently and accurately, and the large-scale time-series graph data can be efficiently processed. And there is no need to analyze the entire time-series graph data where the target node is located, saving the consumption of computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings:

[0058] Figure 1 A schematic diagram of a flow chart of a time sequence diagram data risk control method provided in an embodiment of this specification;

[0059] Figure 2 A schematic diagram of determining a subgraph node provided in this specification;

[0060] Figure 3 A sampling schematic diagram provided for this manual;

[0061] Figure 4 A schematic diagram of a sampling provided for this specification;

[0062] Figure 5 A schematic diagram of the structure of a timing diagram data processing platform provided in this specification;

[0063] Figure 6 A schematic diagram of a time series data risk control device provided in this specification;

[0064] Figure 7 A method corresponding to the Figure 1 Schematic diagram of the structure of an electronic device. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0066] At present, due to the emergence of high-quality open source libraries such as PyTorch and PyG, users' research on static graph data has become efficient and fast. Therefore, the research on static graph data has made great progress. However, the advantages of PyTorch and PyG in the face of static graph data cannot be extended to sequential graph data. Therefore, based on PyTorch and PyG, this specification builds a sequential graph data processing platform for studying and learning sequential graph data to solve the problem that PyTorch and PyG cannot be applied to large-scale sequential graph data.

[0067] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0068] Figure 1 A schematic diagram of a flow chart of a time sequence diagram data risk control method provided in an embodiment of this specification includes the following steps:

[0069] S100: In response to the user's risk control request, determine the timing graph data at the current moment and the target node corresponding to the user to be risk controlled in the timing graph data, the nodes of the timing graph data are determined based on the user data, the edges are determined based on the relationship between users, and the nodes and edges carry time information of data updates.

[0070] The process of performing risk control on the timing diagram data in this specification involves processing the timing diagram data. In the embodiments of this specification, the processing of the timing diagram data can be performed by a server. Of course, this specification does not limit which device is used to perform the processing of the timing diagram data. For example, devices such as personal computers and mobile terminals can also be used to process and risk control the timing diagram data. For ease of description, the following description is based on the timing diagram data processing platform as the execution subject.

[0071] In one or more embodiments of the present specification, the timing graph data processing platform is built based on PyTorch and PyG libraries, and most of the application programming interfaces (Application Programming Interface, API) in the timing graph data processing platform are designed to be compatible with PyTorch and PyG, and support model training and model reasoning operation of a single graphics processor (Graphic Processing Unit, GPU) and multiple GPUs. A timing data processing module is also designed in the timing graph data processing platform, which stores many general continuous-time dynamic graph (Continuous-Time Temporal Graph, CTTG) data sets and discrete-time dynamic graph (Discrete-Time Temporal Graph, DTTG) data sets. In addition, since the timing graph data involves time-related changes and the dynamic evolution of nodes and edges, in order to be able to represent the impact of time-related changes, such as edges with timestamps, evolving nodes and edges, etc., the timing data processing module can accurately represent the time information in the timing graph data and the internal structure of the timing graph data.

[0072] In one or more embodiments of the present specification, a timing graph data processing platform determines the timing graph data at the current moment and the target node corresponding to the user to be risk controlled in the timing graph data in response to the user's data processing request. The nodes of the timing graph data are determined based on the user data, the edges are determined based on the relationships between users, and the nodes and edges carry time information of data updates.

[0073] Of course, the timing diagram data processing platform responds to the user's data processing request, and based on the user's data processing request, it can also determine the timing diagram data at the current moment and the target node corresponding to the user to be risk controlled in the timing diagram data according to the preset data processing module (i.e., the above-mentioned timing data processing module).

[0074] The timing graph data at the current moment can be the timing graph data in PyTorch and PyG, or the timing graph data stored in the data processing module can be used to determine the timing graph data at the current moment, or the timing graph data of the users to be risk-controlled in PyTorch, PyG and the data processing module can be used to determine the timing graph data at the current moment. Similarly, the target node can be the node determined as a possible risk in the timing graph data, or each node in the timing graph data can be used as the target node.

[0075] It is worth noting that the data processing module can also store the timing diagram data set uploaded by the user based on the integration of many common CTTG data sets and DTTG data sets. The timing diagram data processing platform can be used to process data processing requests in different scenarios, and the scenario is not limited in this specification.

[0076] For example, on a social platform, new time-series graph data is generated every moment due to the interaction between users. In order to prevent users from committing fraud and other illegal behaviors on the social platform to obtain improper benefits, risk control is required. The risk control personnel of the social platform can upload the time-series graph data to the time-series data processing platform to process the time-series graph data.

[0077] S102: Determine a subgraph of the target node from the timing graph data.

[0078] In one or more embodiments of the present specification, when performing a sampling subgraph operation on a target node on the time-series graph data, it is necessary to consider the time information of the neighborhood around the target node. In order to be able to predict which nodes the target node may connect to in the future, it is necessary to use the information of the neighborhood around the target node at the current moment. However, in order to avoid information leakage at future moments, only the information of the neighborhood around the target node that already exists at the current moment can be sampled.

