Fraud gang identification method and system based on knowledge graph

Abstract

The invention relates to the technical field of financial data analysis, and discloses a fraud gang identification method and system based on a knowledge graph. The method comprises the following steps: extracting financial transaction entities in equipment fingerprint data and transaction data generated in a financial transaction process and a relationship between the financial transaction entities based on an entity identification technology and a relationship extraction technology, and constructing a financial transaction knowledge graph; and carrying out financial transaction feature analysis on the financial transaction knowledge graph based on a graph analysis technology, identifying target nodes with an association relationship, and determining a financial fraud gang. On the basis of the knowledge graph constructed by utilizing the equipment fingerprint data and the transaction data, the graph analysis technology is adopted, the incidence relation between entities in the financial data can be comprehensively analyzed, potential fraud gangs are identified, and the problem that the fraud gangs in different financial fields cannot be identified is solved. And the hidden association and behavior pattern are difficult to capture by a single data feature, so that the accuracy of cross-domain financial fraud gang identification is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of financial data analysis, and in particular to a method and system for identifying fraud gangs based on knowledge graphs. Background Art

[0002] The identification of fraud gangs in existing technologies relies on data mining technology and machine learning algorithms, the core of which is based on the extraction and pattern recognition of data features, such as anomaly detection of transaction behavior and analysis of user behavior.

[0003] For complex fraud gangs, single data features and patterns are often difficult to capture their hidden associations and behavior patterns. There is a lack of modeling of complex relationships between entities, such as the associations and behavior patterns between fraud gang members. At the same time, in different financial fields, the behavioral characteristics of fraud gangs vary greatly, and traditional methods are difficult to adapt to the fraud identification needs of different fields. Summary of the invention

[0004] In view of this, the present invention provides a method and system for identifying fraud gangs based on knowledge graphs to solve the problem of how to effectively improve the accuracy of identifying fraud gangs on the basis of cross-financial fields.

[0005] In a first aspect, the present invention provides a method for identifying fraud gangs based on a knowledge graph, the method comprising: obtaining device fingerprint data and transaction data generated during a financial transaction;

[0006] Extracting financial transaction entities and relationships between financial transaction entities in the device fingerprint data and the transaction data based on entity recognition technology and relationship extraction technology;

[0007] Constructing a financial transaction knowledge graph based on the financial transaction entities and the relationships between the financial transaction entities; the financial transaction knowledge graph includes a plurality of nodes and edges, wherein the nodes represent the financial transaction entities and the edges represent the relationships between the financial transaction entities;

[0008] Performing financial transaction feature analysis on the nodes and edges in the financial transaction knowledge graph based on graph analysis technology to identify target nodes with associated relationships;

[0009] A financial fraud gang is determined based on the set of target nodes.

[0010] The embodiment of the present invention obtains the device fingerprint data and transaction data generated during the financial transaction process, which is equivalent to obtaining the correlation information at the device layer and the transaction layer, avoiding the problem of single data features in the prior art. It automatically identifies and extracts entities and relationships in financial transactions based on entity recognition technology and relationship extraction technology, thereby modeling a knowledge graph with multiple entity relationships. Even cross-domain financial fraud problems can still be structured in the graph. The knowledge graph is further analyzed based on graph analysis technology to obtain the characteristics of nodes and edges, thereby identifying target nodes with multiple dimensional correlation relationships. The knowledge graph with multiple entity relationships in this embodiment is suitable for cross-domain financial fraud analysis. At the same time, the analysis of the graph structure based on the knowledge graph improves the accuracy of correlation identification, thereby ensuring the accuracy of identifying financial fraud gangs.

[0011] In an optional implementation, the extracting of financial transaction entities and the relationships between financial transaction entities in the device fingerprint data and the transaction data based on entity recognition technology and relationship extraction technology specifically includes:

[0012] Based on the vocabulary of transaction objects in the financial field, a deep learning algorithm is used to train the recognition model of financial transaction entities;

[0013] Inputting the device fingerprint data and the transaction data into an identification model of the financial transaction entity to identify the financial transaction entity;

[0014] According to predefined transaction business rules, the relationship between the financial transaction entities is determined from the transaction data using the financial transaction entities.

[0015] The embodiment of the present invention trains a deep learning model based on a vocabulary of transaction objects in the financial field, and can accurately identify various types of transaction entities in financial transaction data. By using predefined transaction business rules in combination with entity recognition technology, the relationship between entities in financial transaction data can be extracted. In cross-domain scenarios, the use of predefined transaction business rules can flexibly determine the relationship between different entities, further improving the accuracy of identifying financial fraud gangs.

[0016] In an optional implementation, the constructing a financial transaction knowledge graph based on the financial transaction entities and the relationships between the financial transaction entities specifically includes:

[0017] Mapping the financial transaction entities into nodes and mapping the relationships between the financial transaction entities into edges using graph modeling technology;

[0018] Determine the transaction frequency and transaction amount between every two financial transaction entities according to the relationship between the financial transaction entities;

[0019] Determine the weight of the edge between the nodes corresponding to every two financial transaction entities according to the transaction frequency and the transaction amount;

[0020] Determine the attributes of the edge between the nodes corresponding to each two financial transaction entities according to the device fingerprint data and the transaction data;

[0021] A financial transaction knowledge graph is constructed based on the nodes, the edges, the weights of the edges, and the attributes of the edges.

