Risk identification method and device, computer equipment and storage medium

Abstract

The embodiment of the invention relates to a risk identification method and device, computer equipment and a storage medium. The method comprises the following steps: constructing a plurality of groups of user knowledge maps according to attribute information of a plurality of users in a target platform; for each group of user knowledge maps, acquiring account logout proportions of the plurality of users, acquiring a total number of accounts contained in the user knowledge maps, and acquiring degrees of target nodes in the user knowledge maps; and carrying out risk identification on the plurality of users according to the account logout proportion, the total number of accounts and the degree of the target node. Therefore, the user knowledge graph can be generated according to the attribute information of the user, the user knowledge graph is used for identifying the risk user, the relevance of each node in the generated knowledge graph is stronger through the attribute information, the generated nodes are richer, and the risk user is identified through the node logout proportion, the total number of accounts and the degree of the target node. The accuracy of risk user identification can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of risk identification, and in particular, to a risk identification method, apparatus, computer equipment, and storage medium. Background Art

[0002] On any business platform that requires monetary transactions (for example, financial platforms, video playback platforms, shopping platforms, etc.), risk prevention must be carried out to reduce losses. Specifically, it can be done by identifying whether there are risks in users, accounts, mobile phone numbers, payment accounts, etc. (for example, illegal users or illegal gangs).

[0003] Existing risk identification methods usually determine that an account is a black market user based on the abnormal behavior of a certain account, but cannot be associated with more black market users. For new black market users, there may be omissions. Therefore, how to improve the accuracy of identifying whether a user is at risk has become a problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, in order to solve the above-mentioned technical problems or part of the technical problems, an embodiment of the present invention provides a risk identification method, apparatus, computer equipment and storage medium.

[0005] In a first aspect, an embodiment of the present invention provides a risk identification method, including:

[0006] Construct multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform;

[0007] For each group of the user knowledge graphs, obtain the account cancellation ratio of multiple users, obtain the total number of accounts included in the user knowledge graphs, and obtain the degree of the target node in the user knowledge graphs;

[0008] Risk identification is performed on the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node.

[0009] In a possible implementation, the step of constructing multiple groups of user knowledge graphs based on attribute information of multiple users in the target platform includes:

[0010] Acquire attribute information of each user according to the real-time log of each user in the target platform, wherein the attribute information includes: account information, device identifier of the account information logged in, bound mobile phone number, and payment account;

[0011] The user knowledge graph is constructed according to the attribute information of each user using a maximum connected graph model to obtain multiple groups of user knowledge graphs.

[0012] In a possible implementation, obtaining the account cancellation ratios of the plurality of users includes:

[0013] Determine the deregistered account information carrying the deregistration mark from the user knowledge graph;

[0014] Obtaining a first quantity of the deregistered account information;

[0015] The account cancellation ratio is determined according to the first number and the total number of accounts.

[0016] In a possible implementation, the target node includes: a device identifier and / or a mobile phone number, and the risk identification of the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node includes:

[0017] When the account cancellation ratio is greater than a first threshold, the total number of accounts is greater than a second threshold, and the degree from the target node to the account information node is greater than a third threshold, it is determined that the user corresponding to the current user knowledge graph is at risk.

[0018] In a possible implementation, the risk identification of the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node includes:

[0019] When the account cancellation ratio is greater than a first threshold, the total number of accounts is less than or equal to a second threshold, and the degree from the target node to the account information node is greater than a third threshold, the current user knowledge graph is determined to be the target knowledge graph;

[0020] Monitoring all target account information in the target knowledge graph;

[0021] When any of the target account information is monitored to have abnormal behavior, it is determined that the user corresponding to the target knowledge graph is at risk.

[0022] In a possible implementation, the method further includes:

[0023] When the generated new user knowledge graph contains the attribute information of the risky user, determining that the user corresponding to the new user knowledge graph is risky;

[0024] Intercept risky users.

[0025] In a possible implementation, the method further includes:

[0026] When the account cancellation ratio is less than or equal to the first threshold, or the degree from the target node to the account information node is less than or equal to the third threshold, it is determined that there is no risk in the current user knowledge graph;

[0027] The step of constructing multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform is re-executed at intervals of a preset time.

