Potential abnormal object identification method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of data processing, can be applied to various scenes such as cloud technology, artificial intelligence, smart traffic and aided driving, and particularly relates to a potential abnormal object identification method and device, electronic equipment and a storage medium, which are used for improving the identification efficiency of potential abnormal objects. The method comprises the following steps: acquiring a directed heterogeneous graph constructed based on an association relationship among business objects in a specified business scene; respectively taking each historical abnormal node in the directed isomeric graph as a central node, performing diffusion in the directed isomeric graph to obtain corresponding diffusion sub-graphs, and merging the diffusion sub-graphs to obtain a target graph; executing the following operations on other nodes except the historical abnormal nodes in the target graph: calculating corresponding abnormal evaluation values; and when the abnormal evaluation value is higher than a set threshold value, determining the business object corresponding to the other nodes as a potential abnormal object. Therefore, the identification effect of the potential abnormal object can be improved.

Description

Background Art

[0002] With the development of information technology, people can construct graph nodes for each business object in a business scenario, and establish connecting edges between graph nodes based on the association relationship between business objects to obtain a relationship graph for the business scenario; further, by calculating the feature similarity between the abnormal node and other nodes except the abnormal node in the relationship graph, potential abnormal nodes can be identified, and the business objects corresponding to the potential abnormal nodes can be determined as potential abnormal objects, where the abnormal node is the node corresponding to the abnormal business object that has been pre-determined to be abnormal.

[0003] However, in the existing methods for identifying potential abnormal objects, a large amount of computing resources are required to analyze the entire data, which greatly reduces the efficiency of identifying potential abnormal objects. In addition, when determining potential abnormal objects similar to abnormal business objects by calculating the feature similarity between nodes, only the influence of node features is considered, which makes the basis for defining potential abnormal objects less interpretable and difficult to ensure the accuracy of identification. Summary of the invention

[0004] The embodiments of the present application provide a method, device, electronic device and storage medium for identifying potential abnormal objects, so as to improve the efficiency of identifying potential abnormal objects.

[0005] Firstly, a method for identifying potential abnormal objects is proposed, comprising:

[0006] Obtaining a directed heterogeneous graph constructed based on the association relationship between each business object in a specified business scenario; the directed heterogeneous graph includes: nodes corresponding to each business object of different types, and connection edges constructed according to the association relationship; each node includes a historical abnormal node configured with an abnormality coefficient; each connection edge is respectively configured with an association coefficient determined according to the corresponding association relationship;

[0007] Taking each historical abnormal node as the central node, diffusely obtaining a corresponding diffusion subgraph in the directed heterogeneous graph, and merging each diffusion subgraph to obtain a target graph, wherein in a diffusion subgraph, the distance between the central node and each other node is within a preset node step range;

[0008] For each other node in the target graph except the historical abnormal nodes, the following operations are performed respectively: the node paths between one other node and each historical abnormal node are determined respectively; the abnormality evaluation value corresponding to the one other node is determined according to the association coefficient of the connecting edges included in each node path and the abnormality coefficient of each historical abnormal node; when the abnormality evaluation value is higher than a set threshold, the business object corresponding to the one other node is determined as a potential abnormal object.

[0009] In a second aspect, a device for identifying a potential abnormal object is provided, comprising:

[0010] An acquisition unit is used to acquire a directed heterogeneous graph constructed based on the association relationship between each business object in a specified business scenario; the directed heterogeneous graph includes: nodes corresponding to each business object of different types, and connection edges constructed according to the association relationship; each node includes a historical abnormal node configured with an abnormality coefficient; each connection edge is respectively configured with an association coefficient determined according to the corresponding association relationship;

[0011] A diffusion unit is used to diffuse each historical abnormal node as a central node in the directed heterogeneous graph to obtain a corresponding diffusion subgraph, and merge each diffusion subgraph to obtain a target graph, wherein in a diffusion subgraph, the distance between the central node and each other node is within a preset node step range;

[0012] The execution unit is used to perform the following operations for each other node in the target graph except the historical abnormal nodes: determine the node path between one other node and each historical abnormal node respectively; determine the abnormality evaluation value corresponding to the one other node according to the association coefficient of the connecting edge included in each node path and the abnormality coefficient of each historical abnormal node; when the abnormality evaluation value is higher than a set threshold, determine the business object corresponding to the one other node as a potential abnormal object.

