Anti-fraud method, device and system based on knowledge graph reasoning and storage medium

Abstract

The invention discloses an anti-fraud method, device and system based on knowledge graph reasoning and a storage medium, and belongs to the technical field of artificial intelligence. The method comprises the steps of obtaining a fraud case text, performing first information extraction processing and word embedding processing on the fraud case text to obtain case entity information represented by a vector, and performing second information extraction processing and word embedding processing on the fraud case text to obtain victim archive information represented by the vector. And according to the case entity information and the victim archive information, constructing a fraud knowledge graph, obtaining object feature information of the target object, and according to the object feature information and the fraud knowledge graph, recommending a fraud learning case. According to the method, more personalized fraud case recommendation can be provided according to user characteristics based on the knowledge graph, the masses can better understand the current situation of fraud, and accurate fraud prevention is achieved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an anti-fraud method, device, system and storage medium based on knowledge graph reasoning. Background Art

[0002] Traditional anti-fraud systems rely mostly on pre-set rules and manual experience to identify fraudulent behavior. Due to the limitations of rules and manual labor, it is difficult to cope with the ever-changing fraud methods. It takes a lot of time and manpower to update the rules and upgrade the system to deal with fraud.

[0003] Some financial industries use intelligent risk control platforms to prevent fraud. The operating process is usually to collect user transaction data, such as transaction time, location, amount, etc., and input it into a neural network model for analysis. The model will score the transaction for fraud risk based on the learned pattern. However, most systems cannot deeply understand the inherent relationship between the user's personalized characteristics and potential fraud risks, and lack the technical means to actively prevent potential fraud for users. Summary of the invention

[0004] The main purpose of the embodiments disclosed herein is to propose an anti-fraud method, device, system and storage medium based on knowledge graph reasoning, which can provide more personalized fraud case recommendations based on user characteristics, improve the public's understanding of the current situation of fraud, prevent the public from being seriously defrauded, and achieve accurate fraud prevention.

[0005] On the one hand, an embodiment of the present invention proposes an anti-fraud method based on knowledge graph reasoning, comprising the following steps:

[0006] Get the fraud case text;

[0007] Performing a first information extraction process and a word embedding process on the fraud case text to obtain case entity information represented by a vector, wherein the case entity information includes multiple entities and entity relationships;

[0008] Performing second information extraction and word embedding processing on the fraud case text to obtain victim profile information represented by a vector;

[0009] Construct a fraud knowledge graph based on the case entity information and the victim profile information;

[0010] Obtaining object feature information of a target object;

[0011] Recommend fraud learning cases based on the object feature information and the fraud knowledge graph.

[0012] In some embodiments, the step of obtaining the fraud case text includes the following steps:

[0013] Initialize the uniform resource locator;

[0014] Crawl fraud-related web pages according to the uniform resource locator, and obtain a new uniform resource locator from the web pages;

[0015] Filter out the Uniform Resource Locators that are not related to fraud from the new Uniform Resource Locators;

[0016] Putting the filtered uniform resource locator into a uniform resource locator queue;

[0017] Determining the uniform resource locator priority from the uniform resource locator queue according to the crawling strategy;

[0018] Determine a target uniform resource locator from the uniform resource locators with high priority;

[0019] Crawl the next web page according to the target uniform resource locator;

[0020] Determining whether there is a new uniform resource locator available on the web page;

[0021] When there is a new uniform resource locator that can be obtained, repeating the step of filtering out the uniform resource locators that are not related to fraud from the new uniform resource locators to the step of crawling the next web page according to the target uniform resource locator;

[0022] When there is no new uniform resource locator available, the crawling of the web pages is stopped, and the fraud case text is determined based on all the crawled web pages.

[0023] In some embodiments, the first information extraction process and word embedding process are performed on the fraud case text to obtain case entity information represented by a vector, including the following steps:

[0024] Obtain a preset first prompt word, wherein the first prompt word includes a first task description and a type description, the first task description is used to inform the large-scale language model to perform entity extraction and entity relationship extraction tasks in the fraud case text; the type description is used to prompt the large-scale language model to extract entity types and entity relationship types related to fraud;

[0025] Forming a first question text according to the first prompt word and the fraud case text;

[0026] Inputting the first question text into the large-scale language model to obtain the case entity information, wherein the case entity information includes a plurality of triples of the entity and the entity relationship;

[0027] A pre-trained language model is used to perform word embedding processing on the plurality of triples to obtain the case entity information represented by a vector.

[0028] In some embodiments, the step of performing a second information extraction process and a word embedding process on the fraud case text to obtain victim profile information represented by a vector comprises the following steps:

[0029] Obtaining a preset second prompt word, wherein the second prompt word includes a second task description, and the second task description is used to inform the large-scale language model to perform a victim profile extraction task in the fraud case text;

[0030] Forming a second question text according to the second prompt word and the fraud case text;

[0031] Inputting the second question text into a large-scale language model to obtain a victim profile;

[0032] The victim profile is processed by word embedding using a pre-trained language model to obtain the victim profile information represented by a vector.

[0033] In some embodiments, the step of constructing a fraud knowledge graph based on the case entity information and the victim profile information includes the following steps:

[0034] Using entities in the case entity information as nodes and entity relationships in the case entity information as edges of nodes to construct a directed graph;

[0035] Writing node attributes into the node representing the victim in the directed graph according to the victim profile information to obtain a fraud case subgraph of a single fraud case;

[0036] Similar nodes between the fraud case subgraphs of different fraud cases are connected to obtain a fraud knowledge graph.

[0037] In some embodiments, the anti-fraud method based on knowledge graph reasoning further includes the following steps:

[0038] Using a graph attention model to calculate the attention weight values ​​of the central node and adjacent nodes of the fraud knowledge graph;

[0039] Adopting the aggregation mechanism of the graph attention model, the relationship and attribute of each of the central nodes are trained according to the attention weight value to obtain new relationships and attributes of the central nodes;

[0040] The fraud knowledge graph is completed according to the new relationships and attributes of the central node.