[0028] In a second aspect, an embodiment of the present invention provides a risk identification device, including:

[0029] A construction module, used to construct multiple groups of user knowledge graphs based on attribute information of multiple users in the target platform;

[0030] An acquisition module, used for acquiring, for each group of the user knowledge graphs, a proportion of account cancellations of a plurality of the users, a total number of accounts included in the user knowledge graphs, and a degree of a target node in the user knowledge graphs;

[0031] An identification module is used to identify risks of the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node.

[0032] In a third aspect, an embodiment of the present invention provides a computer device, comprising: a processor and a memory, wherein the processor is used to execute a risk identification program stored in the memory to implement the risk identification method described in any one of the first aspects above.

[0033] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the risk identification method described in any one of the first aspects above.

[0034] The risk identification scheme provided by the embodiment of the present invention constructs multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform; for each group of the user knowledge graphs, obtains the account cancellation ratio of multiple users, obtains the total number of accounts contained in the user knowledge graph, and obtains the degree of the target node in the user knowledge graph; and identifies the risks of multiple users based on the account cancellation ratio, the total number of accounts, and the degree of the target node. Thus, a user knowledge graph can be generated based on the user's attribute information to identify risky users. The attribute information makes the correlation of each node in the generated knowledge graph stronger, and the generated nodes are richer. At the same time, the accuracy of risky user identification can be improved by identifying risky users through the node cancellation ratio, the total number of accounts, and the degree of the target node. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a risk identification method provided by an embodiment of the present invention;

[0036] Figure 2A schematic diagram of a flow chart of another risk identification method provided by an embodiment of the present invention;

[0037] Figure 3 A schematic diagram of the structure of a risk identification device provided by an embodiment of the present invention;

[0038] Figure 4 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention;

[0039] Figure 5 A schematic diagram of a user knowledge graph provided by an embodiment of the present invention;

[0040] Figure 6 A flowchart of another risk identification method provided by an embodiment of the present invention;

[0041] Figure 7 A schematic diagram of another user knowledge graph provided by an embodiment of the present invention;

[0042] Figure 8 A schematic diagram of another user knowledge graph provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0045] Figure 1 A flow chart of a risk identification method provided by an embodiment of the present invention is as follows: Figure 1 As shown, the method specifically includes:

[0046] S11. Construct multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform.

[0047] The risk identification method provided in the embodiment of the present invention is applied to computer equipment, which may include but is not limited to: servers, desktop computers, etc. Specifically, after obtaining the user's attribute information to build a user knowledge graph, the user's risk identification is performed based on the account cancellation ratio, the total number of accounts and the degree of the target node in the user knowledge graph.

[0048] In this embodiment, the target platform is a platform that needs to identify risks of users on the platform (for example, the target platform can be a video playback platform, a financial transaction platform, etc.), and the user's attribute information is obtained for each logged-in or registered user on the platform. Considering the stability of the data, data that is strongly associated with the user is selected as the attribute information, and to ensure the accuracy of the data, all mobile phone data is selected (mobile phones include: Android and IOS mobile phone APP data). The attribute information may include but is not limited to: account information (account ID), device identification of the device where the account information has been logged in, the mobile phone number bound to each account, the payment account, etc.

[0049] Furthermore, a heterogeneous graph is constructed based on the acquired attribute information, and a user knowledge graph is generated through a maximum connected graph model. The associated attribute information in the graph is connected to each other.

[0050] S12. For each group of the user knowledge graphs, obtain the account cancellation ratio of the multiple users, obtain the total number of accounts included in the user knowledge graphs, and obtain the degree of the target node in the user knowledge graphs.

[0051] In this embodiment, each account corresponds to an account information, the total number of all accounts contained in the user knowledge graph is obtained, when the account is cancelled, a cancellation mark is added to the account, it is identified whether the account information of each account in the user knowledge graph carries a cancellation mark, and the number of accounts carrying cancellation marks is counted, and the ratio of the number of accounts carrying cancellation marks to the total number of accounts is determined as the account cancellation ratio. And the degree of the node corresponding to a certain type of attribute information in the user knowledge graph is obtained (for example, the target node is a device identifier, a certain type of attribute information is account information, the total degree of each device identifier to each account information is obtained, and the number of account information connected to each device identifier in the user knowledge graph is obtained as the degree of the target node).

[0052] S13: performing risk identification on the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node.

[0053] In this embodiment, when it is determined that the account cancellation ratio is greater than the preset first threshold, the total number of accounts is greater than the preset second threshold, and the degree of the target node is greater than the third threshold, it is determined that all users corresponding to the user knowledge graph are at risk. All users can be marked as black market users or risky users and intercepted.