[0079] Therefore, in one or more embodiments of the present specification, the subgraph of the target node is determined from the timing graph data at the current moment.

[0080] Among them, the method of determining the subgraph of the target node is not limited in this specification. For example, a preset number of nodes and a preset number of hops can be set, and based on the preset number of nodes and the preset number of hops, the subgraph of the target node is determined from the timing graph data at the current moment with the target node as the center.

[0081] For example, in the time series data, there are five time points from t1 to t5, and nodes 1 to 5 appear at each time point. At time point t3, the target node in the current time series data is node 3. So at this time, the current time is time point t3. At time point t3, only nodes 1, 2, and 3 appear in the time series data, and then the subgraph is determined with node 3 as the center.

[0082] Figure 2 This is a sampling diagram provided in this manual. Figure 2As shown in the figure, there is a time axis of node evolution at the bottom of the time series data. From t1 to t5, the relationship between nodes 1 to 5 is evolved in sequence. The dotted line represents the nodes connected when node 3 appears. The target node is the shaded part, that is, node 3. At the current time t3, only nodes 1, 2, and 3 appear in the time series data. At this time, with node 3 as the center, nodes 1 and 2 can be collected to determine the subgraph.

[0083] By collecting the subgraph of the target node and subsequently analyzing the "neighbor information" of the surrounding neighborhood of the target node, efficient and accurate risk control of the target node can be achieved without analyzing the entire time series graph data of the target node, thus saving computing resources.

[0084] It is worth noting that the preset number of nodes and the preset number of hops may also be the preset number of hops and the preset number of nodes for each hop, and the nodes for the next hop are collected based on the collected nodes for the previous hop.

[0085] For example, the preset number of hops is 2 hops, and the preset number of nodes for each hop is 10, that is, with the target node as the center, 10 nodes within 1 hop are collected, and based on the 10 nodes collected within 1 hop, 10 nodes within 2 hops are collected.

[0086] Figure 3 This is a schematic diagram of determining a subgraph node provided in this specification. Figure 3 In the graph data shown, the black shadow node is the target node, the ten dark shadow nodes near the target node are the nodes collected within 1 hop, and the ten light shadow nodes are the nodes collected within 2 hops.

[0087] S104: Input the subgraph carrying time information into the trained risk control model, obtain the time feature through the time encoder in the risk control model, and obtain the graph data feature through the graph data encoder in the risk control model.

[0088] In one or more embodiments of the present specification, the timing graph data processing platform inputs the subgraph carrying time information into the trained risk control model, obtains the time features through the time encoder in the risk control model, and obtains the graph data features through the graph data encoder in the risk control model.

[0089] The subgraph of the graph data encoder input into the risk control model may not include time information. The time information may be the timestamps of events between nodes in the subgraph, the timestamps of each node appearing in the time series graph data, and other events that can be expressed by time.

[0090] It is worth noting that in this specification, the trained risk control model can be multiple risk control models trained in different scenarios. For example, risk screening can be performed on the fund transaction behavior of certain nodes (i.e., target nodes) in the time series graph data generated on the social platform. The risk control model trained based on the social scenario and stored on the time series graph data processing platform can be used to perform risk screening on the target node.

[0091] S106: Input the time feature and the graph data feature into the decoder in the risk control model to obtain the risk classification result of the target node and the prediction result of the connection relationship between the target node and each node in the time series graph data.

[0092] In one or more embodiments of the present specification, the time series graph data processing platform inputs time features and graph data features into a decoder in a risk control model to obtain risk classification results for target nodes and prediction results for the connection relationship between the target node and each node in the time series graph data.

[0093] The risk classification result of the target node output by the decoder in the risk control model can be a classification result of whether there is a risk based on the connection relationship of the subgraph of the target node. Of course, the setting of the classification result is based on how the risk control model is set during training.

[0094] In one or more embodiments of the present specification, the time-series graph data processing platform inputs the time features and graph data features into the decoder in the risk control model to obtain node features, where the node features are features of nodes that have a newly added connection relationship with the target node after the current moment. Based on the matching results of the obtained node features and the features of the nodes that have no connection relationship with the target node in the time-series graph data at the current moment, the prediction results of the connection relationship between the target node and each node in the time-series graph data are determined.

[0095] It is worth noting that the node feature may be the age, gender, income, occupation, etc. of the user corresponding to the node. The node feature may also be the user behavior record of the user corresponding to the node. In this specification, there is no restriction on the node feature, and the node feature may be determined according to the actual situation.

[0096] S108: Perform risk control on the user to be risk controlled according to the prediction result and the risk classification result.

[0097] In one or more embodiments of the present specification, the time series graph data processing platform performs risk control on risk control users based on prediction results and risk classification results.

