A data processing method, apparatus and device

Abstract

The embodiments of this specification provide a data processing method, apparatus, and device. Among them, the method includes: receiving a risk detection request for a target user; in response to the risk detection request, obtaining the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user; inputting the data to be detected into the first module of a pre-trained detection model for feature extraction processing to obtain a feature vector corresponding to each piece of the feature data, where the node association relationship between the first data processing layers is determined according to the feature data; through the second module of the pre-trained detection model, performing feature detection processing on the relationships between multiple feature vectors, and determining a risk detection result for the target user according to the feature detection result.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular, to a data processing method, apparatus, and device. Background Art

[0002] As people pay more and more attention to their privacy data, in order to protect user privacy and ensure data security, it is necessary to detect whether a user is a risky user to ensure the data security of the user. For example, it is possible to detect whether a user is a risky user by means of manual analysis of user data by security personnel.

[0003] However, due to the increasing complexity of the data structure and the increasing amount of user data, the detection efficiency and accuracy of risk detection by manual analysis are low. Therefore, the embodiments of this specification provide a better technical solution for risk detection of users. Summary of the Invention

[0004] The purpose of the embodiments of this specification is to provide a better technical solution for risk detection of users.

[0005] To achieve the above technical solution, the embodiments of this specification are implemented as follows:

[0006] A data processing method provided by the embodiments of this specification, the method includes: receiving a risk detection request for a target user; in response to the risk detection request, obtaining the data to be detected corresponding to the target user, the data to be detected including multi-modal feature data related to the resource transfer behavior of the target user; inputting the data to be detected into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through a learnable activation function on the edge based on the nodes corresponding to each of the feature data in multiple first data processing layers in the first module, and obtaining a feature vector corresponding to each of the feature data, wherein the node association relationship between the first data processing layers is determined according to the feature data; through the second module of the pre-trained detection model, performing feature detection processing on the relationship between multiple feature vectors, and determining a risk detection result for the target user according to the feature detection result.

[0007] A data processing device provided by an embodiment of this specification, the device includes: a request receiving module, configured to receive a risk detection request for a target user; a data acquisition module, configured to, in response to the risk detection request, acquire the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user; a first processing module, configured to input the data to be detected into a first module of a pre-trained detection model for feature extraction processing, so as to summarize and process the input information obtained by processing the output result of the previous node of the node through a learnable activation function on the edge by nodes corresponding to each of the feature data in multiple first data processing layers in the first module, to obtain a feature vector corresponding to each of the feature data, where the node association relationship between the first data processing layers is determined according to the feature data; a risk detection module, configured to perform feature detection processing on the relationship between multiple feature vectors through a second module of the pre-trained detection model, and determine a risk detection result for the target user according to the feature detection result.

[0008] A data processing device provided by an embodiment of this specification, the data processing device includes: a processor; and a memory arranged to store computer-executable instructions, the executable instructions, when executed, cause the processor to: receive a risk detection request for a target user; in response to the risk detection request, acquire the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user; input the data to be detected into a first module of a pre-trained detection model for feature extraction processing, so as to summarize and process the input information obtained by processing the output result of the previous node of the node through a learnable activation function on the edge by nodes corresponding to each of the feature data in multiple first data processing layers in the first module, to obtain a feature vector corresponding to each of the feature data, where the node association relationship between the first data processing layers is determined according to the feature data; perform feature detection processing on the relationship between multiple feature vectors through a second module of the pre-trained detection model, and determine a risk detection result for the target user according to the feature detection result.

[0009] An embodiment of this specification also provides a storage medium for storing computer-executable instructions, and when the executable instructions are executed by a processor, the following processes are implemented: receiving a risk detection request for a target user; in response to the risk detection request, obtaining the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user; inputting the data to be detected into a first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through a learnable activation function on the edge by nodes corresponding to each piece of the feature data in multiple first data processing layers in the first module, and obtaining a feature vector corresponding to each piece of the feature data, where the node association relationship between the first data processing layers is determined according to the feature data; through a second module of the pre-trained detection model, performing feature detection processing on the relationship between multiple feature vectors, and determining a risk detection result for the target user according to the feature detection result.

[0010] An embodiment of this specification also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the following processes are implemented: receiving a risk detection request for a target user; in response to the risk detection request, obtaining the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user; inputting the data to be detected into a first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through a learnable activation function on the edge by nodes corresponding to each piece of the feature data in multiple first data processing layers in the first module, and obtaining a feature vector corresponding to each piece of the feature data, where the node association relationship between the first data processing layers is determined according to the feature data; through a second module of the pre-trained detection model, performing feature detection processing on the relationship between multiple feature vectors, and determining a risk detection result for the target user according to the feature detection result. Description of the Drawings

[0011] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments recorded in this specification. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts;

[0012] Figure 1 This is an embodiment of a data processing method in this specification;

[0013] Figure 2 It is a schematic structural diagram of a first module in this specification;

[0014] Figure 3 It is another embodiment of a data processing method in this specification;

[0015] Figure 4 It is a schematic structural diagram of a second module in this specification;

[0016] Figure 5 It is a schematic structural diagram of a detection model in this specification;

[0017] Figure 6 It is a schematic diagram of a model evaluation result in this specification;

[0018] Figure 7 It is another embodiment of a data processing method in this specification;

[0019] Figure 8 It is an embodiment of a data processing device in this specification;

[0020] Figure 9 It is an embodiment of a data processing device in this specification. Specific embodiments

[0021] The embodiments of this specification provide a data processing method, device and equipment.