[0054] The risk identification method provided by the embodiment of the present invention constructs multiple groups of user knowledge graphs according to the attribute information of multiple users in the target platform; for each group of the user knowledge graphs, obtains the account cancellation ratio of multiple users, obtains the total number of accounts contained in the user knowledge graph, and obtains the degree of the target node in the user knowledge graph; and identifies the risks of multiple users according to the account cancellation ratio, the total number of accounts and the degree of the target node. Thus, a user knowledge graph can be generated according to the user's attribute information to identify risky users. The attribute information makes the correlation of each node in the generated knowledge graph stronger and the generated nodes richer. At the same time, the accuracy of risky user identification can be improved by identifying risky users through the node cancellation ratio, the total number of accounts and the degree of the target node.

[0055] Figure 2 A flow chart of another risk identification method provided by an embodiment of the present invention is as follows: Figure 2 As shown, the method specifically includes:

[0056] S21. Obtain attribute information of each user according to the real-time log of each user in the target platform, wherein the attribute information includes: account information, device identification used by the account information to log in, bound mobile phone number, and payment account; construct the user knowledge graph according to the attribute information of each user using the maximum connected graph model to obtain multiple groups of user knowledge graphs.

[0057] In this embodiment, the real-time log corresponding to each user on the target platform is obtained, and the data strongly associated with each user is obtained from the real-time log as the user's attribute information. The attribute information includes: the unique account information corresponding to each user's account, the device identifier of the device that each account information has logged in, and the mobile phone number and payment account bound to each account.

[0058] For example, the maximum connected graph model constructs a user knowledge graph based on the attribute information of each user. Each node in the user knowledge graph is an attribute information, and the related attribute information is connected to each other (for example, if account X has logged in to mobile phone A and mobile phone B, then the account information of account X is connected to the device identifier of mobile phone A and the device identifier of mobile phone B respectively), and multiple groups of user knowledge graphs are obtained. Figure 5 The figure shows a schematic diagram of a user knowledge graph provided by an embodiment of the present invention. Account A, Account B and Account C are all account information in the attribute information, Device A is the device identifier in the attribute information, Mobile Number A, Mobile Number B and Mobile Number C are the mobile numbers in the attribute information, and Payment Account C is the payment account in the attribute information. Figure 5 The user relationship graph shown.

[0059] S22, determining the deregistered account information carrying the deregistration mark from the user knowledge graph; obtaining a first number of the deregistered account information; determining the account deregistration ratio according to the first number and the total number of accounts. Obtaining the total number of accounts included in the user knowledge graph, and obtaining the degree of the target node in the user knowledge graph.

[0060] In this embodiment, a deregistered account will have a deregistration mark added to the account information. The account information carrying the deregistration mark is identified from the generated user knowledge graph as the deregistered account information. The first number of deregistered account information in each user knowledge graph is obtained, and the number of account information contained in the user knowledge graph is obtained as the total number of accounts. The ratio of the first number to the total number of accounts is used as the account deregistration ratio.

[0061] Furthermore, the device identifier and / or mobile phone number in the user knowledge graph is used as the target node, and the number of account information connected to each target node is obtained as the degree of the target node. That is, the number of account information connected to each device identifier and / or the number of account information connected to each mobile phone number is obtained as the degree of the target node. A user knowledge graph can contain one or more target nodes, that is, one or more degrees can be determined. Or, the number of account information that can be jumped from the target node is obtained as the degree.

[0062] S23. When the account cancellation ratio is greater than a first threshold, the total number of accounts is greater than a second threshold, and the degree from the target node to the account information node is greater than a third threshold, it is determined that the user corresponding to the current user knowledge graph is at risk.

[0063] In this embodiment, the user knowledge graph can be preliminarily screened according to the account cancellation ratio to reduce the processing pressure of subsequent judgment whether there is a risk. Specifically, the user knowledge graph with an account cancellation ratio greater than the fourth threshold can be screened first, and then a subsequent judgment can be made. First, when a large number of associated accounts are cancelled, there may be a risk. Therefore, it is judged whether the account cancellation ratio is greater than the first threshold. The first threshold is greater than or equal to the fourth threshold. In order to avoid misidentification due to too few accounts in the user knowledge graph, it is necessary to limit the total number of accounts, judge whether the total number of accounts is greater than the second threshold, and finally judge whether the degree is greater than the third threshold. When the account cancellation ratio is greater than the first threshold, the total number of accounts is greater than the second threshold, and the degree from any target node to the account information node is greater than the third threshold, it is determined that the user corresponding to all the attribute information contained in the current user knowledge graph is at risk. Users and associated accounts, devices, payment accounts, etc. with risks can be intercepted, blacklisted, etc.