[0098] In one or more embodiments of the present specification, the timing diagram data processing platform determines the node connected to the target node as the node to be checked based on the prediction result. According to the preset risk node library, it is determined whether the node to be checked matches the node in the risk node library, and it is determined whether the risk classification result is risky. If any one of the items is yes, risk control is performed on the risk control user. If both are no, risk control is not performed on the risk control user. Among them, when there are multiple nodes to be checked, as long as one node to be checked matches the node in the risk node library, risk control is performed on the risk control user. The risk nodes in the risk node library can be risk nodes obtained by performing historical risk control business in the timing diagram data, or they can be risk nodes learned based on notifications from relevant departments and other channels.

[0099] Of course, the prediction results and risk classification results can also be returned to the user, who can analyze the connection between the node with the newly added connection relationship of the target node shown in the prediction results and the target node. After receiving the prediction results and risk classification results of the user to be risk controlled, the user can further conduct risk screening for the user to be risk controlled.

[0100] For example, if the risk classification result output by the risk model is that the target node has a fraud risk, the funds of the target node represented by the risk control user can be controlled. Alternatively, the prediction result output by the risk control model is that the target node will have financial transactions with several nodes at a certain time in the future, which is represented in the time series graph data as being connected to several nodes at a certain time in the future. These several nodes are matched with each node in the time series graph data, and the matching results are used to determine which nodes these several nodes represent in the time series graph data. If the target node has no financial transactions with those several nodes in its historical financial transactions, the target node can be monitored or controlled.

[0101] In one or more embodiments of the present specification, the time-series graph data processing platform inputs the time features and the graph data features into the decoder in the risk control model to obtain the node features. According to the matching results of the obtained node features and the features of the nodes that have no connection relationship with the target node in the time-series graph data at the current moment, the prediction results of the connection relationship between the target node and each node in the time-series graph data are determined. According to the matching results, the node corresponding to the obtained node features and the newly added connection relationship with the target node is determined as the newly added node. If the newly added node is a node in the subgraph of the target node, it means that the newly added node is a node that has a connection relationship with the target node at the current moment, and the node that has a connection relationship with the target node has not changed. At this time, the risk control of the risk control user can be performed according to the risk classification result of the target node. If there is a newly added node that has no connection relationship with the target node in the time-series graph data at the current moment, then at this time, it is necessary to comprehensively consider the risk classification results and whether there is a risk when the target node is connected to the newly added node, obtain the result under comprehensive consideration, and perform risk control on the risk control user.

[0102] based on Figure 1 The timing graph data risk control method provided in this specification responds to the user's risk control request, determines the timing graph data at the current moment and the target node of the user to be risk controlled in the timing graph data, the nodes of the timing graph data are determined based on the user data, the edges are determined based on the relationship between users, and the nodes and edges carry the time information of the data update. Determine the subgraph of the target node from the timing graph data. Input the subgraph carrying the time information into the trained risk control model, obtain the time feature through the time encoder in the risk control model, and obtain the graph data feature through the graph data encoder in the risk control model. Input the time feature and the graph data feature into the decoder in the risk control model to obtain the risk classification result of the target node and the prediction result of the connection relationship between the target node and each node in the timing graph data. According to the risk classification result and the prediction result, risk control is performed on the user to be risk controlled.

[0103] The subgraph is obtained by sampling the time-series graph data. By inputting the subgraph carrying time information into the risk control model, the risk control model can output the risk classification result of the target node according to the characteristics of the existing nodes and edges of the subgraph. In addition, the risk control model can also predict the nodes that the target node may connect to in the future by analyzing the time evolution based on the time information of the subgraph. According to the risk classification result of the target node and the prediction of the nodes that may be connected in the future, the risk control of the user to be risk-controlled represented by the target node can be performed efficiently and accurately, and large-scale time-series graph data can be efficiently processed. And there is no need to analyze the entire time-series graph data where the target node is located, saving the consumption of computing resources. The construction of a time-series graph data processing platform with PyTorch and PyG not only combines the advantages of PyTorch and PyG in processing static graph data, but also avoids the problem that PyTorch and PyG cannot be applied to large-scale time-series graph data, and opens up the application scenarios and scope of using PyTorch and PyG to process time-series graph data.

[0104] In addition, in one or more embodiments of the present specification, in order to be able to flexibly convert between CTTG data and DTTG data, the data processing module in the timing diagram data processing platform can adapt to a wider range of application scenarios. Therefore, in the present specification, the data processing module supports flexible conversion between CTTG data and DTTG data, and can convert CTTG data into DTTG data by discretizing timestamps. It is also possible to convert DTTG data into CTTG data by assigning continuous timestamps to DTTG data. Of course, in the present specification, the data processing module also supports the conversion of timing diagram data (whether DTTG data or CTTG data) into static graph data. The following are some conversion examples:

[0105] from lastgl.data import TemporalData#Import TemporalData.

[0106] data=TemporalData(src=…, dst=…, t=…)#Initialize a CTTG data, src is the starting point, dst is the end point, and t is the time.

[0107] static_data = data.to_static() #Convert the timing diagram data into static diagram data.