[0041] In some embodiments, the recommending fraud learning cases according to the object feature information and the fraud knowledge graph comprises the following steps:

[0042] Searching for related entities in the fraud knowledge graph according to the object feature information to obtain a target entity;

[0043] Obtain the corresponding fraud case subgraph in the fraud knowledge graph according to the target entity and the relationship and attribute of the target entity;

[0044] Determine the corresponding fraud learning case according to the fraud case subgraph;

[0045] Different forms of the above-mentioned fraud learning cases are presented through a visual front end.

[0046] On the other hand, an embodiment of the present invention proposes an anti-fraud system based on knowledge graph reasoning, including:

[0047] The first module is used to obtain fraud case texts;

[0048] The second module is used to perform first information extraction processing and word embedding processing on the fraud case text to obtain case entity information represented by a vector, wherein the case entity information includes multiple entities and entity relationships;

[0049] The third module is used to perform second information extraction processing and word embedding processing on the fraud case text to obtain victim profile information represented by a vector;

[0050] The fourth module is used to construct a fraud knowledge graph based on the case entity information and the victim profile information;

[0051] The fifth module is used to obtain object feature information of the target object;

[0052] The sixth module is used to recommend fraud learning cases based on the object feature information and the fraud knowledge graph.

[0053] On the other hand, an embodiment of the present invention provides an electronic device, including:

[0054] at least one processor;

[0055] at least one memory for storing at least one program;

[0056] When the at least one program is executed by the at least one processor, the at least one processor implements the anti-fraud method based on knowledge graph reasoning as described above.

[0057] On the other hand, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the anti-fraud method based on knowledge graph reasoning as described above.

[0058] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes an anti-fraud method, device, system and storage medium based on knowledge graph reasoning. The scheme collects fraud case texts, extracts information and embeds words on the fraud case texts to form a fraud knowledge graph. According to the fraud knowledge graph, more personalized fraud case recommendations can be provided based on user characteristics, thereby improving the public's understanding of the current situation of fraud, preventing the public from being seriously defrauded, and achieving accurate fraud prevention. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a flow chart of an anti-fraud method based on knowledge graph reasoning provided by an embodiment of the present invention;

[0060] Figure 2 is a flow chart of an anti-fraud system provided by an embodiment of the present invention;

[0061] Figure 3 is a flow chart of a focused crawler provided by an embodiment of the present invention;

[0062] Figure 4 is a schematic diagram of the structure of a preprocessing module provided in an embodiment of the present invention;

[0063] Figure 5 It is a schematic diagram of the structure of the knowledge graph embedding module provided by an embodiment of the present invention;

[0064] Figure 6 is a flowchart of entity and entity relationship word embedding provided by an embodiment of the present invention;

[0065] Figure 7 is a schematic diagram of the structure of a victim embedding module provided by an embodiment of the present invention;

[0066] Figure 8 is a victim profile word embedding flow chart provided by an embodiment of the present invention;

[0067] Fig. 9 is a knowledge graph reasoning flowchart provided by an embodiment of the present invention;

[0068] Fig.10 is a schematic diagram of the aggregation calculation of GAT provided by an embodiment of the present invention;

[0069] Fig.11 is a schematic diagram of the aggregation mechanism of GAT provided by an embodiment of the present invention;

[0070] Fig.12 It is a schematic diagram of the hardware structure of the electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0071] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0072] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0073] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0074] First, some nouns involved in this application are analyzed:

[0075] Natural language processing (NLP): NLP uses computers to process, understand and apply human languages ​​(such as Chinese, English, etc.). NLP is a branch of artificial intelligence and an interdisciplinary subject between computer science and linguistics. It is often referred to as computational linguistics. Natural language processing includes grammatical analysis, semantic analysis, and text comprehension. Natural language processing is often used in technical fields such as machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, information retrieval, information extraction and filtering, text classification and clustering, feedback information analysis and opinion mining. It involves data mining related to language processing, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research, and linguistic research related to language computing.

[0076] Information extraction (lnformation·Extraction): Extracting specified types of entity, relationship, event and other factual information from natural language text and forming a text processing technology for structured data output. Information extraction is a technology for extracting specific information from text data. Text data is composed of some specific units, such as sentences, paragraphs, and chapters. Text information is composed of some small specific units such as characters, words, phrases, sentences, paragraphs, or a combination of these specific units. Extracting noun phrases, names, place names, etc. from text data are all text information extraction. Of course, the information extracted by text information extraction technology can be various types of information.

[0077] Graph Neural Network (GNN) is a framework that uses deep learning to directly learn graph structured data in recent years. Its excellent performance has attracted great attention and in-depth exploration from scholars. By formulating certain strategies on the nodes and edges in the graph, GNN converts graph structured data into a standardized and standard representation, and inputs it into a variety of different neural networks for training, achieving excellent results in tasks such as node classification, edge information propagation, and graph clustering. From the concept of GNN proposed by Gori et al. in 2005, to the emergence of GCN to provide an effective processing paradigm for non-Euclidean structured data, to the proposal of different GNN framework variants such as GAE, GAT, GRN, GGN, and the application of GNN in various fields, GNN has experienced a process from scratch to optimization in theory and practice, and the GNN system family is also constantly developing and improving.

[0078] BERT (Bidirectional Encoder Representation from Transformers) model: The BERT model further increases the generalization ability of the word vector model, fully describes the characteristics of character level, word level, sentence level and even inter-sentence relationship, and is built based on Transformer. There are three types of Embedding in BERT, namely Token Embedding, Segment Embedding, and Position Embedding; Token Embeddings is a word vector, and the first word is the CLS mark, which can be used for subsequent classification tasks; Segment Embeddings is used to distinguish between two sentences, because pre-training not only does LM but also does classification tasks with two sentences as input; Position Embeddings, the position word vector here is not the trigonometric function in Transfor, but is learned by BERT through training. However, BERT directly trains a Position embedding to retain the position information, randomly initializes a vector for each position, adds model training, and finally obtains an embedding containing position information. Finally, in terms of the combination of Position embedding and word embedding, BERT chooses to directly splice.