[0064] In one possible implementation, when the account cancellation ratio is greater than the first threshold, the total number of accounts is less than or equal to the second threshold, and the degree from the target node to the account information node is greater than the third threshold, it indicates that the current user knowledge graph may be a risky user and needs long-term monitoring. At this time, the current user knowledge graph is determined to be the target knowledge graph;

[0065] All target account information in the target knowledge graph is monitored. The monitored content may be all activities of all nodes associated with the account information in the target platform, which can be obtained by monitoring real-time logs. When any target account information is monitored to have abnormal behavior, it is determined that the user corresponding to all attribute information contained in the target knowledge graph is at risk, wherein the abnormal behavior may be the user behavior monitored in the real-time log being a preset risk behavior (for example, the number of payments within a preset time period is greater than the number threshold, the payment amount is greater than the amount threshold, logging into different devices within a preset time period, etc.).

[0066] In one possible implementation, a new user knowledge graph may be regenerated at regular intervals. When the generated new user knowledge graph contains attribute information of a user who has been historically determined to be at risk, it is determined that the user corresponding to the new user knowledge graph is at risk; and the risky user is intercepted.

[0067] In one possible implementation, when the account cancellation ratio is less than or equal to a first threshold, or the degree from the target node to the account information node is less than or equal to a third threshold, it is determined that the current user knowledge graph does not have risks; the step of constructing multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform is re-executed at every preset time interval, that is, the judgment is repeated at every period of time whether there are users without risks who have turned into users with risks, so as to avoid omissions during identification.

[0068] As an example, Figure 6 As shown, it is a flow chart of another risk identification method provided by an embodiment of the present invention, step 1: obtaining attribute information based on real-time log data, including: user (account information), user's device (device identification), mobile phone number used by the user, and user's payment account.

[0069] Example of attribute information:

[0070] TIME1: [User A], [Device A], [Device B], [Mobile Number A]

[0071] TIME2: [User B], [Device A], [Device C], [Mobile Number B], [Payment Account B]

[0072] TIME3: [User C], [Payment Account B]

[0073] …

[0074] Step 2: Construct a heterogeneous graph and generate multiple groups of user knowledge graphs through the maximum connected graph model.

[0075] Step 3: Combined with the logout mark contained in the account information, count the total number of accounts M in each group of user indication maps and the number of logout account information N with the logout mark in the group.

[0076] Step 4: Calculate the account cancellation ratio N / M in the group. Combined with business information, preliminarily screen the user knowledge graph with N / M>X, which is the data of suspected black market user characteristics.

[0077] Step 5: Upload the data to real-time risk control for monitoring and conduct correlation analysis with known black industries. According to the confirmed black industry gangs, it is possible to be a trusted black industry feature when the threshold N / M>Y (first threshold) is confirmed again, and it is suspected to be a batch registration. At the same time, it is found that when the number of accounts in the group is too small, misidentification will occur. Combined with the business situation, it is confirmed that when the total number of accounts in the group M>10 (second threshold), the proportion of false positives is the smallest.

[0078] Step 6: Combined with the group graph, it is found that there is a case of accidental injury, such as Figure 7 FIG. 1 is another schematic diagram of a user knowledge graph provided by an embodiment of the present invention. Figure 8 Shown is another user knowledge graph schematic diagram provided by an embodiment of the present invention. Figure 7 and 8 In the example, account information can include: account A\B\C, and device identification can include: device A. Account B and account C have been deregistered, and the account deregistration ratio of the two graphs is 67%. However, account registration and deregistration are strongly related to mobile phone numbers and devices, that is, whether the account is registered / deregistered with the same mobile phone number and whether the account is registered / deregistered with the same device is obviously Figure 8 Therefore, it is necessary to increase the graph morphology restrictions, that is, when the number of accounts associated with a device in one hop or the number of accounts associated with a mobile phone number in one hop, or the degree from the device to the account, or the degree from the mobile phone number to the account is > 5 (the third threshold), the proportion of false positives is minimized.