[0108] snapshots = data.snapshots(time_attr = 't') #Convert CTTG data into DTTG data.

[0109] Among them, lastgl is the timing diagram data processing platform, and TemporalData is the data processing module.

[0110] The conversion capability provided by the data processing module enhances the versatility of the data processing module in processing timing diagram data.

[0111] In one or more embodiments of the present specification, the preset number of nodes and the preset number of hops may also be the preset number of hops and the preset number of nodes for each hop, and the nodes for the next hop are collected based on the collected nodes for the previous hop. The following is an example of collection:

[0112] loader = TemporalLoader (temporal_data, [10, 10]) # Initialize the loader for sampling, [10, 10] means collecting 10 nodes for the first hop and 10 nodes for the second hop.

[0113] It is worth noting that if the sequential graph data is converted into static graph data through the data processing module, then the collection example of the static graph data can be:

[0114] loader = NeighborLoader (data, [10, 10]) # Initialize the loader for sampling, [10, 10] means collecting 10 nodes for the first hop and 10 nodes for the second hop.

[0115] For sampling of target nodes, this specification also provides two sampling methods, namely uniform sampling and nearest sampling.

[0116] Uniform sampling means that, in a given time window, a subgraph consisting of nodes that can be sampled with the target node as the center is taken as the subgraph of the target node.

[0117] Although uniform sampling can perform risk screening on the target node as much as possible based on the characteristics of the nodes and edges in the time series graph data. However, nodes that are too old may no longer be used to judge the risk situation of the target node in the current time window, as well as the future node connection situation. Therefore, the most recent sampling just meets this situation. It is only necessary to collect the subgraph composed of the nodes that can be collected under the preset time window with the target node as the center. For example, in the time series graph data, there are five time points from t1 to t5, and nodes 1 to 5 appear at each time point. The current time window is time point t4, then the preset time window can be the most recent time window, which is time point t3. In this manual, there is no restriction on the preset time window, which can be set according to actual conditions.

[0118] In one or more embodiments of the present specification, a preset number of nodes that the target node is not connected to before the current moment can also be determined from the time sequence graph data at the current moment. Based on the nodes that the target node is not connected to, a subgraph carrying the nodes that the target node is not connected to is determined from the time sequence graph data with the target node as the center. That is, the subgraph is expressed in the form of adding additional points.

[0119] Figure 4 This is a schematic diagram of a sample provided in this manual. Figure 4 As shown, there is a time axis of node evolution below the time series data. From t1 to t5, nodes 1 to 9 are evolved from the time series data. The shaded node is the target node, that is, node 6. The time point t3 when node 6 evolves is taken as the current moment. Before the current moment, among the nodes 1, 2, 3, 4, 5, and 7 that appear, except for nodes 2 and 5 that node 6 has connected to, among the remaining nodes, nodes 1, 3, 4, and 7 can be carried by the subgraph composed of node 6, node 2, and node 5.

[0120] By collecting nodes that the target node is not connected to, i.e. negative sampling, the risk control model can more sensitively identify abnormal or fraudulent behaviors in the subsequent steps, because these behaviors often manifest as edges that do not conform to the normal pattern and abnormal connection relationships. This helps to effectively check the risks of the target node and predict the nodes that the target node may be connected to in the future.

[0121] In one or more embodiments of the present specification, for the negative sampling method, a preset number of nodes that the target node has not been connected to before the current moment and are not connected to at the current moment are determined in the time sequence graph data at the current moment as nodes to be selected. A preset number of nodes are selected from the nodes to be selected as selected nodes. With the target node as the center, a subgraph carrying the selected nodes is determined from the time sequence graph data.

[0122] In one or more embodiments of the present specification, before the subgraph of the target node carrying time information is input into the processing model, the features of the nodes and edges in the subgraph can also be digitized, so that better model performance can be achieved when processed by the model. Usually, for features such as numbers (such as price), categories (such as gender or occupation), and text (description) attributes, these features are digitized to make them more suitable for model processing. In addition, the model performance can be further improved by using preprocessing methods such as feature normalization. Of course, for the means of digitizing features, one-hot encoding (One-Hot) can be used to digitize the features. In this specification, the means of digitizing features are not limited.

[0123] In one or more embodiments of the present specification, the timing diagram data processing platform provides reusable and standardized processing model training and processing model reasoning functions in order to meet the model training needs of both users with lower professional qualities and users with higher professional qualities. The processing model reasoning function represents the actual application of the processing model completed through training.

[0124] Therefore, the processing model in the time-series graph data processing platform includes a time encoder, a graph data encoder, and a decoder. The time information of the subgraph of the target node is input into the time encoder to obtain the time features output by the time encoder. The time information can be the timestamps of the nodes and edges in the subgraph of the target node, or a description of the changes of the subgraph of the target node over time, such as periodicity. Then the subgraph of the target node is input into the graph data encoder to obtain the graph data features.

[0125] Finally, the time features and graph data features are input into the decoder to obtain the risk control results and prediction results of the target node output by the decoder.