[0022] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this specification. Obviously, the described embodiments are only a part of the embodiments of this specification, rather than all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of this specification.

[0023] The embodiments of this specification provide a detection mechanism for whether a user is a risky user. As people pay more and more attention to their privacy data, in order to protect user privacy and ensure data security, it is necessary to detect whether a user is a risky user to ensure the data security of the user. For example, security personnel can manually analyze user data to detect whether a user is a risky user. However, due to the increasingly complex data structure and large data volume of user data, the detection efficiency and accuracy of risk detection by manual analysis are low. Therefore, the embodiments of this specification provide a better technical solution for risk detection of users. In this solution, by receiving a risk detection request for a target user, in response to the risk detection request, the data to be detected corresponding to the target user is obtained, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user. The data to be detected is input into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node based on the learnable activation function on the edge through the nodes corresponding to each feature data in multiple first data processing layers in the first module, and obtain a feature vector corresponding to each feature data. Among them, the node association relationship between the first data processing layers is determined according to the feature data. Through the second module of the pre-trained detection model, the relationship between multiple feature vectors is subjected to feature detection processing, and the risk detection result for the target user is determined according to the feature detection result. In this way, when the data structure of the feature data included in the data to be detected is becoming more and more complex, the first module of the pre-trained detection model can first perform feature extraction processing on each feature data to obtain a feature vector corresponding to each feature data, that is, the first module can enhance the feature expression ability of the feature data, and then through the second model of the pre-trained detection model, the relationship between multiple feature vectors is subjected to feature detection processing to quickly and accurately determine the risk detection result for the target user through the feature detection result, improving the detection efficiency and accuracy of risk detection for users. The specific processing can refer to the specific content in the following embodiments.

[0024] As Figure 1 As shown, the embodiments of this specification provide a data processing method. The execution subject of this method can be a server. The server can be an independent server or a server cluster composed of multiple servers. The server can be a background server such as a financial business or an online shopping business, or a background server of a certain application program. In this embodiment, the execution subject is taken as an example of a server for detailed description. The method can specifically include the following steps:

[0025] In step S102, a risk detection request for a target user is received.

[0026] Among them, the target user can be any user who triggers the execution of a resource transfer behavior. For example, the target user can be a user who triggers a resource transfer behavior such as transferring money, lending, etc. to a certain user (or a third party such as a resource transfer platform or a business service provider).

[0027] In implementation, the server can regularly trigger a risk detection request for the target user according to a preset detection period. For example, the server can trigger a risk detection request for the target user every 10 days.

[0028] In addition, the server can also set different detection periods according to the different types of resource transfer behaviors triggered by the target user. For example, since the real-time nature of the transfer behavior is stronger and the real-time nature of the lending behavior is weaker, for the transfer behavior, the server can trigger a risk detection request for the target user at the same time as receiving the transfer behavior triggered by the target user. For the lending behavior, the server can set different detection periods according to the priority of the lending business. Specifically, for a lending business with a higher priority, the detection period can be set to 3 days, and for a lending business with a lower priority, the detection period can be set to one week.

[0029] In addition, the server can also detect whether the user data of the user has changed, and trigger a risk detection request for the user (i.e., the target user) when it detects that the user data has changed. For example, when the server detects that the username of a certain user has changed, it can determine the user as the target user and trigger a risk detection request for the target user.

[0030] The above method for obtaining the risk detection request for the target user is an optional and implementable obtaining method. In actual application scenarios, there can also be various different obtaining methods, and different obtaining methods can be selected according to different actual application scenarios. This specification does not make specific limitations on this.

[0031] In step S104, in response to the risk detection request, obtain the data to be detected corresponding to the target user.

[0032] Among them, the data to be detected can include multi-modal feature data related to the resource transfer behavior of the target user. For example, the data to be detected can include but is not limited to text data, image data, video data, and audio data related to the resource transfer behavior of the target user. Specifically, the text data can include data such as the username and address of the target user, the image data can be voucher image data for the target user to trigger the resource transfer behavior, the video data can be relevant video data of the resource transfer process of the target user, and the audio data can include interaction data between the target user and other users.

[0033] In step S106, the data to be detected is input into the first module of a pre-trained detection model for feature extraction processing. Through the nodes corresponding to each feature data in multiple first data processing layers in the first module, based on the learnable activation functions on the edges, the input information obtained by processing the output result of the previous node of the node is aggregated to obtain feature vectors corresponding to each feature data.

[0034] Among them, the node association relationship between the first data processing layers can be determined according to the feature data.

[0035] In implementation, taking the first module as an example of a module constructed based on the Kolmogorov - Arnold Network (KAN network), the KAN network sets the activation function on the edge (weight) of the network instead of the traditional node, and these activation functions are scientific continuous functions and can be parameterized by B - Spline. Among them, the B - Spline is a local and piecewise polynomial curve, and the coefficients of the B - Spline are scientific. By stacking KAN layers composed of function matrices with learnable parameters, the depth of the KAN network can be extended, enabling the KAN network to have good interpretability and expression ability, and the KAN network has good effects in fields such as data fitting and partial differential equation solving.

[0036] For any continuous multivariate function defined on a closed interval, the KAN network can be written as a finite composition of continuous functions of single variables and addition operations. The KAN network provides a powerful non - linear fitting ability by introducing learnable parameters in the activation operation.

[0037] As Figure 2 shown, taking the first module including a KAN network composed of 2 layers of first data processing layers as an example, among them, the formula for each layer of the first data processing layer can be:

[0038] ,

[0039] Among them, f is a continuous function of n variables x, is the outer - layer function, is the inner - layer function, and both the outer - layer function and the inner - layer function are single - variable functions. The KAN network can be determined by learning the inner - layer function and the outer - layer function.