[0079] Step 7: Confirm the interception threshold to obtain the risk control strategy: N / M>Y, and M>10, and the number of accounts associated with the device in one hop or the number of accounts associated with the mobile phone number in one hop>5, which determines that there is a risk.

[0080] Step 8: The above are all statistical analyses of the account, but the account has been cancelled and subsequent services are unavailable. It is necessary to find the user knowledge graph that meets the conditions of step 7, determine the device identification, account information, mobile phone number and other sinking lists corresponding to all attribute information contained in the user knowledge graph for interception. Prevent the black industry from using the same material information to register / cancel repeatedly.

[0081] The risk identification method provided by the embodiment of the present invention obtains the attribute information of each user according to the real-time log of each user in the target platform, and the attribute information includes: account information, device identification of the account information logged in, bound mobile phone number, and payment account; the user knowledge graph is constructed according to the attribute information of each user using the maximum connected graph model to obtain multiple groups of user knowledge graphs. Determine the deregistered account information carrying the deregistration mark from the user knowledge graph; obtain the first number of the deregistered account information; determine the account deregistration ratio according to the first number and the total number of accounts. Obtain the total number of accounts contained in the user knowledge graph, and obtain the degree of the target node in the user knowledge graph. When the account deregistration ratio is greater than the first threshold, and the total number of accounts is greater than the second threshold, and the degree from the target node to the account information node is greater than the third threshold, it is determined that the user corresponding to the current user knowledge graph is at risk. In this way, a user knowledge graph can be generated based on the user's attribute information to identify risky users. The attribute information makes the correlation of each node in the generated knowledge graph stronger and the generated nodes richer. At the same time, risky users can be identified through the node cancellation ratio, the total number of accounts and the degree of the target node, which can improve the accuracy of risky user identification.

[0082] Figure 3 A schematic diagram of a risk identification device provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, the device specifically includes:

[0083] A construction module 31, used to construct multiple groups of user knowledge graphs according to attribute information of multiple users in the target platform;

[0084] An acquisition module 32, for acquiring, for each group of the user knowledge graphs, a proportion of account cancellations of a plurality of the users, a total number of accounts included in the user knowledge graphs, and a degree of a target node in the user knowledge graphs;

[0085] The identification module 33 is used to identify the risks of the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node.

[0086] In a possible implementation, the construction module is specifically used to obtain attribute information of each user according to the real-time log of each user in the target platform, and the attribute information includes: account information, device identifier of the account information logged in, bound mobile phone number, and payment account;

[0087] The user knowledge graph is constructed according to the attribute information of each user using a maximum connected graph model to obtain multiple groups of user knowledge graphs.

[0088] In a possible implementation, the acquisition module is specifically used to determine the deregistered account information carrying a deregistration mark from the user knowledge graph;

[0089] Obtaining a first quantity of the deregistered account information;

[0090] The account cancellation ratio is determined according to the first number and the total number of accounts.

[0091] In a possible implementation, the identification module is specifically configured to determine that a user corresponding to the current user knowledge graph is at risk when the account cancellation ratio is greater than a first threshold, the total number of accounts is greater than a second threshold, and the degree from the target node to the account information node is greater than a third threshold.

[0092] In a possible implementation, the identification module is specifically configured to determine that the current user knowledge graph is the target knowledge graph when the account cancellation ratio is greater than a first threshold, the total number of accounts is less than or equal to a second threshold, and the degree from the target node to the account information node is greater than a third threshold;

[0093] Monitoring all target account information in the target knowledge graph;

[0094] When any of the target account information is monitored to have abnormal behavior, it is determined that the user corresponding to the target knowledge graph is at risk.

[0095] In a possible implementation, the identification module is further configured to determine that a user corresponding to the new user knowledge graph is at risk when the generated new user knowledge graph contains attribute information of the risky user;

[0096] The interception module 34 is used to intercept risky users.

[0097] In a possible implementation, the identification module is further configured to determine that there is no risk in the current user knowledge graph when the account cancellation ratio is less than or equal to a first threshold, or the degree from the target node to the account information node is less than or equal to a third threshold;

[0098] The construction module is also used to re-execute the step of constructing multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform at intervals of a preset time.

[0099] The risk identification device provided in this embodiment can be as follows Figure 3 The device shown in FIG. 1 can perform the following steps: Figure 1-2 All steps of the risk identification method, thereby achieving Figure 1-2 For details, please refer to the technical effects of the risk identification method shown. Figure 1-2For the sake of brevity, the relevant description is not repeated here.