[0079] Embedding: Embedding Layer is a word embedding jointly learned with a neural network model for specific natural language processing. This embedding method one hot encodes the words in the cleaned text, and the size or dimension of the vector space is specified as part of the model, such as 50, 100, or 300 dimensions. The vector is initialized with a small random number. The Embedding Layer is used at the front end of the neural network and is supervised by the backpropagation algorithm. The encoded words are mapped into word vectors, and if a multi-layer perceptron model MLP is used, the word vectors are cascaded before being input into the model. If a recurrent neural network RNN ​​is used, each word can be used as an input in the sequence. This method of learning the embedding layer requires a lot of training data and can be slow, but it can learn and train embedding models that are both specific to text data and for NLP. Embedding is a vector representation, which means using a low-dimensional vector to represent an object. The object can be a word, a product, a movie, etc. The nature of this Embedding vector is that it can make objects corresponding to vectors with similar distances have similar meanings. For example, the distance between Embedding (Avengers) and Embedding (Iron Man) will be very close, but the distance between Embedding (Avengers) and Embedding (Gone with the Wind) will be farther. Embedding is essentially a mapping from semantic space to vector space, while trying to maintain the relationship of the original samples in the semantic space in the vector space. For example, the positions of two words with similar semantics in the vector space are also relatively close. Embedding can encode objects with low-dimensional vectors and retain their meaning. It is often used in machine learning. In the process of building machine learning models, objects are encoded into a low-dimensional dense vector and then passed to DNN to improve efficiency.

[0080] Reference Figure 1 As shown, the anti-fraud method based on knowledge graph reasoning of an embodiment of the present invention includes but is not limited to steps S100 to S600.

[0081] Step S100, obtaining fraud case text;

[0082] Step S200, performing first information extraction processing and word embedding processing on the fraud case text to obtain case entity information represented by a vector, wherein the case entity information includes multiple entities and entity relationships;

[0083] Step S300, performing a second information extraction process and a word embedding process on the fraud case text to obtain victim profile information represented by a vector;

[0084] Step S400, constructing a fraud knowledge graph based on case entity information and victim profile information;

[0085] Step S500, obtaining object feature information of the target object;

[0086] Step S600, recommending fraud learning cases based on object feature information and the fraud knowledge graph.

[0087] In some embodiments, after using web crawlers, swarm intelligence, data perception, publishing, and calling multiple sensors of smartphones to collect data extensively, a knowledge graph with various attributes of fraud cases as entities is built based on a graph neural network (GNN). The knowledge graph can build a complete anti-fraud system and system for financial institutions and enterprises, effectively prevent financial fraud, and ultimately achieve greater social and economic benefits.

[0088] Reference Figure 2 , Figure 2 This is the flow chart of the anti-fraud system of this embodiment. First, based on large-scale fraud case texts, web crawlers and crowd intelligence perception are used to obtain initial data. After data cleaning, GPT-4.0 is used to extract keywords and store them in the knowledge graph. Secondly, the GNN neural network is used for knowledge reasoning. Finally, fraud cases are recommended based on user characteristics. User characteristics usually include basic information such as gender and age of the user, as well as user personal preferences, browsing articles and other behavioral information. Experiments have shown that this recommendation method based on user characteristics can effectively provide personalized fraud case recommendations based on the needs and risk conditions of different users, helping users better identify and prevent various types of fraud.

[0089] In some embodiments, for a young working woman, the system may give priority to recommending fraud cases related to beauty, shopping, and the workplace based on her age and gender characteristics. If online shopping-related content appears multiple times in her browsing history, the system will further strengthen the recommendation of online shopping fraud cases. At the same time, if there are friends in her social circle who have encountered online shopping fraud, this will also increase the recommendation weight of related cases. Finally, the fraud case recommendation results are presented to users through the APP and mini-programs, and the entity relationship diagram between users and knowledge graphs is displayed to explore the relationship between users and fraud cases. Users can more intuitively understand their potential risks in fraud cases and enhance their awareness of prevention.

[0090] In some embodiments of step S100, web crawlers, swarm intelligence, data perception, publishing, and calling multiple sensors of smart phones to widely collect data are used as the basis of fraud case texts. In order to quickly obtain a large amount of fraud case texts from the Internet, web crawlers are usually used to download web pages on the Internet to the local computer to form a mirror backup of Internet content. A general crawler may crawl all pages on the entire Internet, regardless of whether these pages are relevant to the user's query. In contrast, a focused crawler will only crawl pages related to a specific topic. For example, a focused crawler about "fraud" will only crawl web pages related to fraud and ignore other irrelevant content. Therefore, a focused crawler is used to obtain fraud-related network data from the Internet as the basis of fraud case texts.

[0091] In some embodiments, step S100 may include but is not limited to the following steps:

[0092] Step S110, initializing the uniform resource locator;

[0093] Step S120, crawling fraud-related web pages according to the uniform resource locator, and obtaining a new uniform resource locator from the web pages;

[0094] Step S130, putting the filtered uniform resource locator into a uniform resource locator queue;

[0095] Step S140, determining the uniform resource locator priority from the uniform resource locator queue according to the crawling strategy;

[0096] Step S150, determining a target uniform resource locator from uniform resource locators with high priority;

[0097] Step S160, crawling the next web page according to the target uniform resource locator;

[0098] Step S170, determining whether there is a new uniform resource locator that can be obtained on the web page;

[0099] Step S180, when there is a new uniform resource locator that can be obtained, repeat the steps of filtering out uniform resource locators that are not related to fraud from the new uniform resource locators to the step of crawling the next web page according to the target uniform resource locator;

[0100] Step S190, when there is no new uniform resource locator available, stop crawling web pages, and determine the fraud case text based on all crawled web pages.

[0101] In this embodiment, the requests and selenium libraries of Python are used to dynamically crawl HTML web pages using the method of focused crawlers. The request library is a native module based on network requests in Python. It is very powerful, simple and convenient, and highly efficient. The selenium library can easily obtain dynamically loaded data on the website and easily implement simulated login. This method can collect sufficient data as the basis of the knowledge graph.