[0022] In an embodiment of the present invention, graph modeling technology is used to map financial transaction entities into nodes, and the relationships between these entities into edges. The strength of the entity relationship is determined by determining the transaction frequency and transaction amount between every two financial transaction entities, that is, the edges are assigned corresponding weights. The attributes of the edges are further determined by analyzing device fingerprint data and transaction data. When the weights and attributes of the edges are determined, the knowledge graph constructed based on nodes and edges, edge weights and edge attributes is more accurate, providing multi-dimensional data for subsequent graph analysis, and further improving the accuracy of identifying financial fraud gangs.

[0023] In an optional implementation, the graph analysis technology includes an association analysis algorithm; the graph analysis technology is used to perform financial transaction feature analysis on nodes and edges in the financial transaction knowledge graph to identify target nodes with association relationships, specifically including:

[0024] According to the nodes in the financial transaction knowledge graph and the weights corresponding to each edge, the financial transaction features are associated based on the association analysis algorithm to analyze and determine the association between the nodes;

[0025] A target node having a first type of association relationship is identified according to the association degree.

[0026] In the embodiment of the present invention, the weights corresponding to the nodes and each edge in the financial transaction knowledge graph are analyzed through an association analysis algorithm, and the relationship characteristics between the financial transaction entities and the entities are obtained from the weights. By calculating the association between the nodes, some entities that may belong to the same fraud gang can be found. Regardless of whether there is an association in the actual financial transaction process, the first-class association relationship between the nodes can be determined by the association, thereby ensuring the relationship identification between cross-domain financial transaction entities.

[0027] In an optional implementation, the graph analysis technology includes a community discovery algorithm; the graph analysis technology is used to analyze the nodes and edges in the financial transaction knowledge graph for financial transaction characteristics, and the target nodes with associated relationships are identified, specifically including:

[0028] According to the attributes of the nodes and each edge of the financial transaction knowledge graph, the nodes are clustered into financial transaction features based on a community discovery algorithm;

[0029] According to the financial transaction feature clustering result, a target node having a second type of association relationship is identified.

[0030] In an embodiment of the present invention, the attributes of the nodes and each edge in the financial transaction knowledge graph are clustered through a community discovery algorithm, and nodes with similar characteristics and behavior patterns are classified into the same community. After the knowledge graph is clustered, the clustering result of each node can display all entities with potential associations, avoiding the omission of cross-domain nodes, thereby effectively improving the accuracy of identifying financial fraud gangs.

[0031] In an optional implementation, the graph analysis technology includes a path analysis algorithm; the graph analysis technology is used to perform financial transaction feature analysis on nodes and edges in the financial transaction knowledge graph to identify target nodes with associated relationships, specifically including:

[0032] Determine, based on the nodes and edges of the financial transaction knowledge graph, a path set from a starting node to an ending node of a financial transaction process including multiple financial transaction entities;

[0033] Performing financial transaction feature analysis on the path set based on the path analysis algorithm to determine abnormal transit path nodes;

[0034] The target node with the third type of association relationship is identified based on the transit path node.

[0035] The embodiments of the present invention can identify all possible paths between the starting node and the ending node in the financial transaction process, and after identifying the path set, analyze the characteristics of the path through a path analysis algorithm, so as to determine abnormal transit path nodes that should not appear in the normal transaction process. The abnormal nodes represent nodes of potential fraudulent behavior, and the abnormal nodes are clearly identified, thereby effectively improving the accuracy of identifying financial fraud gangs.

[0036] In an optional implementation manner, determining a financial fraud gang according to the set of target nodes specifically includes:

[0037] Determine an intersection node among target nodes with a first type of association relationship, target nodes with a second type of association relationship, and target nodes with a third type of association relationship;

[0038] Calculating the fraud risk assessment value of the intersection node using a preset risk assessment model; the fraud risk assessment value represents a weighted assessment value of the transaction data risk value, the transaction address risk value, and the transaction path risk value;

[0039] The set of financial transaction entities corresponding to all intersection nodes whose fraud risk assessment values ​​are greater than a preset risk threshold is regarded as a financial fraud gang.

[0040] The embodiment of the present invention determines the intersection nodes among the target nodes with the first type of association relationship, the target nodes with the second type of association relationship, and the target nodes with the third type of association relationship, ensures that the screened nodes all meet the requirements of the above three types of risks, filters out the nodes with a single association relationship, thereby reducing the risk of misjudgment caused by a single relationship type, and uses a preset risk assessment model to perform fraud risk assessment on the intersection nodes. The risk assessment combines multiple factors such as transaction data risk, transaction address risk, and transaction path risk to obtain a risk value, quantifies the risk situation of the node, and screens out all intersection nodes that are higher than the preset risk threshold. Only when the fraud risk assessment value of the intersection node exceeds the threshold will it be identified as a potential fraud gang, reducing the misjudgment rate, thereby effectively improving the accuracy of identifying financial fraud gangs, and avoiding the inaccurate analysis and misjudgment of single data features that exist in the prior art.

[0041] In a second aspect, the present invention provides a fraud gang identification system based on a knowledge graph, the system comprising:

[0042] A data collection module, used to obtain device fingerprint data and transaction data generated during financial transactions;

[0043] An entity relationship extraction module, used for extracting financial transaction entities and relationships between financial transaction entities in the device fingerprint data and the transaction data based on entity recognition technology and relationship extraction technology;

[0044] A knowledge graph construction module, used to construct a financial transaction knowledge graph based on the financial transaction entities and the relationships between the financial transaction entities; the financial transaction knowledge graph includes a plurality of nodes and edges, wherein the nodes represent the financial transaction entities and the edges represent the relationships between the financial transaction entities;

[0045] A feature analysis module, used to perform financial transaction feature analysis on the nodes and edges in the financial transaction knowledge graph based on graph analysis technology, and identify target nodes with associated relationships;

[0046] A fraud group identification module is used to determine a financial fraud group based on the set of target nodes.