[0100] Figure 4 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention, Figure 4 The computer device 400 shown includes: at least one processor 401, a memory 402, at least one network interface 404 and other user interfaces 403. The various components in the computer device 400 are coupled together via a bus system 405. It is understood that the bus system 405 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 405 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 405 is not shown in FIG. Figure 4 Various buses are labeled as bus system 405 .

[0101] The user interface 403 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0102] It can be understood that the memory 402 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 402 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0103] In some implementations, the memory 402 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 4021 and application programs 4022 .

[0104] The operating system 4021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 4022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 4022.

[0105] In the embodiment of the present invention, by calling the program or instruction stored in the memory 402, specifically, the program or instruction stored in the application 4022, the processor 401 is used to execute the method steps provided by each method embodiment, for example, including:

[0106] Construct multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform;

[0107] For each group of the user knowledge graphs, obtain the account cancellation ratio of multiple users, obtain the total number of accounts included in the user knowledge graphs, and obtain the degree of the target node in the user knowledge graphs;

[0108] Risk identification is performed on the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node.

[0109] In a possible implementation, attribute information of each user is obtained according to the real-time log of each user in the target platform, and the attribute information includes: account information, device identifiers used to log in with the account information, bound mobile phone numbers, and payment accounts;

[0110] The user knowledge graph is constructed according to the attribute information of each user using a maximum connected graph model to obtain multiple groups of user knowledge graphs.

[0111] In a possible implementation, deregistered account information carrying a deregistration mark is determined from the user knowledge graph;

[0112] Obtaining a first quantity of the deregistered account information;

[0113] The account cancellation ratio is determined according to the first number and the total number of accounts.

[0114] In a possible implementation, when the account cancellation ratio is greater than a first threshold, the total number of accounts is greater than a second threshold, and the degree from the target node to the account information node is greater than a third threshold, it is determined that the user corresponding to the current user knowledge graph is at risk.

[0115] In a possible implementation, when the account cancellation ratio is greater than a first threshold, the total number of accounts is less than or equal to a second threshold, and the degree from the target node to the account information node is greater than a third threshold, the current user knowledge graph is determined to be the target knowledge graph;

[0116] Monitoring all target account information in the target knowledge graph;

[0117] When any of the target account information is monitored to have abnormal behavior, it is determined that the user corresponding to the target knowledge graph is at risk.

[0118] In a possible implementation, when the generated new user knowledge graph contains attribute information of the risky user, it is determined that the user corresponding to the new user knowledge graph is risky;

[0119] Intercept risky users.

[0120] In a possible implementation, when the account cancellation ratio is less than or equal to a first threshold, or the degree from the target node to the account information node is less than or equal to a third threshold, it is determined that there is no risk in the current user knowledge graph;

[0121] The step of constructing multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform is re-executed at intervals of a preset time.

[0122] The method disclosed in the above embodiment of the present invention can be applied to the processor 401, or implemented by the processor 401. The processor 401 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 401 or the instruction in the form of software. The above processor 401 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 402, and the processor 401 reads the information in the memory 402 and completes the steps of the above method in combination with its hardware.

[0123] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0124] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0125] The computer device provided in this embodiment may be Figure 4 The device shown in , can be executed as Figure 1-2 All steps of the risk identification method, thereby achieving Figure 1-3 For details, please refer to the technical effects of the risk identification method shown. Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0126] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0127] When one or more programs in the storage medium can be executed by one or more processors, the risk identification method executed on the device side can be implemented.

[0128] The processor is used to execute the risk identification program stored in the memory to implement the following steps of the risk identification method performed on the device side:

[0129] Construct multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform;

[0130] For each group of the user knowledge graphs, obtain the account cancellation ratio of multiple users, obtain the total number of accounts included in the user knowledge graphs, and obtain the degree of the target node in the user knowledge graphs;

[0131] Risk identification is performed on the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node.

[0132] In a possible implementation, attribute information of each user is obtained according to the real-time log of each user in the target platform, and the attribute information includes: account information, device identifiers used to log in with the account information, bound mobile phone numbers, and payment accounts;

[0133] The user knowledge graph is constructed according to the attribute information of each user using a maximum connected graph model to obtain multiple groups of user knowledge graphs.