[0102] Reference Figure 3 , Figure 3 It focuses on the crawler flow chart, initializes the crawler task, sets the target theme of the crawler as fraud, configures the parameters of the crawler, including the maximum crawling depth, the limit on the number of crawled pages, and the exclusion of domain names, etc., initializes the crawler system, including setting up the storage and logging environment, loading the necessary configuration files, and checking the network connection, putting the initial uniform resource locator (URL) into the URL queue, waiting for processing, setting the initial depth and priority information to help with subsequent screening and evaluation, accessing the initial URL through network requests, obtaining web page content, using the HTML parsing library to parse the web page content, extracting key information such as text, title, keywords, links, etc. If the access fails, record the error message and skip the URL, and continue to process the next URL. In the obtained web page content, extract all new URLs, clean and normalize them, perform preliminary screening on the newly extracted URLs, such as filtering out links that are not related to the target theme, or excluding URLs that have been crawled, add the screened URLs to the URL queue, mark their sources and relevance evaluation, and prepare for subsequent crawling. For each URL to be processed, a specific topic analysis algorithm (such as TF-IDF, word vector, BERT, etc.) is used to calculate the topic relevance of the page content, and each URL is prioritized according to the matching degree with the target topic, page structure (such as page title, meta tag), word frequency and other information. URLs with higher priority will be crawled first, and URLs with lower priority may be discarded or delayed. Through sorting and screening strategies, the current optimal URL is determined for crawling. Common selection strategies include: Breadth First (BFS): Prioritize crawling all URLs at the current depth to ensure coverage. Depth First (DFS): Prioritize crawling URLs with larger depth to explore specific content faster. Relevance First: Prioritize crawling URLs with higher scores and focus on the content most relevant to the topic. Check regularly whether the stop conditions are met. The stop conditions may include: Reaching the specified crawling depth: After exceeding a certain depth, it is considered no longer valuable to continue crawling. Enough content has been collected: Enough relevant content has been obtained. Queue is empty: There are no more links to be crawled in the URL queue. If the stop condition is not met, return to the URL selection step and continue processing the next URL.

[0103] In this embodiment, in order to obtain specific data on online fraud, it is necessary to search for relevant fraud cases on the Internet as a data set. The websites to be collected need to have comprehensive information, detailed descriptions and authority, which can effectively avoid problems such as insufficient information and unclear details in traditional news reports.

[0104] For example, the source of data can be some professional legal databases, well-known news media websites, and user interactive communication platforms, etc. In summary, 2221 fraud-related articles from 2022 to 2023 were crawled, including many new types of fraud, such as "AI fraud", "part-time order brushing", etc., and these articles were used as data sources.

[0105] In some embodiments, after obtaining the fraud case text, it is necessary to perform information extraction and word embedding processing on the fraud case text to extract the case entity information and victim profile information required by the fraud case text, and construct a knowledge graph based on the extracted information. This process can be implemented in the preprocessing module. Figure 4 As shown, Figure 4 This is a schematic diagram of the preprocessing module structure. The preprocessing module is responsible for extracting case relationship information and victim information from fraud texts and constructing a knowledge graph for subsequent reasoning. The input of this module is the fraud case text, and the output is a knowledge graph. The preprocessing module contains two submodules, namely the knowledge graph embedding module and the victim profile embedding module.

[0106] The fraud case text is used as the input data source. By parsing the information in the case text, it provides a data source for the preprocessing module. The knowledge graph embedding module extracts entities and entity relationships from the text content and maps them to the vector space. The victim embedding module extracts and converts each victim profile into a vectorized numerical representation, and associates the embedded representation of the victim profile with the entity nodes and relationships in the knowledge graph, thus forming a knowledge graph.

[0107] In some embodiments of step S200, please refer to Figure 5 , Figure 5 This is a schematic diagram of the knowledge graph embedding module structure. The knowledge graph embedding module plays a key role in the entire anti-fraud analysis system. First, the first information extraction process is to accurately extract entities and entity relationships from the fraud case text. Entity types may include fraudsters, victims, fraud methods, fraud amounts, etc., while relationship types may involve the way fraudsters commit fraud, the process of victims suffering from fraud, etc. Then, word embedding processing is performed on entities and entity relationships to obtain case entity information represented by vectors. The vectors are used to represent the entities and entity relationships of fraud cases, thereby providing a basic data structure for subsequent knowledge graph construction and analysis.

[0108] In some embodiments, step S200 may include but is not limited to the following steps:

[0109] Step S210, obtaining a preset first prompt word, wherein the first prompt word includes a first task description and a type description, the first task description is used to inform the large-scale language model to perform entity extraction and entity relationship extraction tasks in the fraud case text; the type description is used to prompt the large-scale language model to extract entity types and entity relationship types related to fraud;

[0110] Step S220, forming a first question text according to the first prompt word and the fraud case text;

[0111] Step S230, inputting the first question text into a large-scale language model to obtain case entity information, wherein the case entity information includes a plurality of triples of entities and entity relationships;

[0112] Step S240, using a pre-trained language model to perform word embedding processing on multiple triples to obtain case entity information represented by vectors.

[0113] In some embodiments of steps S210 to S230, the input of the knowledge graph embedding module is the fraud case text, which is a source of original data containing rich fraud-related information. Then, entity relationship extraction is performed based on GPT-4.0. As an advanced large-scale language model in the field of contemporary natural language processing, GPT-4.0 has powerful capabilities and can cover a variety of tasks. Among them, entity relationship extraction from text resources is an important function used by this module. In order to give full play to the entity relationship information extraction capability of GPT-4.0 in the fraud case text, prompts that meet specific requirements are carefully designed. The first prompt includes but is not limited to the following prompts:

[0114] Detailed description of the task: The first task description clearly tells GPT-4.0 that it needs to perform entity relationship extraction tasks in fraud case texts. In this process, it is emphasized that the recognition and understanding of the relationships between different entities in the text is crucial, allowing GPT-4.0 to focus on extracting key information from fraud cases.

[0115] Type description: Detailed explanation of the entity types and relationship types that need to be identified. Special attention is paid to entity types and relationship types that are closely related to fraud cases. For example, in fraud cases, common entity types may include fraudsters, victims, fraud methods, fraud amounts, etc., while relationship types may involve the way fraudsters commit fraud, the process of victims being defrauded, etc. Through detailed type descriptions, GPT-4.0 is guided to more accurately identify and extract relevant information.

[0116] Output format: Clearly explain the answer format of GPT-4.0, which is crucial for the subsequent data processing process. A reasonable output format can ensure that the extracted information can be effectively integrated and utilized.

[0117] Examples: Provide some representative examples to help GPT-4.0 better understand the task. These examples should cover different types of fraud cases and entity relationship combinations so that GPT-4.0 can understand the task requirements from multiple perspectives and improve the accuracy of information extraction.