[0047] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the knowledge graph-based fraud gang identification method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0048] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the knowledge graph-based fraud gang identification method of the above-mentioned first aspect or any corresponding embodiment thereof.

[0049] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the knowledge graph-based fraud gang identification method of the above-mentioned first aspect or any corresponding embodiment. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 It is a flowchart of a fraud gang identification method based on knowledge graph according to an embodiment of the present invention;

[0052] Figure 2 is a flow chart of another method for identifying fraud gangs based on knowledge graph according to an embodiment of the present invention;

[0053] Figure 3 is a flow chart of another method for identifying fraud gangs based on knowledge graph according to an embodiment of the present invention;

[0054] Figure 4 is a flow chart of another method for identifying fraud gangs based on knowledge graph according to an embodiment of the present invention;

[0055] Figure 5 is a structural block diagram of a fraud gang identification system based on knowledge graph according to an embodiment of the present invention;

[0056] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0058] At present, the identification of fraud gangs mainly relies on data mining technology and machine learning algorithms, which mainly identify fraudulent behaviors by extracting data features and performing pattern recognition, such as abnormal transaction behavior detection and user behavior analysis.

[0059] The existing technical methods still have the following technical problems: (1) For complex fraud gangs, single data features and patterns are often difficult to capture their hidden associations and behavior patterns. (2) There is a lack of modeling of complex relationships between entities, such as the mutual associations and behavior patterns between members of a fraud gang. (3) In different financial fields, the behavioral characteristics of fraud gangs vary significantly, and traditional methods are difficult to adapt to the fraud identification needs of various fields.

[0060] An embodiment of the present invention provides a method for identifying fraud gangs based on a knowledge graph, which is applied to financial transaction tracing and financial crime law enforcement scenarios. It is based on a knowledge graph constructed using device fingerprint data and transaction data, and uses graph analysis technology. It can comprehensively analyze the associations between entities in financial data, identify potential fraud gangs, and solve the technical problem that a single data feature and pattern is often difficult to capture the hidden associations and behavior patterns of fraud gangs in different financial fields, thereby improving the accuracy of identifying cross-field financial fraud gangs.

[0061] According to an embodiment of the present invention, an embodiment of a fraud gang identification method based on a knowledge graph is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0062] In this embodiment, a method for identifying fraud gangs based on knowledge graph is provided, which can be used in the above-mentioned computer. Figure 1 is a flow chart of a method for identifying fraud gangs based on knowledge graph according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0063] Step S101, obtaining device fingerprint data and transaction data generated during a financial transaction.

[0064] Specifically, through the mobile application (APP) or web interface of the financial institution, various types of data generated by users when conducting financial transactions are collected, mainly including device fingerprint data and transaction data; device fingerprint data refers to a series of characteristic information that can uniquely identify the user's device, including but not limited to: hardware configuration information (such as device model, operating system version, etc.), software configuration information (such as installed application list, application version number), network characteristic information (such as IP address, network operator information, Wi-Fi name, etc.), geographic location information (such as GPS coordinates, etc.). Transaction data refers to various operations and transaction information performed by users on financial platforms, including but not limited to: transaction type, transaction amount and frequency, counterparty information, transaction time and location, account balance changes, etc.

[0065] For example, when users perform key operations such as logging in, paying, and transferring money, multiple types of preset collection interfaces are used to collect different types of device fingerprint data and transaction data, respectively, providing multi-dimensional data for subsequent knowledge graph construction and fraud gang identification.

[0066] Step S102: extracting financial transaction entities and the relationships between financial transaction entities from the device fingerprint data and transaction data based on entity recognition technology and relationship extraction technology.

[0067] It should be noted that financial transaction entities refer to participants or objects in financial transactions, such as consumer users, merchants, financial equipment, etc.; relationships refer to various connections between financial transaction entities, such as transaction relationships between consumer users and financial equipment, transaction relationships between consumer users and merchants, etc. In this embodiment, entity recognition technology uses natural language processing (NLP) technology, combined with pre-trained models and proprietary vocabulary in the financial field, to perform word segmentation and named entity recognition on the data. Relationship extraction technology is to extract useful relationships between identified entities.

[0068] Specifically, the entity recognition technology in this embodiment includes: (1) using a specific word segmentation algorithm in the financial field to divide text data into word units; (2) using a pre-trained deep learning model (such as BERT, GPT, etc.) to identify all entities in the above word units, and classify all entities into predefined multiple financial transaction entities according to preset categories. In this embodiment, the relationship extraction technology can directly extract the relationship between entities from the data according to multiple financial transaction entities based on predefined business rules or logic; or, using an existing financial transaction knowledge base as a remote supervision signal, automatically annotate a large number of financial sentence units, generate training samples, input the training samples into a machine learning model, train to obtain a recognition model for financial transaction entity relationships, input the word units to be extracted into the recognition model for financial transaction entity relationships, and obtain the relationship between entities output by the model.

[0069] Step S103, constructing a financial transaction knowledge graph based on the financial transaction entities and the relationships between the financial transaction entities; the financial transaction knowledge graph includes multiple nodes and edges, wherein the nodes represent the financial transaction entities and the edges represent the relationships between the financial transaction entities.

[0070] It should be noted that a knowledge graph is a structured data graph containing entities and relationships. Each node in the graph represents an entity, and the edges connecting the nodes represent the relationships between entities.