[0040] In addition, the above formula can also be represented by a combination of B - spline functions, that is

[0041] ,

[0042] Among them, is the i - th B - spline function, and is a preset weight, and is the control coefficient of the i-th B-spline function.

[0043] The server can separately input each piece of feature data included in the data to be detected into the first module of the pre-trained detection model. In this way, through the first module constructed by the KAN network, feature extraction processing can be performed on each piece of feature data to obtain the feature vector corresponding to each piece of feature data.

[0044] Among them, the input information of the nodes in the first data processing layer of the first layer is the feature data, and the input information of the nodes in the other first data processing layers except the first layer is obtained by summarizing the input information obtained by processing the output result of the previous node of the node based on the learnable activation function on the edge.

[0045] In step S108, through the second module of the pre-trained detection model, feature detection processing is performed on the relationship between multiple feature vectors, and the risk detection result for the target user is determined according to the feature detection result.

[0046] Among them, the second module can be a module constructed based on any machine learning algorithm that can be used to perform feature detection processing on the relationship between multiple feature vectors.

[0047] In implementation, the server can perform feature detection processing on the relationship between multiple feature vectors through the second module of the pre-trained detection model, and then perform classification processing according to the feature detection result to determine the risk detection result for the target user according to the classification result. Among them, the risk detection result of the target user can include the risk type to which the target user belongs. For example, the risk type can be multiple types such as high risk, medium risk, and low risk.

[0048] An embodiment of this specification provides a data processing method. By receiving a risk detection request for a target user, in response to the risk detection request, obtaining the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user, inputting the data to be detected into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node based on the learnable activation function on the edge through the nodes corresponding to each feature data in multiple first data processing layers in the first module, and obtaining a feature vector corresponding to each feature data, where the node association relationship between the first data processing layers is determined according to the feature data, and through the second module of the pre-trained detection model, performing feature detection processing on the relationship between multiple feature vectors, and determining the risk detection result for the target user according to the feature detection result. In this way, in the case where the data structure of the feature data included in the data to be detected becomes more and more complex, the first module of the pre-trained detection model can be used to perform feature extraction processing on each feature data first, and obtain the feature vector corresponding to each feature data, that is, the feature expression ability of the feature data can be enhanced through the first module, and then through the second model of the pre-trained detection model, perform feature detection processing on the relationship between multiple feature vectors, so as to quickly and accurately determine the risk detection result for the target user according to the feature detection result, and improve the detection efficiency and detection accuracy of user risk detection.

[0049] In practical applications, the activation function of the second module can be located at the network nodes of the second module, and the activation function of the second module can be a non-learnable activation function. Correspondingly, before step S106, the detection model can also be trained. The specific processing method of model training can be various. The following provides an optional processing method, as Figure 3 shown, which can specifically include the processing of the following steps S302~S310.

[0050] In step S302, historical sample data is obtained.

[0051] Among them, the historical sample data can include the historical detection data corresponding to the historical user and the historical risk detection result corresponding to the historical user. The historical detection data includes multi-modal feature data related to the resource transfer behavior of the historical user.

[0052] In implementation, the server can determine the historical detection data and the historical risk detection result corresponding to the historical user stored during the model training period as the historical sample data.

[0053] In step S304, the historical detection data is input into the first module of the detection model for feature extraction processing to obtain historical feature vectors corresponding to each piece of historical feature data.

[0054] In practical applications, the specific processing method of inputting the historical detection data into the first module of the detection model for feature extraction processing to obtain historical feature vectors corresponding to each piece of historical feature data in step S304 above can be various. The following provides an optional processing method, which can specifically include the processing of steps A1 to A2 below.

[0055] In step A1, according to the data processing format corresponding to the detection model, format conversion processing is performed on the historical detection data to obtain the converted historical detection data.

[0056] In implementation, since the historical detection data contains multi-modal feature data, the server can convert the data format of the historical detection data into a data processing format that the detection model can process according to the data processing format corresponding to the detection model, that is, the server can perform format conversion processing on the historical detection data according to the data processing format corresponding to the detection model to obtain the converted historical detection data.

[0057] For example, taking the tabular data in the historical detection data as an example, assuming that the data processing format corresponding to the detection model is the 0-1 format, that is, the data that the detection model can process is 0 or 1, then the server can convert the feature data in the tabular data into the 0-1 format. Specifically, assuming that the feature data of the user type includes type 1 and type 2, then the server can convert type 1 to 0 and type 2 to 1. In this way, the data format of the obtained converted historical detection data is the data processing format that the detection model can process, and the server can directly input the converted historical detection data into the detection model for processing. This avoids the problem that the detection model cannot process the feature data due to the existence of feature data in the historical detection data that does not conform to the data processing format corresponding to the detection model.

[0058] In step A2, the converted historical detection data is input into the first module of the detection model for feature extraction processing to obtain historical feature vectors corresponding to each piece of historical feature data.

[0059] In implementation, the server can input the converted historical detection data into the first module of the detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node based on the learnable activation function on the edge through the nodes corresponding to each piece of historical feature data in multiple first data processing layers in the first module, and obtain the feature vectors corresponding to each piece of historical feature data.

[0060] In step S306, through the second module of the detection model, feature detection processing is performed on the relationships between multiple historical feature vectors, and a first risk detection result for the historical user is determined according to the feature detection result.

[0061] In implementation, as Figure 4 shown, taking the second module constructed by the Multilayer Perceptron (MLP) algorithm as an example, where the formula for a single-layer MLP can be

[0062] ,

[0063] where, is the activation function, is the preset weight, is the bias.