[0118] By guiding GPT-4.0 to process the fraud case text through the above carefully designed prompt words, it can obtain several pairs of triplets containing entities and relationships, and both entities and relationships have two parts: type and description.

[0119] The output is a (H, R, T) triple, where H, R, and T represent the word embedding vectors of the head entity, relationship, and tail entity, respectively, and n is the dimension of the word embedding. This triple structure can effectively represent the relationship between entities and lays the foundation for the construction of the knowledge graph.

[0120] In some embodiments of step S240, the extracted case entity information is word-embedded based on the BERT model, such as Figure 6 As shown in the figure, after obtaining the entities and relations extracted by GPT-4.0, the pre-trained BERT model is introduced for word embedding processing. The specific word embedding method is to use the type and description of the entity or relationship as the input of the BERT model, and finally take the pool value of the BERT output layer as the word embedding vector through the internal calculation mechanism of the BERT model. This method can convert entities and relations into vector representations with specific dimensions, which is convenient for processing and calculation in the subsequent knowledge graph construction and analysis.

[0121] Finally, we obtained triplets of the form (H, R, T). These triplets will serve as the basic elements for constructing the knowledge graph and provide data support for further mining entity relationships and knowledge in fraud cases.

[0122] In some embodiments of step S300, please refer to Figure 7 , Figure 7 This is a schematic diagram of the victim embedding module structure. The module extracts the second information, sorts out the victim files in the fraud case text, and embeds the victim files. The module inputs the fraud case text and outputs the victim file information represented by a vector. The various features of the victim file information are represented by vectors as the basic data structure, which is convenient for the case entity information represented by the vector to form a fraud case and the victim are associated with each other, forming a fraud knowledge graph.

[0123] In some embodiments, step S300 may include but is not limited to the following steps:

[0124] Step S310, obtaining a preset second prompt word, wherein the second prompt word includes a second task description, and the second task description is used to inform the large-scale language model to perform a victim profile extraction task in the fraud case text;

[0125] Step S320, forming a second question text according to the second prompt word and the fraud case text;

[0126] Step S330, inputting the second question text into the large-scale language model to obtain a victim profile;

[0127] Step S340: Use the pre-trained language model to perform word embedding processing on the victim profile to obtain the victim profile information represented by a vector.

[0128] In some embodiments of step S310 to step S330, firstly, based on the victim profile information extraction of the large model, in order to enhance the victim profile extraction capability of GPT-4.0 in the fraud case text, a prompt word, i.e., the second prompt word, is provided to GPT-4.0, and the task, i.e., the second task description, is described in detail in the prompt word, and the victim profile is extracted from the fraud case text. In this context, the focus is on analyzing the factors of victim deception and the characteristics of the task. Victim profiles are extracted from the fraud case text by GPT-4.0 to obtain several victim profiles.

[0129] In some embodiments of step S340, refer to Figure 8 , word embedding is performed based on the BERT embedding model, and the victim files are embedded using the pre-trained BERT model. The specific method is to use the victim files as the input of the BERT model, and finally take the pool value of the BERT output layer as the word embedding vector.

[0130] In some embodiments, step S400 may include but is not limited to the following steps:

[0131] Step S410, constructing a directed graph by taking entities in the case entity information as nodes and entity relationships in the case entity information as edges of the nodes;

[0132] Step S420, writing node attributes into the node representing the victim in the directed graph according to the victim profile information, and obtaining a fraud case subgraph of a single fraud case;

[0133] Step S430, connecting similar nodes between fraud case subgraphs of different fraud cases to obtain a fraud knowledge graph.

[0134] In this embodiment, the connection between the victim and the knowledge graph is established, wherein constructing a directed graph G(V, E) is a key step in establishing the connection between the victim and the knowledge graph, wherein V represents the point set of the graph, E represents the edge set, and satisfies G(V, E) = mG(i). Here m represents the number of fraud case texts, and each fraud case text corresponds to a subgraph G(i), which contains its own point set V(i) and edge set E(i). There is and exists a victim node in G(i), denoted as c(i)∈V(i), and N(c(i)) = V(i)-N(c(i)). N(i) represents the set of neighbor nodes of node i.

[0135] Then determine the feature vectors of nodes and edges, the node feature vector u i The determination of is a process that takes into account many factors. Its initial value comes from the word embedding results of the knowledge graph embedding module and the victim embedding module. Specifically, the knowledge graph embedding module and the victim embedding module involve word embedding processing of different entities and relationships in the fraud case text. These word embedding results contain rich semantic information, such as the category, attributes of the entity, and the relationship between them. By integrating and processing this information, each node is given a feature vector u that can reflect its essential characteristics. i .

[0136] Edge eigenvector e ij The word embedding results are also based on the knowledge graph embedding module and the victim embedding module. The edge represents the relationship between the nodes, so e ij Reflects the essential characteristics of the relationship between node i and node h.

[0137] The connection between nodes is first based on the internal structure of each fraud case subgraph G(i). In each subgraph, the connection relationship between nodes is determined according to the actual situation of the fraud case. For example, if in a fraud case, the fraudster establishes a connection with the victim through some means, then in the corresponding subgraph G(i), there will be an edge between the node representing the fraudster and the node representing the victim.

[0138] In addition to connections within subgraphs, connections across case subgraphs are also required. When there are similar entities or relationships between different fraud cases, connections may be established between nodes in different subgraphs G(i). If two different fraud cases involve the same fraud method, then the nodes representing this fraud method may be connected between different subgraphs. This cross-subgraph connection can uncover the commonalities and potential connections between different fraud cases, which helps to more comprehensively analyze the patterns and laws of fraudulent behavior.

[0139] Through the construction process of the directed graph G(V, E) described in detail above, including the determination of the feature vectors of nodes and edges and the specific rules for connecting nodes, the connection between victims and the knowledge graph can be established more accurately, providing stronger support for anti-fraud analysis.

[0140] In some embodiments, if a node represents a victim, then u i It may include the encoding of personal information such as the victim’s age, gender, occupation, etc., as well as characteristic information related to fraud, such as whether the person is gullible, whether the person has financial needs, etc. These encodings are obtained by reasonably mapping and combining the word embedding results.