[0126] In one or more embodiments of this specification, the following method may also be used to train the above-mentioned risk control model:

[0127] In response to the training request of the user, historical risk control users and historical risk control moments are determined according to historical risk control business.

[0128] Determine the time series graph data at the historical risk control moments as the training graph data, and determine the nodes of the historical risk control users at the historical risk control moments as the training nodes.

[0129] Taking the training node as the center, the training subgraph of the training node is determined from the training graph data as the training sample, and the future node connection status of the training node after the historical risk control moment is determined as the historical prediction result, and the historical risk control results and historical prediction results of the training node are used as annotations.

[0130] The time information of the training samples is input into the time encoder in the risk control model to be trained to obtain the time features, and the training samples are input into the graph data encoder in the risk control model to be trained to obtain the graph data features.

[0131] The time characteristics and graph data characteristics of the training samples are input into the encoder of the risk control model to be trained to obtain the risk control results and prediction results of the training nodes.

[0132] According to the difference between the risk control results of the labeled and trained nodes and the prediction results, the loss is determined, and the risk control model to be trained is trained with the minimum loss as the optimization goal.

[0133] In one or more embodiments of the present specification, the subgraph of the target node obtained by negative sampling can also be used to train the risk control model. The subgraphs obtained by the two negative sampling methods can be used to train the risk control model separately or in combination, and can also be used together with the subgraphs determined in S102. Figure 1 The combination is used to train the risk control model. By learning which edges should not exist, the risk control model not only learns to predict which edges may exist, but also provides a certain degree of explanation for the prediction.

[0134] Specifically, in this specification, a preset number of nodes that the training node is not connected to before the historical risk control moment are determined from the training graph data, and the connection status of the nodes that the training node is not connected to with the training node after the historical risk control moment is used as the historical prediction result. The historical risk control results and historical prediction results of the training node are used as annotations. With the training node as the center, the training subgraph of the training node is determined from the training graph data, and the training sample is determined based on the nodes that the training subgraph is not connected to the training node.

[0135] In addition, in the present specification, nodes that the training node was not connected to before the historical risk control moment and nodes that were not connected at the historical risk control moment can also be determined in the training graph data as nodes to be selected. A preset number of nodes are selected from the nodes to be selected as selected nodes. With the training node as the center, a training subgraph of the training node is determined from the training graph data, and a training sample is determined based on the training subgraph and the selected node. The disconnection of the selected node from the training node after the historical risk control moment is used as a historical prediction result, and the historical risk control result and historical prediction result of the training node are used as annotations of the training sample.

[0136] In one or more embodiments of the present specification, a preset number of risk nodes that are not connected to the target node before the current moment can also be determined from the timing diagram data at the current moment according to historical risk control business.

[0137] According to the determined risk nodes that the target node is not connected to, a subgraph carrying nodes that the target node is not connected to is determined from the time series graph data with the target node as the center.

[0138] The subgraph containing nodes that are not connected to the target node is input into the trained risk control model to obtain the classification and prediction results of the target node.

[0139] Then, based on the classification result and prediction result of the target node obtained by carrying the subgraph of nodes that are not connected to the target node, and the classification result and prediction result of the target node obtained by determining the subgraph of the target node from the time series graph data with the target node as the center, the risk control result of the target node is determined.

[0140] Similarly, in one or more embodiments of the present specification, nodes that were not connected to the target node before the current moment and are not connected at the current moment may also be determined in the timing diagram data at the current moment as candidate nodes.

[0141] A preset number of nodes are selected from the candidate nodes as selected nodes.

[0142] With the target node as the center, the subgraph carrying the selected node is determined from the time series graph data.

[0143] The subgraph carrying the selected node is input into the trained risk control model to obtain the classification and prediction results of the target node.

[0144] Then, based on the classification result and prediction result of the target node obtained by carrying the subgraph of the selected node, and the classification result and prediction result of the target node obtained by determining the subgraph of the target node from the time series graph data with the target node as the center, the risk control result of the target node is determined.

[0145] In one or more embodiments of this specification, an example of training and reasoning a risk control model on a time series graph data processing platform is as follows:

[0146] from lastgl.config import load_config

[0147] from lastgl.training import Trainer

[0148] from lastgl.models.event_based import TGAT#Import load_config, Trainer, TGAT.

[0149] cfg = load_config('path_to_yaml_file') #Load yaml file.

[0150] model=TGAT(cfg)#Initialize TGAT model.

[0151] trainer=Trainer(cfg)#Initialize the training class (Trainer).

[0152] trainer.fit(train_data)#Training model.

[0153] trainer.evaluate(test_data)#Test the inference model.

[0154] Among them, the time-series graph data processing platform provides a yaml file configuration module, which allows users to configure the time-series graph data processing platform (lastgl) to train and reason about risk control models. In addition, lastgl can load yaml files, so users can perform model training and reasoning across various tasks, such as node classification and future link prediction.