[0064] The second module can be a stack of multiple MLP layers, that is .

[0065] In addition, in practical applications, the second module can include multiple second data processing layers. The second data processing layer can be used to determine the output data of the second data processing layer according to the first mapping result and the second mapping result. The first mapping result can be determined according to the input data of the second data processing layer, the first preset weight, and the first preset bias. The second mapping result can be determined according to the input data of the second data processing layer, the second preset weight, the second preset bias, and the preset gating activation function.

[0066] For example, the second module can be a MLP algorithm with a gating mechanism (GatedMLP). By introducing a gating signal to dynamically control the information flow, the selective processing ability of the model can be enhanced. GatedMLP is an architecture that combines the gating mechanism and MLP. Therefore, the SwiGLU activation function can be adopted, and this activation function can be expressed by the following formula

[0067] ,

[0068] where, , X is the input data, Y is the output data, is the preset gating activation function, V is the first preset weight, is the first preset bias, U is the second preset weight, is the second preset bias. As Figure 4 shown, U and V can respectively represent linear mappings in different channels.

[0069] In this way, according to the first module constructed by the KAN network and the second module constructed by the GatedMLP algorithm, it is possible to construct asFigure 5 For the detection model shown, when processing feature data such as tabular data, for each piece of feature data, it is possible to first perform a transformation through the KAN network of the first module, and then use GatedMLP to expand the depth of the network and improve the expression ability of the model.

[0070] That is, for the input data X, it can be expressed by the following formula

[0071] .

[0072] In step S308, according to the first risk detection result and the historical risk detection result, determine whether the detection model converges.

[0073] In implementation, it is possible to determine the loss value according to the first risk detection result, the historical risk detection result, and a preset loss function, and determine whether the detection model converges according to the loss value.

[0074] In step S310, in the case where it is determined that the detection model does not converge, update the parameters of the activation function of the first module and the weights of the edges between the nodes in the second module, and continue to train the updated detection model according to the historical sample data until the detection model converges to obtain the trained detection model.

[0075] In implementation, after obtaining the trained detection model, it is possible to test the trained detection model based on a preset validation data set and determine the evaluation result of the trained detection model according to preset evaluation metrics (such as KS, AUC, etc.).

[0076] In addition, it is also possible to perform a comparative verification on the models constructed by other network structures based on a preset validation data set. For example, it is possible to select a detection model including a three-layer network structure (such as the first module includes a first data processing layer, and the second module includes two second data processing layers) and other comparative models, and determine the KS and AUC metric values of each model based on the preset validation data set with different data volumes. The specific evaluation results can be as shown in Table 1 below.

[0077] Table 1

[0078]

[0079] It can be seen from the evaluation results in Table 1 above that the prediction effect of the detection model is good, and as the data volume of the processed data increases, the model effect of the detection model also has a more obvious improvement compared with the effect of Model 1 constructed by LightGBM. In addition, there are also obvious improvements in other business scenarios, and the convergence speed is also faster. Among them, the KS metric value for model verification based on the above validation data set can be as Figure 6As shown, it can be seen from the figure that the evaluation effect of the detection model is good.

[0080] In practical applications, the specific processing method for updating the weights of the edges between nodes in the second module in step S310 can be various. The following provides an optional processing method, which can specifically include the processing of step B1.

[0081] In step B1, update the weights of the edges between the second module nodes, as well as the first preset weight, the first preset deviation, the second preset weight, and the second preset deviation in each second data processing layer.

[0082] In practical applications, the data to be detected can include image data, the resource transfer behavior sequence data of the target user, table data, and graph structure data. The graph structure data can be constructed based on the resource transfer relationship between the target user and other users.

[0083] Among them, the image data can be image data containing user information such as the user identifier of the target user. The resource transfer behavior sequence data can include the resource transfer behavior sequence data of the target user, operation behavior sequence data, etc. The table data can be table data containing the transaction feature data and identity feature data of the target user. The graph structure data can include graph structure data constructed based on the association relationship between the target user and other users, graph structure data constructed based on the association relationship between the devices of the target user, graph structure data constructed based on the resource flow relationship of the target user, etc.

[0084] In practical applications, after obtaining the risk detection result of the target user, it is also possible to determine the service processing result of the resource transfer service triggered for the target user according to the risk detection result. The specific processing method for determining the service processing result can be various. The following provides an optional processing method, as Figure 7 shown, which can specifically include the processing of steps S702~S704.

[0085] In step S702, receive the trigger request of the target user for the resource transfer service.

[0086] In implementation, the target user can trigger an execution instruction for the resource transfer service through the resource transfer application program in the terminal device. The terminal device can send a trigger request of the target user for the resource transfer service to the server, that is, the server can receive the trigger request of the target user for the resource transfer service.

[0087] In step S704, in response to the trigger request, determine the service processing result for the resource transfer service according to the risk detection result of the target user.

[0088] In implementation, if the risk detection result of the target user indicates that there is no risk for the target user, the server may execute a resource transfer service based on the service data carried in the trigger request (such as the resource transfer object, the resource transfer quantity, etc.), and obtain a service processing result.

[0089] If the risk detection result of the target user indicates that there is a risk for the target user, then the server may suspend the execution of the resource transfer service to avoid security issues such as the leakage of user privacy data.

[0090] In practical applications, after obtaining the risk detection result of the target user, it is also possible to determine whether an alarm message needs to be output based on the risk detection result. The specific processing method for determining the output of the alarm message can be diverse. The following provides an optional processing method, such as Figure 7 as shown, and specifically may include the processing of step S706.