[0071] Specifically, the financial transaction knowledge graph constructed based on financial transaction entities and the relationships between financial transaction entities can be automatically modeled through a preset graph modeling tool, and the financial transaction entities and the relationships between financial transaction entities can be input into the parameters of the automatic modeling tool to obtain the automatically modeled financial transaction knowledge graph; the nodes and edges can also be modeled separately, and the node modeling results and the edge modeling results can be merged into an overall financial transaction knowledge graph.

[0072] Step S104, performing financial transaction feature analysis on the nodes and edges in the financial transaction knowledge graph based on graph analysis technology, and identifying target nodes with associated relationships.

[0073] In an embodiment of the present invention, graph analysis technology includes but is not limited to a centrality analysis algorithm, a community discovery algorithm, and a path analysis algorithm, which analyzes the financial characteristics of nodes and edges in a financial transaction knowledge graph. The target node refers to an entity node that is identified as possibly belonging to a fraud gang after analysis.

[0074] Specifically, the specific technical means for analyzing the characteristics of financial transactions can adopt a centrality analysis algorithm, including: (1) calculating the centrality index of each node in the graph, the centrality index is the number of betweenness centrality, specifically the number of times the node is a transit point of the shortest path between other node pairs, (2) selecting nodes with high betweenness centrality as target nodes. Only by calculating the betweenness centrality, the transit nodes of fraudulent funds can be quickly determined. The specific technical means for analyzing the characteristics of financial transactions can also adopt a community detection algorithm to identify multiple closely connected subgroups in the financial transaction knowledge graph, each of which contains multiple target nodes.

[0075] Step S105, determining the financial fraud gang according to the set of target nodes.

[0076] Specifically, when a target node with an associated relationship is identified, it is identified in turn according to the attributes of the edge corresponding to the target node and the preset fraud risk assessment model to determine the risk index of each node. When the number of nodes in the set of target nodes whose risk indicators are higher than the risk threshold reaches a preset number, the group corresponding to the nodes higher than the risk threshold is determined to be a fraud group, and the nodes lower than the risk threshold are determined to be a potential fraud group.

[0077] The embodiment of the present invention obtains the device fingerprint data and transaction data generated during the financial transaction process, which is equivalent to obtaining the correlation information at the device layer and the transaction layer, avoiding the problem of single data features in the prior art. It automatically identifies and extracts entities and relationships in financial transactions based on entity recognition technology and relationship extraction technology, thereby modeling a knowledge graph with multiple entity relationships. Even cross-domain financial fraud problems can still be structured in the graph. The knowledge graph is further analyzed based on graph analysis technology to obtain the characteristics of nodes and edges, thereby identifying target nodes with correlation relationships in multiple dimensions. The knowledge graph with multiple entity relationships in this embodiment is suitable for cross-domain financial fraud analysis. At the same time, the analysis of the graph structure based on the knowledge graph improves the accuracy of correlation identification, thereby ensuring the accuracy of identifying financial fraud gangs.

[0078] In this embodiment, a method for identifying fraud gangs based on knowledge graph is provided, which can be used in the above-mentioned computer. Figure 2 is a flow chart of a method for identifying fraud gangs based on knowledge graph according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0079] Step S201, obtain the device fingerprint data and transaction data generated during the financial transaction process. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0080] Step S202: extracting financial transaction entities and the relationships between financial transaction entities from the device fingerprint data and transaction data based on entity recognition technology and relationship extraction technology.

[0081] Specifically, the above step S202 includes:

[0082] Step S2021, based on the vocabulary of transaction objects in the financial field, use a deep learning algorithm to train a recognition model for financial transaction entities.

[0083] Exemplarily, the BERT model is used to build a financial transaction entity recognition model, and the original text is annotated based on the vocabulary of transaction objects in the financial field. For example: the original text: A transfers 5,000 yuan to B through XX. The annotated data (such as personal name information, institution name information, etc.) is input into the BERT model for training. The BERT model will learn to recognize different types of financial transaction entities, thereby obtaining the final financial transaction entity recognition model.

[0084] Step S2022: input the device fingerprint data and the transaction data into the identification model of the financial transaction entity to identify the financial transaction entity.

[0085] Exemplarily, the device fingerprint data and transaction data to be input are as follows: User A paid 500 yuan at merchant B through device T with IP address 192.168.XX. The transaction time was 1:00 on January 1, 20xx. After identification by the identification model of the financial transaction entity, the device model T (entity type is device), user A (entity type is consumer user), and merchant B (entity type is merchant) are obtained.

[0086] Step S2023, according to the predefined transaction business rules, using the financial transaction entities to determine the relationship between the financial transaction entities from the transaction data.

[0087] Exemplarily, transaction business rules are rules set according to the standards of the financial industry and some transaction scenarios, such as "binding relationship", "usage relationship", "transaction relationship" and other similar relationships related to financial transaction behaviors. According to the above transaction business rules, the transaction relationship between user A and merchant B, the binding relationship between device X and user B, and the usage relationship between device X and user A can be determined. By effectively identifying various entities in financial transactions and their relationships, a multi-dimensional data foundation is provided for building a financial transaction knowledge graph, and accurate data support is further provided for subsequent fraud risk assessment.

[0088] Step S203: construct a financial transaction knowledge graph based on the financial transaction entities and the relationships between them; the financial transaction knowledge graph includes multiple nodes and edges, where the nodes represent the financial transaction entities and the edges represent the relationships between them. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0089] Step S204: Analyze the financial transaction characteristics of the nodes and edges in the financial transaction knowledge graph based on graph analysis technology to identify target nodes with associated relationships. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0090] Step S205: determine the financial fraud gang based on the set of target nodes. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0091] The embodiment of the present invention trains a deep learning model based on a vocabulary of transaction objects in the financial field, and can accurately identify various types of transaction entities in financial transaction data. By using predefined transaction business rules in combination with entity recognition technology, the relationship between entities in financial transaction data can be extracted. In cross-domain scenarios, the use of predefined transaction business rules can flexibly determine the relationship between different entities, further improving the accuracy of identifying financial fraud gangs.