[0155] In one or more embodiments of this specification, an example of processing a subgraph of a target node by a risk control model is as follows:

[0156] loader = TemporalLoader (temporal_data, [10, 10]) # Initialize the loader for sampling, [10, 10] means collecting 10 nodes for the first hop and 10 nodes for the second hop.

[0157] for batch in loader:#Traverse the collected subgraphs.

[0158] batch = batch.to(device) # Load the collected sub-graphs into GPU or CPU.

[0159] output = model (batch.x, # nodes of the collected subgraph.

[0160] batch.edge_index, #Edges of the collected subgraphs.

[0161] batch.t)#The time information of the collected sub-graphs is input into the model to obtain the output of the model.

[0162] After converting the subgraph of the target node into static graph data, an example of studying static graph data is shown below:

[0163] loader = NeighborLoader (data, [10, 10]) # Initialize the loader for sampling, [10, 10] means collecting 10 nodes for the first hop and 10 nodes for the second hop.

[0164] for batch in loader:#Traverse the collected subgraphs.

[0165] batch = batch.to(device) # Load the collected sub-graphs into GPU or CPU.

[0166] output = model (batch.x, # nodes of the collected subgraph.

[0167] batch.edge_index, #Edges of the collected subgraphs.

[0168] )#The collected sub-graph information is input into the model (model) to obtain the output of the model (output).

[0169] In one or more embodiments of the present specification, the time graph data processing platform also includes a time graph neural network model center (Time Graph Neural Network Model Hub), which integrates many time graph algorithms, including the CTTG algorithm and the DTTG algorithm. Many time graph algorithms are integrated for users to choose from. Through the time graph neural network model center, the architectures of different risk control models follow the same API, allowing users to switch between different risk control models for training and reasoning. In order to maintain flexibility and scalability, risk control models are all built based on torch.nn.Module. In the backend supported by PyTorch, users can directly apply the risk control models in the time graph neural network model center to their own backend framework.

[0170] The time-series graph data processing platform also provides an interpretability algorithm for each algorithm integrated in the time-series graph neural network model center. The interpretability algorithm is integrated in the interpretability module to provide interpretability requirements for the risk control model trained through the time-series graph data processing platform, so that users can better understand how the model makes processing decisions or reasoning. The interpretability algorithm provided in this specification is an extension of the static graph neural network interpretation algorithm, such as the graph neural network interpretation algorithm (GNNExplainer). On the basis of considering the time dimension, it can be applied to any type of model, which paves the way for building an interpretable time-series graph neural network (TGNN) and establishing a trustworthy system based on time-series graph data.

[0171] In one or more embodiments of the present specification, the time sequence graph data processing platform further includes a visualization module. Through the visualization module, the time sequence graph data, the target node, and the subgraph of the target node at the current moment are displayed to the user. And according to the risk control result of the target node, the risk control subgraph of the target node is displayed to the user, and in the risk control subgraph, the nodes and edges that the risk control model considers to be risky are marked.

[0172] Figure 5 This is a schematic diagram of the structure of a timing diagram data processing platform provided in this specification. Figure 5 As shown in the figure, the structure of the timing graph data processing platform is as follows from bottom to top: The timing graph data processing platform can be run on a single GPU and multiple GPUs. The timing graph data processing platform is built based on PyTorch and PyG. The data processing module provides CTTG data sets and DTTG data sets, and can perform subgraph sampling and feature processing based on the CTTG data sets and DTTG data sets. Going up, model training and model inference can be performed through the time encoder, graph data encoder, and decoder, where the graph data encoder can be a graph neural network encoder (GNN Encoder). The timing graph neural network model center integrates the timing graph algorithm. The algorithm ranking module lists the model training performance of each timing graph algorithm integrated in the timing graph neural network model center under various training tasks. The interpretable module provides the interpretability of each timing graph algorithm integrated in the timing graph neural network model center. The visualization module can intuitively display the timing graph data in front of the user. The yaml file configuration module allows users to configure the timing graph data processing platform to train and infer the risk control model.

[0173] The above is a time sequence diagram data risk control method provided by one or more embodiments of this specification. Based on the same idea, this specification also provides a corresponding time sequence diagram data risk control device, such as Figure 6 shown.

[0174] Figure 6 A schematic diagram of a time series data risk control device provided in this specification specifically includes:

[0175] Determination module 600, for determining the time series graph data at the current moment and the target node corresponding to the user to be risk controlled in the time series graph data in response to the user's risk control request, wherein the nodes of the time series graph data are determined based on the user data, the edges are determined based on the relationship between users, and the nodes and edges carry the time information of data update;

[0176] A sampling module 602, configured to determine a subgraph of the target node from the timing graph data;

[0177] The encoding module 604 is used to input the subgraph carrying time information into the trained risk control model, obtain the time feature through the time encoder in the risk control model, and obtain the graph data feature through the graph data encoder in the risk control model;

[0178] A decoding module 606 is used to input the time feature and the graph data feature into a decoder in the risk control model to obtain a risk classification result of the target node and a prediction result of a connection relationship between the target node and each node in the time series graph data;

[0179] The risk control module 608 is used to perform risk control on the user to be risk controlled according to the prediction node and the risk classification result.