[0134] In a possible implementation, deregistered account information carrying a deregistration mark is determined from the user knowledge graph;

[0135] Obtaining a first quantity of the deregistered account information;

[0136] The account cancellation ratio is determined according to the first number and the total number of accounts.

[0137] In a possible implementation, when the account cancellation ratio is greater than a first threshold, the total number of accounts is greater than a second threshold, and the degree from the target node to the account information node is greater than a third threshold, it is determined that the user corresponding to the current user knowledge graph is at risk.

[0138] In a possible implementation, when the account cancellation ratio is greater than a first threshold, the total number of accounts is less than or equal to a second threshold, and the degree from the target node to the account information node is greater than a third threshold, the current user knowledge graph is determined to be the target knowledge graph;

[0139] Monitoring all target account information in the target knowledge graph;

[0140] When any of the target account information is monitored to have abnormal behavior, it is determined that the user corresponding to the target knowledge graph is at risk.

[0141] In a possible implementation, when the generated new user knowledge graph contains attribute information of the risky user, it is determined that the user corresponding to the new user knowledge graph is risky;

[0142] Intercept risky users.

[0143] In a possible implementation, when the account cancellation ratio is less than or equal to a first threshold, or the degree from the target node to the account information node is less than or equal to a third threshold, it is determined that there is no risk in the current user knowledge graph;

[0144] The step of constructing multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform is re-executed at intervals of a preset time.

[0145] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0146] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0147] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A risk identification method, characterized in that: include: Construct multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform; For each group of the user knowledge graphs, obtain the account cancellation ratio of multiple users, obtain the total number of accounts included in the user knowledge graphs, and obtain the degree of the target node in the user knowledge graphs; Risk identification is performed on the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node.

2. The method according to claim 1, characterized in that The method of constructing multiple groups of user knowledge graphs according to the attribute information of multiple users in the target platform includes: Acquire attribute information of each user according to the real-time log of each user in the target platform, wherein the attribute information includes: account information, device identifier of the account information logged in, bound mobile phone number, and payment account; The user knowledge graph is constructed according to the attribute information of each user using a maximum connected graph model to obtain multiple groups of user knowledge graphs.

3. The method according to claim 1, characterized in that The obtaining of account cancellation ratios of the plurality of users includes: Determine the deregistered account information carrying the deregistration mark from the user knowledge graph; Obtaining a first quantity of the deregistered account information; The account cancellation ratio is determined according to the first number and the total number of accounts.

4. The method according to claim 1, characterized in that: The target node includes: a device identifier and / or a mobile phone number, and the risk identification of the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node includes: When the account cancellation ratio is greater than a first threshold, the total number of accounts is greater than a second threshold, and the degree from the target node to the account information node is greater than a third threshold, it is determined that the user corresponding to the current user knowledge graph is at risk.

5. The method according to claim 4, characterized in that The risk identification of the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node includes: When the account cancellation ratio is greater than a first threshold, the total number of accounts is less than or equal to a second threshold, and the degree from the target node to the account information node is greater than a third threshold, the current user knowledge graph is determined to be the target knowledge graph; Monitoring all target account information in the target knowledge graph; When any of the target account information is monitored to have abnormal behavior, it is determined that the user corresponding to the target knowledge graph is at risk.

6. The method according to any one of claims 4 or 5, characterized in that: The method further comprises: When the generated new user knowledge graph contains the attribute information of the risky user, determining that the user corresponding to the new user knowledge graph is risky; Intercept risky users.

7. The method according to claim 5, characterized in that The method further comprises: When the account cancellation ratio is less than or equal to the first threshold, or the degree from the target node to the account information node is less than or equal to the third threshold, it is determined that there is no risk in the current user knowledge graph; The step of constructing multiple groups of user knowledge graphs based on the attribute information of multiple users in the target platform is re-executed at intervals of a preset time.

8. A risk identification device, characterized in that: include: A construction module, used to construct multiple groups of user knowledge graphs based on attribute information of multiple users in the target platform; An acquisition module, used for acquiring, for each group of the user knowledge graphs, the account cancellation ratio of the plurality of users, the total number of accounts included in the user knowledge graphs, and the degree of the target node in the user knowledge graphs; An identification module is used to identify risks of the plurality of users according to the account cancellation ratio, the total number of accounts and the degree of the target node.

9. A computer device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a risk identification program stored in the memory to implement the risk identification method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the risk identification method according to any one of claims 1 to 7.

Images