[0091] In step S706, when it is determined that the target user is a risk user based on the risk detection result, a preset alarm message is output.

[0092] In implementation, if it is determined that the target user is a risk user, the server may obtain the alarm message corresponding to the risk detection result of the target user and output the alarm message.

[0093] For example, assume that the target user triggers and executes a lending service on the resource transfer platform. If the risk detection result of the target user indicates that the target user is a risk user, then the resource transfer platform may be sent a preset alarm message to prompt the resource transfer platform that the target user may have risks such as overdue repayment.

[0094] An embodiment of this specification provides a data processing method. By receiving a risk detection request for a target user, in response to the risk detection request, the to-be-detected data corresponding to the target user is obtained, where the to-be-detected data includes multi-modal feature data related to the resource transfer behavior of the target user. The to-be-detected data is input into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node based on the learnable activation function on the edge through the nodes corresponding to each feature data in multiple first data processing layers in the first module, and obtain feature vectors corresponding to each feature data. Among them, the node association relationship between the first data processing layers is determined according to the feature data. Through the second module of the pre-trained detection model, feature detection processing is performed on the relationship between multiple feature vectors, and the risk detection result for the target user is determined according to the feature detection result. In this way, in the case where the data structure of the feature data included in the to-be-detected data becomes more and more complex, the first module of the pre-trained detection model can first perform feature extraction processing on each feature data to obtain feature vectors corresponding to each feature data, that is, the feature expression ability of the feature data can be enhanced through the first module, and then through the second model of the pre-trained detection model, feature detection processing is performed on the relationship between multiple feature vectors, so as to quickly and accurately determine the risk detection result for the target user according to the feature detection result, and improve the detection efficiency and detection accuracy of user risk detection.

[0095] The above is the data processing method provided by the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a data processing device, as Figure 8 shown.

[0096] The data processing device includes: a request receiving module 801, a data obtaining module 802, a first processing module 803, and a risk detection module 804, where:

[0097] The request receiving module 801 is configured to receive a risk detection request for a target user;

[0098] The data obtaining module 802 is configured to obtain the to-be-detected data corresponding to the target user in response to the risk detection request, where the to-be-detected data includes multi-modal feature data related to the resource transfer behavior of the target user;

[0099] The first processing module 803 is configured to input the data to be detected into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of each node based on the learnable activation function on the edge through the nodes corresponding to each piece of feature data in multiple first data processing layers in the first module, and obtain feature vectors corresponding to each piece of feature data, wherein the node association relationship between the first data processing layers is determined according to the feature data;

[0100] The risk detection module 804 is configured to perform feature detection processing on the relationships between multiple feature vectors through the second module of the pre-trained detection model, and determine a risk detection result for the target user according to the feature detection result.

[0101] In the embodiments of this specification, the activation function of the second module is located at the network nodes of the second module, and the activation function of the second module is a non-learnable activation function. The apparatus further includes:

[0102] The first acquisition module is configured to acquire historical sample data, where the historical sample data includes historical detection data corresponding to a historical user and a historical risk detection result corresponding to the historical user;

[0103] The second processing module is configured to input the historical detection data into the first module of the detection model for feature extraction processing to obtain historical feature vectors corresponding to each piece of historical feature data;

[0104] The third processing module is configured to perform feature detection processing on the relationships between multiple historical feature vectors through the second module of the detection model, and determine a first risk detection result for the historical user according to the feature detection result;

[0105] The convergence judgment module is configured to determine whether the detection model converges according to the first risk detection result and the historical risk detection result;

[0106] The model training module is configured to, when it is determined that the detection model does not converge, update the parameters of the activation function of the first module and the weights of the edges between the nodes in the second module, and continue to train the updated detection model according to the historical sample data until the detection model converges to obtain a trained detection model.

[0107] In the embodiments of this specification, the data to be detected includes image data, resource transfer behavior sequence data of the target user, table data, and graph structure data, and the graph structure data is constructed according to the resource transfer relationship between the target user and other users.

[0108] In the embodiments of this specification, the second processing module is configured to:

[0109] Perform format conversion processing on the historical detection data according to the data processing format corresponding to the detection model to obtain the converted historical detection data;

[0110] Input the converted historical detection data into the first module of the detection model for feature extraction processing to obtain historical feature vectors corresponding to each of the historical feature data.

[0111] In the embodiments of this specification, the second module includes multiple second data processing layers, and the second data processing layer is used to determine the output data of the second data processing layer according to the first mapping result and the second mapping result. The first mapping result is determined according to the input data of the second data processing layer, the first preset weight, and the first preset deviation, and the second mapping result is determined according to the input data of the second data processing layer, the second preset weight, the second preset deviation, and the preset gating activation function.

[0112] In the embodiments of this specification, the model training module is configured to:

[0113] Update the weights of the edges between the nodes of the second module, as well as the first preset weight, the first preset deviation, the second preset weight, and the second preset deviation in each of the second data processing layers.

[0114] In the embodiments of this specification, the device further includes:

[0115] A request receiving module, configured to receive a trigger request from the target user for a resource transfer service;

[0116] A result determination module, configured to, in response to the trigger request, determine a service processing result for the resource transfer service according to the risk detection result of the target user.

[0117] In the embodiments of this specification, the device further includes:

[0118] An alarm output module, configured to output a preset alarm message when it is determined according to the risk detection result that the target user is a risk user.