[0092] In this embodiment, a method for identifying fraud gangs based on knowledge graph is provided, which can be used in the above-mentioned computer. Figure 3 is a flow chart of a method for identifying fraud gangs based on knowledge graph according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0093] Step S301, obtain the device fingerprint data and transaction data generated during the financial transaction process. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0094] Step S302: extract the financial transaction entities and the relationships between the financial transaction entities in the device fingerprint data and transaction data based on entity recognition technology and relationship extraction technology. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0095] Step S303, constructing a financial transaction knowledge graph based on the financial transaction entities and the relationships between the financial transaction entities; the financial transaction knowledge graph includes multiple nodes and edges, wherein the nodes represent the financial transaction entities and the edges represent the relationships between the financial transaction entities.

[0096] Specifically, the above step S303 includes:

[0097] Step S3031, using graph modeling technology to map financial transaction entities into nodes, and mapping relationships between financial transaction entities into edges.

[0098] Step S3032: determining the transaction frequency and transaction amount between every two financial transaction entities according to the relationship between the financial transaction entities.

[0099] For example, user A and merchant B conducted 5 transactions between January 1 and January 5, 2024, with a total amount of RMB 1,000. The transaction frequency is 5, and the transaction amount is RMB 1,000.

[0100] Step S3033, determining the weight of the edge between the nodes corresponding to every two financial transaction entities according to the transaction frequency and the transaction amount.

[0101] For example, a weight is assigned to each edge according to the transaction frequency and transaction amount, where the edge weight can indicate that the closer the connection between entities is, the higher the weight value is. The transaction frequency and amount are weighted to form a comprehensive value, which is used as the edge weight. For example, if the transaction amount and frequency each account for a coefficient of 0.5, the weight value is calculated as: 0.5×5+0.5×1000=502.5.

[0102] Step S3034, determining the attributes of the edges between the nodes corresponding to every two financial transaction entities according to the device fingerprint data and the transaction data.

[0103] Step S2035, constructing a financial transaction knowledge graph based on nodes, edges, edge weights, and edge attributes.

[0104] It should be noted that since the relationship between financial transaction entities is mapped to an edge, the attributes of the edge essentially represent the attributes corresponding to the relationship between the financial transaction entities. The relationship between financial transaction entities in the embodiment of the present invention is classified as follows:

[0105] Example 1, the transaction relationship between a user and a merchant, the corresponding edge attributes include transaction frequency, transaction amount, transaction time, etc. The edge data storage structure is: (User_A)--[Transaction:{"frequency":5,"amount":1000,"time_range":"2024-01-01to 2024-01-05"}]-->(Merchant_B). The above storage structure indicates that user A conducted 5 transactions with merchant B within a specific time range, with a total transaction amount of 1,000 yuan.

[0106] Example 2, the binding relationship between a device and a user, the corresponding edge attributes: including device model, operating system version, IP address, network type, etc. The edge data storage structure is: (Device_X)--[BoundTo:{"model":"iPhone12","OS":"iOS16.3","IP":"192.168.0.5","network":"Wi-Fi"}]-->(User_A). The above storage structure indicates that device X is bound to user A, and records detailed information such as the device model, operating system, IP address, and network type.

[0107] Example 3, the relationship between devices and transactions, the corresponding edge attributes include transaction type, transaction amount, geographic location, etc. The edge data storage structure is: (Device_X)--[UsedForTransaction:{"type":"payment","amount":500,"location":"Beijing"}]-->(Transaction_123). The above storage structure indicates that device X is used for transaction 123 at a specific location (Beijing), the transaction type is payment, and the amount is 500 yuan.

[0108] Example 4, the transfer relationship between a user and other users, the corresponding edge attributes include: transfer amount, transfer time, device ID, etc. The edge data storage structure is: (User_A)--[TransferTo:{"amount":200,"time":"2024-02-01 14:30","device_id":"Device_X"}]-->(User_B). The above storage structure indicates that user A transfers 200 yuan to user B through device X at 14:30 on February 1, 2024.

[0109] Step S304: Analyze the financial transaction characteristics of the nodes and edges in the financial transaction knowledge graph based on graph analysis technology to identify target nodes with associated relationships. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0110] Step S305: determine the financial fraud gang based on the set of target nodes. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0111] In an embodiment of the present invention, graph modeling technology is used to map financial transaction entities into nodes, and the relationships between these entities into edges. The strength of the entity relationship is determined by determining the transaction frequency and transaction amount between every two financial transaction entities, that is, the edges are assigned corresponding weights. The attributes of the edges are further determined by analyzing device fingerprint data and transaction data. When the weights and attributes of the edges are determined, the knowledge graph constructed based on nodes and edges, edge weights and edge attributes is more accurate, providing multi-dimensional data for subsequent graph analysis, and further improving the accuracy of identifying financial fraud gangs.

[0112] This embodiment provides a method for identifying fraud gangs based on knowledge graphs, which can be used in the above-mentioned computer. Figure 4 is a flow chart of a method for identifying fraud gangs based on knowledge graph according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0113] Step S401, obtain the device fingerprint data and transaction data generated during the financial transaction process. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0114] Step S402: extract the financial transaction entities and the relationships between the financial transaction entities in the device fingerprint data and transaction data based on entity recognition technology and relationship extraction technology. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0115] Step S403: construct a financial transaction knowledge graph based on the financial transaction entities and the relationships between them; the financial transaction knowledge graph includes multiple nodes and edges, where the nodes represent the financial transaction entities and the edges represent the relationships between them. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0116] Step S404: perform financial transaction feature analysis on the nodes and edges in the financial transaction knowledge graph based on graph analysis technology to identify target nodes with associated relationships.