[0141] In some embodiments, such as the "scammer - fraud method - victim" relationship in the fraud case, there is an edge from the scammer node to the victim node, then e ij It may contain the encoding of characteristic information such as the type, strength, and concealment of the fraud method. This information is also extracted and integrated from the word embedding results, and can accurately describe the relationship represented by the edge.

[0142] In some embodiments, a triple of "entity-relationship-entity" or "entity-attribute-attribute value" is stored to form a graph knowledge base. Among them, the entity node is the basic element of the knowledge graph, which refers to a specific name, organization name, place name, date, time, etc. Two nodes are connected by different relationships to represent the semantic relationship or closeness of the two nodes. Attributes are additional information possessed by entities and are stored as attribute values.

[0143] In some embodiments, first, the fraud case and its title are used as nodes, and then the keywords extracted after data cleaning are used as nodes. Then these nodes are connected, and the nodes in the same sentence are connected according to the sentence order, and the head node of each sentence is connected to the fraud case node. For repeated keyword nodes, they are processed to avoid duplication, that is, in a new sentence, when a keyword is repeated, the previous node of the repeated keyword in this sentence is directly connected to the constructed keyword node, and then the original sentence is returned to connect with the remaining keywords, so that a data cluster consisting of a fraud case is initially formed.

[0144] In this embodiment, neo4j is used to save data such as entity relationships.

[0145] In this embodiment, since the data is huge and requires real-time collaboration among multiple people, as well as multi-terminal access by mini-programs and administrators, the knowledge graph data is uploaded to the cloud server.

[0146] In some embodiments, after completing the construction of the knowledge graph, a prototype of the knowledge graph has been built, but because the relationships between most entity nodes in the knowledge graph are incomplete and there are many missing attribute values, it is necessary to apply the reasoning technology of the knowledge graph to complete the knowledge graph.

[0147] Reasoning in knowledge graphs refers to a series of processes that analyze the original entity nodes and relationships, and then infer and predict new entity node relationships or attribute values, such as Fig. 9 shown.

[0148] In some embodiments, after step S400, the method of the embodiment of the present application may further include, but is not limited to, the following steps:

[0149] Step S510, using the graph attention model to calculate the attention weight values ​​of the central node and adjacent nodes of the fraud knowledge graph;

[0150] Step S520, using the aggregation mechanism of the graph attention model, the relationship and attribute of each central node are trained according to the attention weight value to obtain new relationships and attributes of the central node;

[0151] Step S530, completing the fraud knowledge graph based on the new relationships and attributes of the central node.

[0152] In this embodiment, knowledge reasoning technology based on graph neural network (GNN) is used. For example, birds of a feather flock together, and people are divided into groups. According to the existing relationship of each entity node, it is aggregated, updated, and continuously cycled, and the information of the adjacent nodes can be used to complete the information of the node, thereby completing the completion of the entire knowledge graph.

[0153] In some embodiments of steps S510 to S530, a graph attention model (GAT) model is used to complete and reason about the knowledge graph. The GAT model consists of multiple layers of graph attention layers, each layer contains several attention heads, and each attention head independently calculates the attention weights between nodes.

[0154] Parameter settings: Number of attention heads: 8 attention heads are set for each layer; Number of hidden units: 64 hidden units are set for each layer; Activation function: Use LeakyReLU activation function.

[0155] Training process: Loss function: use cross entropy loss function; Optimizer: use Adam optimizer, initial learning rate is 0.001; Number of training rounds: 100 rounds.

[0156] Optimization strategy: Learning rate decay: The learning rate decays by 0.1 after every 10 rounds of training; Early stopping strategy: If the validation set loss does not decrease within 10 consecutive rounds, stop training.

[0157] In some embodiments, a graph neural network (GNN) is a neural network model for processing graph structured data. Unlike traditional neural network models, GNN can directly learn and reason about graph structured data. By capturing and transmitting the relationship and feature information between nodes, GNN can achieve in-depth analysis and mining of graph structured data. In GNN, the relationship and feature information between nodes can be shared through information transmission between neighboring nodes. This information transmission process can be achieved through convolution operations. Specifically, GNN obtains the feature information of the current node by aggregating the feature information of neighboring nodes. This aggregation method can be a simple summation, average, maximum pooling, etc., or it can be a complex combination.

[0158] Graph Attention Network (GAT) is a model based on graph neural network. By introducing the attention mechanism between nodes, the model can better capture the relationship and feature information between nodes. Specifically, GAT linearly transforms the feature information of the node and uses weights to weight the feature information of neighboring nodes to obtain the feature information of the current node. This weighted summation process is an attention mechanism. In GAT, the weight is determined by the relationship between nodes. Specifically, the relationship between nodes can be represented by an adjacency matrix. GAT calculates the relationship weight between the current node and its neighboring nodes to obtain the weight of the feature information of the neighboring nodes. This calculation method allows the model to better capture the relationship and feature information between nodes.

[0159] Reference Fig.10 , Fig.11 , Fig.10 This is a schematic diagram of the aggregation calculation of GAT. Fig.11 Schematic diagram of the polymerization mechanism of GAT.

[0160] Fig.10 The calculation formulas are shown in formulas (1) to (3);

[0161]

[0162] In formula (1), e ij is the attention coefficient between node i and node j. and are the vector representations of nodes i and j respectively, W is a linear transformation matrix, and It is the representation of the node feature vector after linear transformation, and a is the affine transformation function.

[0163] In formula (2), the attention coefficient e ijPerform softmax normalization to obtain the attention weight α ij The normalization operation ensures that the sum of the weights of all neighbor nodes is 1.

[0164] In formula (3), and The connection vector of is linearly transformed, processed by the LeakyReLU activation function, and then normalized by softmax to calculate the attention weight;

[0165] Fig.11 The calculation formulas are shown in equations (4) to (6);

[0166]

[0167] In formula (4), the neighbor node feature vector Weighted summation to get the new node representation where σ is a nonlinear activation function.

[0168] In formula (5), multi-head attention is introduced, the results of K attention heads are concatenated, and the representation of node i is obtained through the activation function.

[0169] In formula (6), a variant of multi-head attention obtains a more robust representation by taking the average of K heads instead of the concatenation operation.