[0119] An embodiment of this specification provides a data processing device. By receiving a risk detection request for a target user and in response to the risk detection request, the device obtains the data to be detected corresponding to the target user. The data to be detected includes multimodal feature data related to the resource transfer behavior of the target user. The data to be detected is input into the first module of a pre-trained detection model for feature extraction processing. Through the nodes corresponding to each feature data in multiple first data processing layers in the first module, based on the learnable activation functions on the edges, the input information obtained by processing the output result of the previous node of the node is aggregated to obtain a feature vector corresponding to each feature data. The node association relationship between the first data processing layers is determined according to the feature data. Through the second module of the pre-trained detection model, feature detection processing is performed on the relationship between multiple feature vectors, and the risk detection result for the target user is determined according to the feature detection result. In this way, when the data structure of the feature data included in the data to be detected becomes more and more complex, the first module of the pre-trained detection model can first perform feature extraction processing on each feature data to obtain a feature vector corresponding to each feature data, that is, the feature expression ability of the feature data can be enhanced through the first module. Then, through the second model of the pre-trained detection model, feature detection processing is performed on the relationship between multiple feature vectors, so as to quickly and accurately determine the risk detection result for the target user according to the feature detection result, improving the detection efficiency and detection accuracy of user risk detection.

[0120] The above is the data processing device provided by the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a data processing device, as Figure 9 shown.

[0121] The data processing device may be a terminal device or a server provided in the above embodiment, etc.

[0122] The data processing device may vary greatly due to configuration or performance differences, and may include one or more processors 901 and a memory 902. One or more application programs or data may be stored in the memory 902. Among them, the memory 902 may be short-term storage or persistent storage. The application programs stored in the memory 902 may include one or more modules (not shown in the figure), and each module may include a series of computer-executable instructions in the data processing device. Further, the processor 901 may be set to communicate with the memory 902 and execute a series of computer-executable instructions in the memory 902 on the data processing device. The data processing device may also include one or more power supplies 903, one or more wired or wireless network interfaces 904, one or more input / output interfaces 905, and one or more keyboards 906.

[0123] Specifically, in this embodiment, the data processing device includes a memory and one or more programs. One or more programs are stored in the memory, and one or more programs may include one or more modules. Each module may include a series of computer-executable instructions in the data processing device and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0124] Receive a risk detection request for a target user;

[0125] In response to the risk detection request, obtain the data to be detected corresponding to the target user, where the data to be detected includes multimodal feature data related to the resource transfer behavior of the target user;

[0126] Input the data to be detected into the first module of a pre-trained detection model for feature extraction processing. Through the nodes corresponding to each feature data in multiple first data processing layers in the first module, based on the learnable activation function on the edge, the input information obtained by processing the output result of the previous node of the node is aggregated to obtain a feature vector corresponding to each feature data. Among them, the node association relationship between the first data processing layers is determined according to the feature data;

[0127] Through the second module of the pre-trained detection model, perform feature detection processing on the relationship between multiple feature vectors, and determine the risk detection result for the target user according to the feature detection result.

[0128] Each embodiment in this specification is described in a progressive manner. The same or similar parts between each embodiment can be referred to each other. The key point of each embodiment is to illustrate the differences from other embodiments. In particular, for the data processing device embodiment, since it is basically similar to the method embodiment, the description is relatively simple. For the relevant parts, refer to the corresponding description in the method embodiment.

[0129] An embodiment of this specification provides a data processing device. By receiving a risk detection request for a target user, in response to the risk detection request, obtaining the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user, inputting the data to be detected into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through the learnable activation function on the edge by the nodes corresponding to each feature data in multiple first data processing layers in the first module, and obtaining a feature vector corresponding to each feature data, where the node association relationship between the first data processing layers is determined according to the feature data, and through the second module of the pre-trained detection model, performing feature detection processing on the relationship between multiple feature vectors, and determining the risk detection result for the target user according to the feature detection result. In this way, in the case where the data structure of the feature data included in the data to be detected becomes more and more complex, the first module of the pre-trained detection model can be used to perform feature extraction processing on each feature data first, and obtain a feature vector corresponding to each feature data, that is, the feature expression ability of the feature data can be enhanced through the first module, and then through the second model of the pre-trained detection model, the relationship between multiple feature vectors is further subjected to feature detection processing, so as to quickly and accurately determine the risk detection result for the target user according to the feature detection result, and improve the detection efficiency and detection accuracy of user risk detection.

[0130] Further, based on the above Figures 1 to 7 The method shown, one or more embodiments of this specification also provide a storage medium for storing computer-executable instruction information. In a specific embodiment, the storage medium can be a USB flash drive, an optical disc, a hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, the following process can be implemented:

[0131] Receiving a risk detection request for a target user;

[0132] In response to the risk detection request, obtaining the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user;

[0133] Inputting the data to be detected into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through the learnable activation function on the edge by the nodes corresponding to each feature data in multiple first data processing layers in the first module, and obtaining a feature vector corresponding to each feature data, where the node association relationship between the first data processing layers is determined according to the feature data;

[0134] Through the second module of the pre-trained detection model, perform feature detection processing on the relationships between the multiple feature vectors, and determine a risk detection result for the target user according to the feature detection result.

[0135] Each embodiment in this specification is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other. The key point of each embodiment is to illustrate the differences from other embodiments. In particular, for the above-mentioned embodiment of a storage medium, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment.