[0117] It should be noted that the graph analysis technology in the above step S404 includes three categories, namely: correlation analysis algorithm, community discovery algorithm and path analysis algorithm. The target node identified based on the correlation analysis algorithm is the target node with the first type of correlation relationship; the target node identified based on the community discovery algorithm is the target node with the second type of correlation relationship; the target node identified based on the path analysis algorithm is the target node with the third type of correlation relationship.

[0118] Furthermore, the above step S404 can be implemented in the following three specific ways:

[0119] Method 1: According to the nodes in the financial transaction knowledge graph and the weights corresponding to each edge, the financial transaction features are associated based on the association analysis algorithm to analyze and determine the association between the nodes; the target nodes with the first type of association relationship are identified based on the association.

[0120] Specifically, for any two nodes, the cumulative weights of all paths between them are calculated, and a threshold is set. When the cumulative weight exceeds the threshold, the two nodes are considered to be strongly associated.

[0121] In the embodiment of the present invention, the weights corresponding to the nodes and each edge in the financial transaction knowledge graph are analyzed through an association analysis algorithm, and the relationship characteristics between the financial transaction entities and the entities are obtained from the weights. By calculating the association between the nodes, some entities that may belong to the same fraud gang can be found. Regardless of whether there is an association in the actual financial transaction process, the first-class association relationship between the nodes can be determined by the association, thereby ensuring the relationship identification between cross-domain financial transaction entities.

[0122] Method 2: According to the attributes of the nodes and each edge of the financial transaction knowledge graph, the nodes are clustered according to the financial transaction characteristics based on the community discovery algorithm; and the target nodes with the second type of association relationship are identified according to the financial transaction feature clustering results.

[0123] Specifically, the graph is divided into communities using label propagation algorithms, clustered according to node attributes and edge attributes, similar nodes are classified into one category to obtain multiple clustering results, the characteristics of the clustering results within each community are analyzed to identify suspicious communities, and all nodes in the suspicious communities are used as target nodes with second-category association relationships.

[0124] In an embodiment of the present invention, the attributes of the nodes and each edge in the financial transaction knowledge graph are clustered through a community discovery algorithm, and nodes with similar characteristics and behavior patterns are classified into the same community. After the knowledge graph is clustered, the clustering result of each node can display all entities with potential associations, avoiding the omission of cross-domain nodes, thereby effectively improving the accuracy of identifying financial fraud gangs.

[0125] Method 3: Based on the nodes and edges of the financial transaction knowledge graph, determine the path set from the start node to the end node of the financial transaction process involving multiple financial transaction entities; perform financial transaction feature analysis on the path set based on the path analysis algorithm to determine abnormal transit path nodes; identify target nodes with third-category association relationships based on the transit path nodes.

[0126] Specifically, determine the starting node and ending node of the transaction, and use depth-first search or breadth-first search to find all optional paths; analyze the characteristics of the optional paths based on the attributes of the edges, and the path characteristics include length, number of transfers, etc.; identify abnormal paths that do not conform to normal transaction patterns based on length and number of transfers.

[0127] The embodiments of the present invention can identify all possible paths between the starting node and the ending node in the financial transaction process, and after identifying the path set, analyze the characteristics of the path through a path analysis algorithm, so as to determine abnormal transit path nodes that should not appear in the normal transaction process. The abnormal nodes represent nodes of potential fraudulent behavior, and the abnormal nodes are clearly identified, thereby effectively improving the accuracy of identifying financial fraud gangs.

[0128] Step S405, determining the financial fraud gang according to the set of target nodes.

[0129] Specifically, the above step S405 includes:

[0130] Step S4051, determining the intersection node among the target nodes with the first type of association relationship, the target nodes with the second type of association relationship, and the target nodes with the third type of association relationship.

[0131] For example, the target node set identified by the association analysis algorithm is A = {a1, a2, a3, a4, a6, a8}, the target node set identified by the community discovery algorithm is B = {a2, a3, a5, a6, a8}, and the target node set identified by the path analysis algorithm is C = {a3, a6, a7, a8}. Then, the intersection of these three sets is {a3}, and the intersection nodes are determined to be a3, a6, and a8, which are high-risk target nodes in all three algorithms.

[0132] Step S4052, using a preset risk assessment model to calculate the fraud risk assessment value of the intersection node; the fraud risk assessment value represents a weighted assessment value of the transaction data risk value, the transaction address risk value, and the transaction path risk value.

[0133] Specifically, the preset risk assessment model stores the mapping relationship between transaction frequency and transaction data risk value, the mapping relationship between device address and transaction address risk value, and the mapping relationship between transit path and transaction path risk value. For example, the transaction frequency, device address, and transit path in the attributes of the edge connecting all other nodes with the intersection node a3 are matched with the above mapping relationships to obtain the corresponding risk values, and the weighted assessment value is obtained by weighted calculation according to the preset coefficients.

[0134] Step S4053: The set of financial transaction entities corresponding to all intersection nodes whose fraud risk assessment values ​​are greater than a preset risk threshold is regarded as a financial fraud gang.

[0135] For example, the preset risk threshold is 4.5, and the calculated fraud risk assessment value of a3 is 4.0. Since 4.0 is less than 4.5, a3 will not be determined as a member of a financial fraud gang (but can still be marked as a potential fraud gang member). If its fraud risk assessment value is 5.0, a3 will be determined as a member of a financial fraud gang. Similarly, it can be determined whether a6 and a8 are members of a financial fraud gang.