[0180] Optionally, the encoding module 604 is also used to train the risk control model using the following method, wherein: according to historical risk control business, historical risk control users and historical risk control moments are determined, time series graph data at the historical risk control moments are determined as training graph data, and nodes of the historical risk control users at the historical risk control moments are determined as training nodes, with the training node as the center, a training subgraph of the training node is determined from the training graph data as a training sample, and future node connection conditions of the training node after the historical risk control moment are determined as historical prediction results, and the historical risk control results and the historical prediction results of the training node are used as annotations, the time information of the training sample is input into the time encoder in the risk control model to be trained to obtain time features, the training sample is input into the graph data encoder in the risk control model to be trained to obtain graph data features, the time features and graph data features of the training sample are input into the encoder in the risk control model to be trained to obtain the risk control results and prediction results of the training node, and the risk control model to be trained is trained according to the difference between the annotations and the risk control results and prediction results of the training node.

[0181] Optionally, the encoding module 604 is also used to determine from the training graph data a preset number of nodes that the training node is not connected to before the historical risk control moment, use the connection status of the nodes that the training node is not connected to with the training node after the historical risk control moment as historical prediction results, use the historical risk control results of the training node and the historical prediction results as annotations, determine the training subgraph of the training node from the training graph data with the training node as the center, and determine the training samples based on the training subgraph and the nodes that are not connected to the training node.

[0182] Optionally, the encoding module 604 is also used to determine in the training graph data the nodes that the training node was not connected to before the historical risk control moment and the nodes that were not connected at the historical risk control moment as candidate nodes, select a preset number of nodes from the candidate nodes as selected nodes, determine a training subgraph of the training node from the training graph data with the training node as the center, and determine the training sample based on the training subgraph and the selected node, use the disconnection of the selected node from the training node after the historical risk control moment as a historical prediction result, and use the historical risk control result of the training node and the historical prediction result as annotations of the training sample.

[0183] Optionally, the encoding module 604 is also used to determine, from the timing graph data, a preset number of nodes that the target node is not connected to before the current moment, and based on the nodes that the target node is not connected to, determine from the timing graph data a subgraph carrying the nodes that the target node is not connected to, with the target node as the center.

[0184] Optionally, the encoding module 604 is also used to respond to determining in the timing graph data nodes that the target node was not connected to before the current moment and are also not connected to at the current moment as candidate nodes, select a preset number of nodes from the candidate nodes as selected nodes, and determine a subgraph carrying the selected nodes from the timing graph data with the target node as the center.

[0185] Optionally, the decoding module 606 is further used to input the time features and the graph data features into a decoder in the risk control model to obtain node features, wherein the node features are features of nodes that have a newly added connection relationship with the target node after the current moment, and the prediction result of the connection relationship between the target node and each node in the timing graph data is determined based on the node features and the matching results of the features of the nodes in the timing graph data at the current moment that have no connection relationship with the target node.

[0186] Optionally, the risk control module 608 is also used to determine the node connected to the target node as the node to be checked based on the prediction result, judge whether the node to be checked matches the node in the risk node library based on a preset risk node library, and determine whether the risk classification result is risky. If any item is yes, risk control is performed on the user to be risk controlled; if both are no, risk control is not performed on the user to be risk controlled.

[0187] Optionally, the device further includes a visualization module 610;

[0188] The visualization module 610 is used to display the timing diagram data, the target node and the subgraph of the target node at the current moment to the user, and display the risk control subgraph of the target node to the user based on the risk control result of the target node.

[0189] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 A time series graph data risk control method is provided.

[0190] This manual also provides Figure 7 The schematic structure diagram of the electronic device shown in FIG. Figure 7 As shown, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 The described timing diagram data risk control method.

[0191] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0192] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0193] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0194] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0195] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0196] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0197] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0198] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0199] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0200] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0201] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0202] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0203] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0204] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0205] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0206] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0207] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A time series graph data risk control method, comprising: In response to the user's risk control request, determine the time series graph data at the current moment and the target node corresponding to the user to be risk controlled in the time series graph data, wherein the nodes of the time series graph data are determined based on the user data, the edges are determined based on the relationship between users, and the nodes and edges carry the time information of data update; Determine a subgraph of the target node from the timing graph data; Input the subgraph carrying time information into the trained risk control model, obtain the time feature through the time encoder in the risk control model, and obtain the graph data feature through the graph data encoder in the risk control model; Input the time feature and the graph data feature into the decoder in the risk control model to obtain the risk classification result of the target node and the prediction result of the connection relationship between the target node and each node in the time series graph data; Risk control is performed on the user to be risk controlled according to the prediction node and the risk classification result.