[0136] An embodiment of this specification provides a storage medium. By receiving a risk detection request for a target user, in response to the risk detection request, obtain the data to be detected corresponding to the target user, where the data to be detected includes multi-modal feature data related to the resource transfer behavior of the target user. Input the data to be detected into the first module of the pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through the learnable activation function on the edge by the nodes corresponding to each feature data in the multiple first data processing layers in the first module, and obtain feature vectors corresponding to each feature data, where the node association relationship between the first data processing layers is determined according to the feature data. Through the second module of the pre-trained detection model, perform feature detection processing on the relationships between the multiple feature vectors, and determine a risk detection result for the target user according to the feature detection result. In this way, in the case where the data structure of the feature data included in the data to be detected becomes more and more complex, the first module of the pre-trained detection model can first perform feature extraction processing on each feature data to obtain feature vectors corresponding to each feature data, that is, the first module can enhance the feature expression ability of the feature data, and then through the second model of the pre-trained detection model, perform feature detection processing on the relationships between the multiple feature vectors, so as to quickly and accurately determine a risk detection result for the target user according to the feature detection result, improving the detection efficiency and detection accuracy of user risk detection.

[0137] Further, based on the above Figures 1 to 7 shown method, one or more embodiments of this specification also provide a computer program product, including a computer program. When the computer program in the computer program product is executed by a processor, the following processes can be implemented:

[0138] Receive a risk detection request for a target user;

[0139] In response to the risk detection request, obtain the data to be detected corresponding to the target user, where the data to be detected includes multimodal feature data related to the resource transfer behavior of the target user;

[0140] Input the data to be detected into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through the learnable activation function on the edge based on the nodes corresponding to each feature data in multiple first data processing layers in the first module, and obtain feature vectors corresponding to each feature data, where the node association relationship between the first data processing layers is determined according to the feature data;

[0141] Through the second module of the pre-trained detection model, perform feature detection processing on the relationships between multiple feature vectors, and determine the risk detection result for the target user according to the feature detection result.

[0142] Each embodiment in this specification is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the above embodiment of a computer program product, since it is basically similar to the method embodiment, the description is relatively simple, and for the relevant parts, reference can be made to the partial description of the method embodiment.

[0143] An embodiment of this specification provides a computer program product. By receiving a risk detection request for a target user, in response to the risk detection request, obtaining the data to be detected corresponding to the target user, where the data to be detected includes multimodal feature data related to the resource transfer behavior of the target user, inputting the data to be detected into the first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through the learnable activation function on the edge by the nodes corresponding to each feature data in multiple first data processing layers in the first module, and obtaining feature vectors corresponding to each feature data, where the node association relationship between the first data processing layers is determined according to the feature data, and through the second module of the pre-trained detection model, performing feature detection processing on the relationship between multiple feature vectors, and determining the risk detection result for the target user according to the feature detection result. In this way, in the case where the data structure of the feature data included in the data to be detected becomes more and more complex, the first module of the pre-trained detection model can be used to perform feature extraction processing on each feature data respectively to obtain the feature vector corresponding to each feature data, that is, the feature expression ability of the feature data can be enhanced through the first module, and then through the second model of the pre-trained detection model, the relationship between multiple feature vectors is further subjected to feature detection processing, so as to quickly and accurately determine the risk detection result for the target user according to the feature detection result, and improve the detection efficiency and detection accuracy of user risk detection.

[0144] The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve the desired result. Additionally, the processes depicted in the figures do not necessarily require the particular order or sequential order shown to achieve the desired result. In certain implementations, multitasking and parallel processing are also possible or may be advantageous.

[0145] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structures of diodes, transistors, switches, etc.) or software improvements (improvements to method flows). However, with the development of technology, many method flow improvements today can be regarded as direct improvements to hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement to a method flow cannot be implemented using a hardware entity module. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is an integrated circuit whose logical function is determined by a user's programming of the device. Designers can program themselves to "integrate" a digital system onto a single PLD, without having to ask a chip manufacturer to design and fabricate a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly implemented using "logic compiler" software, which is similar to the software compilers used in program development and writing. The original code before compilation also has to be written in a specific programming language, which is called a Hardware Description Language (HDL). There is not just one type of HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones currently are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also be aware that by simply performing a little logical programming on the method flow using the above-mentioned several hardware description languages and programming it into an integrated circuit, it is easy to obtain the hardware circuit that implements the logical method flow.

[0146] The controller can be implemented in any suitable manner. For example, the controller can take the form of, for example, a microprocessor or a processor and a computer-readable medium storing computer-readable program code (such as software or firmware) executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of the controller include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in the form of pure computer-readable program code, it is entirely possible to logically program the method steps to enable the controller to be implemented in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. to achieve the same function. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be regarded as the structures within the hardware component. Or even, the devices for implementing various functions can be regarded as either software modules for implementing the method or structures within the hardware component.

[0147] The systems, devices, modules, or units illustrated in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0148] For the convenience of description, when describing the above devices, they are described separately as various units according to their functions. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0149] Those skilled in the art should understand that the embodiments of this specification can be provided as a method, a system, or a computer program product. Therefore, one or more embodiments of this specification can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code.

[0150] Embodiments of the present specification are described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present specification. It should be understood that each process and / or block in the flowchart and / or block diagram, and the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable serial-parallel devices for fraud cases to generate a machine, such that the instructions executed by the processor of the computer or other programmable serial-parallel devices for fraud cases generate means for implementing the functions specified in the process Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0151] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable serial-parallel devices for fraud cases to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including instruction means that implement the functions specified in the process Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0152] These computer program instructions can also be loaded onto a computer or other programmable serial-parallel devices for fraud cases, such that a series of operation steps are executed on the computer or other programmable devices to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable devices provide steps for implementing the functions specified in the process Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0153] In a typical configuration, a computing device includes one or more processors (CPUs), an input / output interface, a network interface, and a memory.