[0136] The embodiment of the present invention determines the intersection nodes among the target nodes with the first type of association relationship, the target nodes with the second type of association relationship, and the target nodes with the third type of association relationship, ensures that the screened nodes all meet the requirements of the above three types of risks, filters out the nodes with a single association relationship, thereby reducing the risk of misjudgment caused by a single relationship type, and uses a preset risk assessment model to perform fraud risk assessment on the intersection nodes. The risk assessment combines multiple factors such as transaction data risk, transaction address risk, and transaction path risk to obtain a risk value, quantifies the risk situation of the node, and screens out all intersection nodes that are higher than the preset risk threshold. Only when the fraud risk assessment value of the intersection node exceeds the threshold will it be identified as a potential fraud gang, reducing the misjudgment rate, thereby effectively improving the accuracy of identifying financial fraud gangs, and avoiding the inaccurate analysis and misjudgment of single data features that exist in the prior art.

[0137] In this embodiment, a fraud gang identification system based on knowledge graph is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0138] This embodiment provides a fraud gang identification system based on knowledge graph, such as Figure 5 As shown, including:

[0139] The data collection module 501 is used to obtain device fingerprint data and transaction data generated during the financial transaction process;

[0140] An entity relationship extraction module 502 is used to extract financial transaction entities and relationships between financial transaction entities in device fingerprint data and transaction data based on entity recognition technology and relationship extraction technology;

[0141] The knowledge graph construction module 503 is used to construct a financial transaction knowledge graph based on financial transaction entities and the relationships between the financial transaction entities; the financial transaction knowledge graph includes a plurality of nodes and edges, wherein the nodes represent the financial transaction entities and the edges represent the relationships between the financial transaction entities;

[0142] The feature analysis module 504 is used to perform financial transaction feature analysis on the nodes and edges in the financial transaction knowledge graph based on the graph analysis technology, and identify the target nodes with associated relationships;

[0143] The fraud group identification module 505 is used to determine the financial fraud group according to the set of target nodes.

[0144] In an optional implementation, the entity relationship extraction module 502 specifically includes:

[0145] The financial transaction entity recognition unit is used to train the recognition model of financial transaction entities using a deep learning algorithm based on the vocabulary of transaction objects in the financial field;

[0146] A transaction data input unit, used to input device fingerprint data and transaction data into an identification model of a financial transaction entity to identify the financial transaction entity;

[0147] The transaction relationship analysis unit is used to determine the relationship between financial transaction entities from the transaction data using the financial transaction entities according to predefined transaction business rules.

[0148] In an optional implementation, the knowledge graph construction module 503 specifically includes:

[0149] A graph modeling mapping unit, used to map financial transaction entities into nodes using graph modeling technology, and to map relationships between financial transaction entities into edges;

[0150] A transaction frequency and amount calculation unit, used to determine the transaction frequency and transaction amount between every two financial transaction entities according to the relationship between the financial transaction entities;

[0151] An edge weight calculation unit, used to determine the weight of the edge between the nodes corresponding to every two financial transaction entities according to the transaction frequency and the transaction amount;

[0152] An edge attribute calculation unit, used to determine the attribute of the edge between nodes corresponding to every two financial transaction entities according to the device fingerprint data and the transaction data;

[0153] The financial transaction knowledge graph construction unit is used to construct a financial transaction knowledge graph based on nodes, edges, edge weights, and edge attributes.

[0154] In an optional implementation, the graph analysis technology includes a correlation analysis algorithm; the feature analysis module 504 specifically includes:

[0155] A correlation analysis unit is used to associate financial transaction features based on the nodes in the financial transaction knowledge graph and the weights corresponding to each edge based on the correlation analysis algorithm, and to analyze and determine the correlation between the nodes;

[0156] The first type association relationship identification unit is used to identify the target node with the first type association relationship according to the association degree.

[0157] In an optional implementation, the graph analysis technology includes a community discovery algorithm; the feature analysis module 504 specifically includes:

[0158] The community discovery clustering unit is used to cluster the nodes into financial transaction features based on the community discovery algorithm according to the attributes of the nodes and each edge of the financial transaction knowledge graph;

[0159] The second type association relationship identification unit is used to identify the target node with the second type association relationship according to the financial transaction feature clustering result.

[0160] In an optional implementation, the graph analysis technology includes a path analysis algorithm; the feature analysis module 504 specifically includes:

[0161] A path set analysis unit, used to determine a path set from a start node to an end node of a financial transaction process including multiple financial transaction entities according to the nodes and edges of the financial transaction knowledge graph;

[0162] A path analysis and anomaly detection unit, used to analyze the financial transaction characteristics of the path set based on the path analysis algorithm and determine the transit path nodes with abnormalities;

[0163] The third type association relationship identification unit is used to identify the target node with the third type association relationship according to the transit path node.

[0164] In an optional implementation, the fraud gang identification module 505 specifically includes:

[0165] An intersection node identification unit, used to determine an intersection node among target nodes with a first type of association relationship, target nodes with a second type of association relationship, and target nodes with a third type of association relationship;

[0166] A risk assessment model calculation unit, used to calculate a fraud risk assessment value of an intersection node using a preset risk assessment model; the fraud risk assessment value represents a weighted assessment value of a transaction data risk value, a transaction address risk value, and a transaction path risk value;

[0167] The financial fraud gang identification unit is used to regard the set of financial transaction entities corresponding to all intersection nodes whose fraud risk assessment values ​​are greater than a preset risk threshold as a financial fraud gang.