[0170] In the actual operation of GAT, the calculation of attention scores is done through a structure called "attention head". Each attention head calculates a set of attention scores, and in the final result, the results of all attention heads are averaged or concatenated to get the final node embedding. The advantage of this is that each attention head can focus on different features or patterns, allowing GAT to capture more information.

[0171] In some embodiments of step S500, the target object is the user collected by the mini program, and the object characteristic information, i.e., the information uploaded by the user, includes but is not limited to the user's personal information, usage records, etc. The personal information may be age, gender, hobbies, etc., and the usage records include browsing records, search records, questionnaires, etc.

[0172] In some embodiments of step S600, based on the object feature information, that is, various information about the user such as age, gender, hobbies, browsing history, search history, questionnaires, etc., multiple similar information nodes are found in the knowledge graph, and more adjacent nodes are found through the relationship and attributes of the nodes, so as to determine the corresponding fraud case subgraph. Since each fraud case subgraph corresponds to a fraud case, fraud cases suitable for object learning can be obtained, and according to a certain algorithm mechanism, more important fraud cases are selected for recommendation.

[0173] Specifically, if the user has recently browsed and searched for more fraud cases related to online order-brushing, the system will increase the recommendation weight of online order-brushing fraud cases. If the user is a female, the recommendation weight of online shopping beauty and other related fraud cases will be increased.

[0174] In some embodiments, step S600 may include but is not limited to the following steps:

[0175] Step S610, searching for related entities in the fraud knowledge graph according to the object feature information to obtain the target entity;

[0176] Step S620, obtaining a corresponding fraud case subgraph in the fraud knowledge graph according to the target entity and the relationship and attributes of the target entity;

[0177] Step S630, determining a corresponding fraud learning case according to the fraud case subgraph;

[0178] Step S640, displaying different forms of fraud learning cases through a visual front end.

[0179] In some embodiments, the same or similar entities or entity relationships in the knowledge graph are found through keywords of the user's information features as target entities and the relationships and attributes of the target entities, and fraud cases that meet the user's information features are obtained and pushed to the user.

[0180] In this embodiment, fraud case videos, articles, news, etc. are recommended through the front-end mini-program interface to provide users with a variety of fraud learning case displays.

[0181] In this embodiment, the results are visualized by developing a WeChat applet, and the anti-fraud science is promoted to help the whole people fight against fraud. The interface of the applet includes:

[0182] The main functions will include 4 parts: home page, short videos, knowledge graph, and my information.

[0183] Home page: robot Q&A, risk assessment, search, push, article publishing, etc.;

[0184] Short videos: videos showing fraud cases, etc.

[0185] Knowledge graph: Use knowledge graph to display fraud information (people, regions, methods, etc.);

[0186] My information: personal information, favorite articles, etc.

[0187] In this embodiment, Huawei Cloud's Elastic Cloud Server (ECS) is used as the backend server to store the trained graph database, web page information, user data, etc., to provide an operating basis for users to access, browse and upload through mini-programs.

[0188] In this embodiment, the server environment includes: CentOS based on Linux server, Baota control panel, Nginx firewall, Spring boot, Neo4j database, MySQL database, and phpMyAdmin.

[0189] In this embodiment, the knowledge graph and statistical data of the database are visualized, and users can search for related nodes and view the links.

[0190] In this embodiment, a database search may be performed in response to the user's question and then an answer may be given.

[0191] In this embodiment, users can monitor fraud risks by filling out questionnaires.

[0192] In this embodiment, personalized and latest fraud news and articles are recommended to users, and users can search for relevant information of interest.

[0193] The embodiment of the present invention also provides an anti-fraud system based on knowledge graph reasoning, including:

[0194] The first module is used to obtain fraud case texts;

[0195] The second module is used to perform first information extraction and word embedding processing on the fraud case text to obtain case entity information represented by a vector, wherein the case entity information includes multiple entities and entity relationships;

[0196] The third module is used to perform second information extraction and word embedding processing on the fraud case text to obtain the victim profile information represented by the vector;

[0197] The fourth module is used to build a fraud knowledge graph based on case entity information and victim profile information;

[0198] The fifth module is used to obtain object feature information of the target object;

[0199] The sixth module is used to recommend fraud learning cases based on object feature information and fraud knowledge graph.

[0200] The anti-fraud system based on knowledge graph reasoning in the embodiment of the present application collects fraud case texts, performs information extraction and word embedding on the fraud case texts, and forms a fraud knowledge graph. The fraud knowledge graph can provide more personalized fraud case recommendations based on user characteristics, thereby improving the public's understanding of the current situation of fraud, preventing the public from being seriously defrauded, and achieving accurate fraud prevention.

[0201] It should be noted that the anti-fraud system based on knowledge graph reasoning in the embodiment of the present application corresponds to the aforementioned anti-fraud method based on knowledge graph reasoning. For the specific anti-fraud steps based on knowledge graph reasoning, please refer to the aforementioned anti-fraud method based on knowledge graph reasoning, which will not be repeated here.

[0202] Combine the following Fig.12 The electronic device according to the embodiment of the present application is introduced in detail.

[0203] like Fig.12 , Fig.12 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0204] The processor 1600 may be implemented by a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided by the embodiments of the present disclosure;

[0205] The memory 1700 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1700 can store an operating system and other applications. When the technical solution provided in the embodiments of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1700, and the processor 1600 calls and executes the anti-fraud method based on knowledge graph reasoning in the embodiments of this disclosure;

[0206] Input / output interface 1800, used to implement information input and output;

[0207] The communication interface 1900 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0208] Bus 2000 , which transmits information between various components of the device (e.g., processor 1600 , memory 1700 , input / output interface 1800 , and communication interface 1900 );

[0209] The processor 1600 , the memory 1700 , the input / output interface 1800 , and the communication interface 1900 are connected to each other in communication within the device via the bus 2000 .

[0210] An embodiment of the present disclosure also provides a storage medium, which is a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned anti-fraud method based on knowledge graph reasoning.

[0211] The storage medium of the embodiment of the present application is used to execute the above-mentioned anti-fraud method based on knowledge graph reasoning. By collecting fraud case texts, performing information extraction and word embedding on the fraud case texts, a fraud knowledge graph is formed. According to the fraud knowledge graph, more personalized fraud case recommendations can be provided based on user characteristics, thereby improving the public's understanding of the current situation of fraud, preventing the public from being seriously defrauded, and achieving accurate fraud prevention.