2. The method according to claim 1, wherein the risk control model is trained by the following method, wherein: Based on historical risk control business, determine historical risk control users and historical risk control moments; Determine the time series graph data at the historical risk control moment as training graph data, and determine the nodes of the historical risk control users at the historical risk control moment as training nodes; Taking the training node as the center, determining the training subgraph of the training node from the training graph data as a training sample, and determining the future node connection status of the training node after the historical risk control moment as a historical prediction result, and taking the historical risk control result of the training node and the historical prediction result as annotations; Inputting the time information of the training sample into the time encoder in the risk control model to be trained to obtain a time feature, and inputting the training sample into the graph data encoder in the risk control model to be trained to obtain a graph data feature; Inputting the time features and graph data features of the training samples into the encoder in the risk control model to be trained to obtain the risk control results and prediction results of the training nodes; The risk control model to be trained is trained according to the difference between the risk control result and the prediction result of the annotation and the training node.

3. The method according to claim 2, taking the training node as the center, determining the training subgraph of the training node from the training graph data as a training sample, and determining the future node connection status of the training node after the historical risk control moment as a historical prediction result, and taking the historical risk control result of the training node and the historical prediction result as annotations, specifically includes: Determine a preset number of nodes that the training node is not connected to before the historical risk control moment from the training graph data, and use the connection status of the nodes that the training node is not connected to with the training node after the historical risk control moment as the historical prediction result; Using the historical risk control results of the training node and the historical prediction results as annotations; Taking the training node as the center, a training subgraph of the training node is determined from the training graph data, and training samples are determined according to nodes that are not connected between the training subgraph and the training node.

4. The method according to claim 2, taking the training node as the center, determining the training subgraph of the training node from the training graph data as a training sample, and determining the future node connection status of the training node after the historical risk control moment as a historical prediction result, and taking the historical risk control result of the training node and the historical prediction result as annotations, specifically includes: In the training graph data, determine the nodes that the training node was not connected to before the historical risk control moment and the nodes that were not connected at the historical risk control moment as candidate nodes; Selecting a preset number of nodes from the nodes to be selected as selected nodes; Taking the training node as the center, determining a training subgraph of the training node from the training graph data, and determining the training sample according to the training subgraph and the selected node; The disconnection between the selected node and the training node after the historical risk control moment is used as a historical prediction result, and the historical risk control result of the training node and the historical prediction result are used as annotations of the training sample.

5. The method according to claim 1, before inputting the subgraph carrying time information into the trained risk control model, the method further comprises: Determine, from the timing graph data, a preset number of nodes to which the target node is not connected before the current moment; According to the nodes not connected to the target node, a subgraph carrying the nodes not connected to the target node is determined from the timing graph data with the target node as the center.

6. The method according to claim 1, before inputting the subgraph carrying time information into the trained risk control model, the method further comprises: In the time sequence graph data, determine nodes that the target node has not been connected to before the current moment and that are not connected to the target node at the current moment as candidate nodes; Selecting a preset number of nodes from the nodes to be selected as selected nodes; Taking the target node as the center, a subgraph carrying the selected node is determined from the timing graph data.

7. The method according to claim 1, inputting the time feature and the graph data feature into a decoder in the risk control model to obtain a prediction result of the connection relationship between the target node and each node in the time series graph data, specifically comprising: Input the time feature and the graph data feature into a decoder in the risk control model to obtain a node feature, where the node feature is a feature of a node that has a newly added connection relationship with the target node after the current moment; Based on the node features and the matching results of the features of the nodes in the time series graph data at the current moment that have no connection relationship with the target node, the prediction result of the connection relationship between the target node and each node in the time series graph data is determined.

8. The method according to claim 1, performing risk control on the user to be risk controlled according to the prediction result and the risk classification result, specifically comprising: According to the prediction result, determining a node connected to the target node as a node to be checked; According to a preset risk node library, determine whether the node to be inspected matches a node in the risk node library, and determine whether the risk classification result is risky; If any of the items is yes, risk control is performed on the user to be risk controlled; If both are negative, no risk control will be performed on the user to be risk controlled.

9. The method of claim 1, further comprising: The timing diagram data, the target node, and the subgraph of the target node at the current moment are displayed to the user, and according to the risk control result of the target node, the risk control subgraph of the target node is displayed to the user.

10. A time series graph data risk control device, comprising: A determination module, configured to determine, in response to a user's risk control request, the time sequence graph data at the current moment and a target node corresponding to the user to be risk controlled in the time sequence graph data, wherein the nodes of the time sequence graph data are determined based on user data, the edges are determined based on the relationship between users, and the nodes and edges carry time information of data update; A sampling module, used for determining a subgraph of the target node from the timing graph data; An encoding module, used to input the subgraph carrying time information into the trained risk control model, obtain time features through the time encoder in the risk control model, and obtain graph data features through the graph data encoder in the risk control model; A decoding module, used to input the time feature and the graph data feature into a decoder in the risk control model to obtain a risk classification result of the target node and a prediction result of a connection relationship between the target node and each node in the time series graph data; The risk control module is used to perform risk control on the user to be risk controlled according to the prediction node and the risk classification result.

11. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 9.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 9 when executing the program.

Images