[0168] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0169] The knowledge graph-based fraud gang identification system in this embodiment is presented in the form of functional units, where the units refer to ASIC (Application Specific Integrated Circuit) circuits, processors and memories that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0170] The embodiment of the present invention also provides a computer device having the above Figure 5 The knowledge graph-based fraud gang identification system shown.

[0171] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0172] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0173] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0174] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0175] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0176] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0177] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0178] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0179] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the defined scope.

Claims

1. A method for identifying fraud gangs based on knowledge graph, characterized in that: The method comprises: Obtain device fingerprint data and transaction data generated during financial transactions; Extracting financial transaction entities and relationships between financial transaction entities in the device fingerprint data and the transaction data based on entity recognition technology and relationship extraction technology; Constructing a financial transaction knowledge graph based on the financial transaction entities and the relationships between the financial transaction entities; the financial transaction knowledge graph includes a plurality of nodes and edges, wherein the nodes represent the financial transaction entities and the edges represent the relationships between the financial transaction entities; Performing financial transaction feature analysis on the nodes and edges in the financial transaction knowledge graph based on graph analysis technology to identify target nodes with associated relationships; A financial fraud gang is determined based on the set of target nodes.

2. The method according to claim 1, characterized in that The extracting of financial transaction entities and the relationships between financial transaction entities in the device fingerprint data and the transaction data based on entity recognition technology and relationship extraction technology specifically includes: Based on the vocabulary of transaction objects in the financial field, a deep learning algorithm is used to train the recognition model of financial transaction entities; Inputting the device fingerprint data and the transaction data into an identification model of the financial transaction entity to identify the financial transaction entity; According to predefined transaction business rules, the relationship between the financial transaction entities is determined from the transaction data using the financial transaction entities.

3. The method according to claim 1, characterized in that The constructing of a financial transaction knowledge graph based on the financial transaction entities and the relationships between the financial transaction entities specifically includes: Mapping the financial transaction entities into nodes and mapping the relationships between the financial transaction entities into edges using graph modeling technology; Determine the transaction frequency and transaction amount between every two financial transaction entities according to the relationship between the financial transaction entities; Determine the weight of the edge between the nodes corresponding to every two financial transaction entities according to the transaction frequency and the transaction amount; Determine the attributes of the edge between the nodes corresponding to each two financial transaction entities according to the device fingerprint data and the transaction data; A financial transaction knowledge graph is constructed based on the nodes, the edges, the weights of the edges, and the attributes of the edges.

4. The method according to claim 3, characterized in that The graph analysis technology includes an association analysis algorithm; the graph analysis technology is used to analyze the nodes and edges in the financial transaction knowledge graph for financial transaction characteristics, and to identify target nodes with association relationships, specifically including: According to the nodes in the financial transaction knowledge graph and the weights corresponding to each edge, the financial transaction features are associated based on the association analysis algorithm to analyze and determine the association between the nodes; A target node having a first type of association relationship is identified according to the association degree.

5. The method according to claim 3, characterized in that: The graph analysis technology includes a community discovery algorithm; the graph analysis technology is used to analyze the nodes and edges in the financial transaction knowledge graph for financial transaction characteristics, and to identify target nodes with associated relationships, specifically including: According to the attributes of the nodes and each edge of the financial transaction knowledge graph, the nodes are clustered into financial transaction features based on a community discovery algorithm; According to the financial transaction feature clustering result, a target node having a second type of association relationship is identified.

6. The method according to claim 3, characterized in that The graph analysis technology includes a path analysis algorithm; the graph analysis technology is used to analyze the nodes and edges in the financial transaction knowledge graph for financial transaction characteristics, and to identify target nodes with associated relationships, specifically including: Determine, based on the nodes and edges of the financial transaction knowledge graph, a path set from a starting node to an ending node of a financial transaction process including multiple financial transaction entities; Performing financial transaction feature analysis on the path set based on the path analysis algorithm to determine abnormal transit path nodes; The target node with the third type of association relationship is identified based on the transit path node.

7. The method according to any one of claims 4 to 6, characterized in that Determining a financial fraud gang according to the set of target nodes specifically includes: Determine an intersection node among target nodes with a first type of association relationship, target nodes with a second type of association relationship, and target nodes with a third type of association relationship; Calculating the fraud risk assessment value of the intersection node using a preset risk assessment model; the fraud risk assessment value represents a weighted assessment value of the transaction data risk value, the transaction address risk value, and the transaction path risk value; The set of financial transaction entities corresponding to all intersection nodes whose fraud risk assessment values ​​are greater than a preset risk threshold is regarded as a financial fraud gang.

8. A fraud gang identification system based on knowledge graph, characterized in that: The system comprises: A data collection module, used to obtain device fingerprint data and transaction data generated during financial transactions; An entity relationship extraction module, used for extracting financial transaction entities and relationships between financial transaction entities in the device fingerprint data and the transaction data based on entity recognition technology and relationship extraction technology; A knowledge graph construction module, used to construct a financial transaction knowledge graph based on the financial transaction entities and the relationships between the financial transaction entities; the financial transaction knowledge graph includes a plurality of nodes and edges, wherein the nodes represent the financial transaction entities and the edges represent the relationships between the financial transaction entities; A feature analysis module, used to perform financial transaction feature analysis on the nodes and edges in the financial transaction knowledge graph based on graph analysis technology, and identify target nodes with associated relationships; A fraud group identification module is used to determine a financial fraud group based on the set of target nodes.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the fraud gang identification method based on knowledge graph described in any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the fraud gang identification method based on knowledge graph described in any one of claims 1-7.

Images