[0212] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0213] The embodiments described in the embodiments of the present disclosure are intended to more clearly illustrate the technical solutions of the embodiments of the present disclosure and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0214] Those skilled in the art will appreciate that the technical solutions shown in the figures do not limit the embodiments of the present disclosure and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0215] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0216] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0217] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0218] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one item (one) of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0219] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0220] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0221] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0222] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including multiple instructions to enable an electronic device (which can be a personal computer, server, or network equipment, etc.) to execute all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store programs.

[0223] The preferred embodiments of the present disclosure are described above with reference to the accompanying drawings, but the scope of the rights of the present disclosure is not limited thereto. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the present disclosure should be within the scope of the rights of the present disclosure.

Claims

1. An anti-fraud method based on knowledge graph reasoning, characterized in that: The following steps are involved: Get the fraud case text; Performing a first information extraction process and a word embedding process on the fraud case text to obtain case entity information represented by a vector, wherein the case entity information includes multiple entities and entity relationships; Performing second information extraction and word embedding processing on the fraud case text to obtain victim profile information represented by a vector; Construct a fraud knowledge graph based on the case entity information and the victim profile information; Obtaining object feature information of a target object; Recommend fraud learning cases based on the object feature information and the fraud knowledge graph.

2. The anti-fraud method based on knowledge graph reasoning according to claim 1 is characterized in that: The method of obtaining the fraud case text includes the following steps: Initialize the uniform resource locator; Crawl fraud-related web pages according to the uniform resource locator, and obtain a new uniform resource locator from the web pages; Filter out the Uniform Resource Locators that are not related to fraud from the new Uniform Resource Locators; Putting the filtered uniform resource locator into a uniform resource locator queue; Determining the uniform resource locator priority from the uniform resource locator queue according to the crawling strategy; Determine a target uniform resource locator from the uniform resource locators with high priority; Crawl the next web page according to the target uniform resource locator; Determining whether there is a new uniform resource locator available on the web page; When there is a new uniform resource locator that can be obtained, repeating the step of filtering out the uniform resource locators that are not related to fraud from the new uniform resource locators to the step of crawling the next web page according to the target uniform resource locator; When there is no new uniform resource locator available, the crawling of the web pages is stopped, and the fraud case text is determined based on all the crawled web pages.

3. The anti-fraud method based on knowledge graph reasoning according to claim 1 is characterized in that: The step of performing first information extraction processing and word embedding processing on the fraud case text to obtain case entity information represented by a vector comprises the following steps: Obtain a preset first prompt word, wherein the first prompt word includes a first task description and a type description, the first task description is used to inform the large-scale language model to perform entity extraction and entity relationship extraction tasks in the fraud case text; the type description is used to prompt the large-scale language model to extract entity types and entity relationship types related to fraud; Forming a first question text according to the first prompt word and the fraud case text; Inputting the first question text into the large-scale language model to obtain the case entity information, wherein the case entity information includes a plurality of triples of the entity and the entity relationship; A pre-trained language model is used to perform word embedding processing on the plurality of triples to obtain the case entity information represented by a vector.

4. The anti-fraud method based on knowledge graph reasoning according to claim 1 is characterized in that: The step of performing a second information extraction process and a word embedding process on the fraud case text to obtain victim profile information represented by a vector comprises the following steps: Obtaining a preset second prompt word, wherein the second prompt word includes a second task description, and the second task description is used to inform the large-scale language model to perform a victim profile extraction task in the fraud case text; Forming a second question text according to the second prompt word and the fraud case text; Inputting the second question text into a large-scale language model to obtain a victim profile; The victim profile is processed by word embedding using a pre-trained language model to obtain the victim profile information represented by a vector.

5. The anti-fraud method based on knowledge graph reasoning according to claim 1 is characterized in that: The step of constructing a fraud knowledge graph based on the case entity information and the victim profile information includes the following steps: Using entities in the case entity information as nodes and entity relationships in the case entity information as edges of nodes to construct a directed graph; Writing node attributes into the node representing the victim in the directed graph according to the victim profile information to obtain a fraud case subgraph of a single fraud case; Similar nodes between the fraud case subgraphs of different fraud cases are connected to obtain a fraud knowledge graph.

6. The anti-fraud method based on knowledge graph reasoning according to claim 1 is characterized in that: After the step of constructing a fraud knowledge graph according to the case entity information and the victim profile information, the anti-fraud method based on knowledge graph reasoning further includes the following steps: Using a graph attention model to calculate the attention weight values ​​of the central node and adjacent nodes of the fraud knowledge graph; Adopting the aggregation mechanism of the graph attention model, the relationship and attribute of each of the central nodes are trained according to the attention weight value to obtain new relationships and attributes of the central nodes; The fraud knowledge graph is completed according to the new relationships and attributes of the central node.

7. The anti-fraud method based on knowledge graph reasoning according to claim 1 is characterized in that: The step of recommending fraud learning cases according to the object feature information and the fraud knowledge graph comprises the following steps: Searching for related entities in the fraud knowledge graph according to the object feature information to obtain a target entity; Obtaining a corresponding fraud case subgraph in the fraud knowledge graph according to the target entity and the relationship and attribute of the target entity; Determine the corresponding fraud learning case according to the fraud case subgraph; Different forms of the above-mentioned fraud learning cases are presented through a visual front end. 8.An anti-fraud system based on knowledge graph reasoning, characterized in that: include: The first module is used to obtain fraud case texts; The second module is used to perform first information extraction processing and word embedding processing on the fraud case text to obtain case entity information represented by a vector, wherein the case entity information includes multiple entities and entity relationships; The third module is used to perform second information extraction processing and word embedding processing on the fraud case text to obtain victim profile information represented by a vector; The fourth module is used to construct a fraud knowledge graph based on the case entity information and the victim profile information; The fifth module is used to obtain object feature information of the target object; The sixth module is used to recommend fraud learning cases based on the object feature information and the fraud knowledge graph.

9. An electronic device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the anti-fraud method based on knowledge graph reasoning as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a program executable by a processor, characterized in that: The program executable by the processor is used to implement the anti-fraud method based on knowledge graph reasoning as described in any one of claims 1 to 7 when executed by the processor.

Images