[0154] The memory may include non-permanent memory in the form of computer-readable media, random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. The memory is an example of computer-readable media.

[0155] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0156] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0157] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, one or more embodiments of this specification may be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0159] Each embodiment in this specification is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for the relevant parts, reference can be made to the partial description of the method embodiment.

[0160] The above description is only for the embodiments of this specification and is not intended to limit this document. For those skilled in the art, various changes and modifications can be made to this specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included within the scope of the claims of this specification.

Claims

1. A data processing method, comprising: Receive risk detection requests for target users; In response to the risk detection request, acquiring the to-be-detected data corresponding to the target user, the to-be-detected data comprising multimodal feature data related to the resource transfer behavior of the target user; The data to be detected is input into a first module of a pre-trained detection model for feature extraction processing, so as to obtain a feature vector corresponding to each feature data by summarizing the input information obtained by processing the output result of the previous node of the node through the nodes corresponding to each feature data in a plurality of first data processing layers in the first module based on a learnable activation function on the edge, wherein the node association relationship between the first data processing layers is determined according to the feature data; The second module of the pre-trained detection model performs feature detection processing on the relationship between the plurality of feature vectors, and determines the risk detection result for the target user according to the feature detection result.

2. According to the method of claim 1, the activation function of the second module is located at the network node of the second module, and the activation function of the second module is a non-learnable activation function. Before the first module of the detection model that inputs the data to be detected into the pre-trained detection model for feature extraction processing, so as to obtain the feature vector corresponding to each feature data by processing the output result of the previous node of the node through the nodes corresponding to each feature data in the multiple first data processing layers in the first module based on the learnable activation function on the edge, the input information is summarized and processed, and the feature vector corresponding to each feature data is obtained, the method further comprises: Acquire historical sample data, where the historical sample data includes historical detection data corresponding to historical users and historical risk detection results corresponding to the historical users; Inputting the historical detection data into the first module of the detection model for feature extraction processing to obtain a historical feature vector corresponding to each of the historical sample data; Performing feature detection processing on the relationship between the plurality of historical feature vectors through the second module of the detection model, and determining a first risk detection result for the historical user according to the feature detection result; Determining whether the detection model converges according to the first risk detection result and the historical risk detection result; When it is determined that the detection model has not converged, the parameters of the activation function of the first module and the weights of the edges between the nodes in the second module are updated, and the updated detection model is continued to be trained according to the historical sample data until the detection model converges to obtain a trained detection model.

3. According to the method of claim 2, the data to be detected includes image data, sequence data of resource transfer behavior of the target user, table data, and graph structure data, and the graph structure data is constructed according to the resource transfer relationship between the target user and other users.

4. The method according to claim 3, wherein the step of inputting the historical detection data into the first module of the detection model for feature extraction processing to obtain a historical feature vector corresponding to each of the historical sample data comprises: According to the data processing format corresponding to the detection model, the historical detection data is format converted to obtain converted historical detection data; The converted historical detection data is input into the first module of the detection model for feature extraction processing to obtain a historical feature vector corresponding to each of the historical sample data.

5. According to the method according to claim 2, the second module includes multiple second data processing layers, and the second data processing layer is used to determine the output data of the second data processing layer according to the first mapping result and the second mapping result, the first mapping result is determined according to the input data of the second data processing layer, the first preset weight and the first preset deviation, and the second mapping result is determined according to the input data of the second data processing layer, the second preset weight, the second preset deviation and the preset gated activation function.

6. The method according to claim 5, wherein the updating of the weights of the edges between the nodes in the second module comprises: The weights of the edges between the nodes of the second module, and the first preset weight, the first preset deviation, the second preset weight and the second preset deviation in each of the second data processing layers are updated.

7. The method according to claim 1, further comprising: receiving a trigger request for a resource transfer service from the target user; In response to the trigger request, a service processing result for the resource transfer service is determined according to the risk detection result of the target user.

8. The method according to claim 1, further comprising: When it is determined that the target user is a risky user according to the risk detection result, preset alarm information is output.

9. A data processing device, comprising: A request receiving module, used to receive a risk detection request for a target user; A data acquisition module, configured to acquire, in response to the risk detection request, the to-be-detected data corresponding to the target user, wherein the to-be-detected data includes multimodal feature data related to the resource transfer behavior of the target user; A first processing module is used to input the data to be detected into a first module of a pre-trained detection model for feature extraction processing, so as to summarize the input information obtained by processing the output result of the previous node of the node through the nodes corresponding to each feature data in multiple first data processing layers in the first module based on the learnable activation function on the edge, and obtain a feature vector corresponding to each feature data, wherein the node association relationship between the first data processing layers is determined according to the feature data; The risk detection module is used to perform feature detection processing on the relationship between the plurality of feature vectors through the second module of the pre-trained detection model, and determine the risk detection result for the target user according to the feature detection result.

10. A data processing device, comprising: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: Receive risk detection requests for target users; In response to the risk detection request, acquiring the to-be-detected data corresponding to the target user, the to-be-detected data comprising multimodal feature data related to the resource transfer behavior of the target user; The data to be detected is input into a first module of a pre-trained detection model for feature extraction processing, so as to obtain a feature vector corresponding to each feature data by summarizing the input information obtained by processing the output result of the previous node of the node through the nodes corresponding to each feature data in a plurality of first data processing layers in the first module based on a learnable activation function on the edge, wherein the node association relationship between the first data processing layers is determined according to the feature data; The second module of the pre-trained detection model performs feature detection processing on the relationship between the plurality of feature vectors, and determines the risk detection result for the target user according to the feature detection result.

Images