[0013] Optionally, when each historical abnormal node is used as a central node and a corresponding diffusion subgraph is obtained by diffusion in the directed heterogeneous graph, the diffusion unit is used to:

[0014] For each historical abnormal node, perform the following operations respectively:

[0015] In the directed heterogeneous graph, taking a historical abnormal node as a central node, ignoring the direction of the connection edge, diffusion determines the distance between the historical abnormal node and each other node within a preset node step range, and determines each connection edge covered by the corresponding diffusion path;

[0016] A diffusion subgraph consisting of the one historical abnormal node, the other nodes, and the connecting edges is obtained.

[0017] Optionally, when determining the abnormality assessment value corresponding to the other node according to the association coefficient of the connecting edge included in each node path and the abnormality coefficient of each historical abnormal node, the execution unit is used to:

[0018] For each historical abnormal node, the following operations are performed: determining the path correlation corresponding to the node path according to the correlation coefficients corresponding to the connecting edges in the node path between the historical abnormal node and the other node, and determining the node correlation between the historical abnormal node and the other node according to the path correlation and the abnormal coefficient of the historical abnormal node;

[0019] According to the relevance of each node, an abnormality assessment value corresponding to the one other node is determined.

[0020] Optionally, when determining the node paths between one other node and each of the historical abnormal nodes respectively, the execution unit is used to:

[0021] Each of the historical abnormal nodes and one other node is respectively used as the two end nodes, and the corresponding node path is traversed and determined along the connection edge in the target graph.

[0022] Optionally, the directed isomeric graph is constructed by the acquisition unit in the following manner:

[0023] Construct corresponding nodes for each business object in a specified business scenario, and construct connection edges between corresponding nodes according to the association relationship between the business objects to obtain an initial directed heterogeneous graph;

[0024] Determine the nodes corresponding to the abnormal business objects in the initial directed heterogeneous graph as historical abnormal nodes, and configure the abnormal coefficients corresponding to the historical abnormal nodes;

[0025] According to the association relationship between the nodes connected to each connection edge, in the initial directed isomeric graph, the association coefficient corresponding to each connection edge is configured to obtain a processed directed isomeric graph.

[0026] Optionally, before constructing corresponding nodes for each business object in the specified business scenario, the acquisition unit is further used to:

[0027] Acquire business data between business objects of different types in a specified business scenario, wherein the business data includes business operation data and business relationship data;

[0028] In the business data, the same type of business operation data between the same business objects are merged, and duplicate data is deleted to obtain cleaned business data;

[0029] According to the cleaned business data, the association relationship between the business objects is determined.

[0030] Optionally, when configuring the abnormal coefficient corresponding to each historical abnormal node, the acquisition unit is used to:

[0031] Determine the abnormal accumulation behavior of each historical abnormal node respectively, and determine the abnormal coefficient corresponding to each historical abnormal node according to the matching relationship between the preset abnormal behavior and the abnormal coefficient;

[0032] The configuring the association coefficients corresponding to the respective connection edges includes:

[0033] According to the association relationship between each node and each business object, the business operation relationship and business binding relationship between the business objects connected to each connection edge are determined, and the corresponding association coefficient is configured according to the business operation relationship and business binding relationship identified by each connection edge.

[0034] Optionally, after determining the business object corresponding to the one other node as a potential abnormal object, the execution unit is further configured to:

[0035] Detecting business interaction behaviors associated with the potential abnormal object;

[0036] When it is determined that the business interaction behavior matches the preset abnormal interaction behavior, business isolation processing is performed on the potential abnormal object to refuse to provide business services for the potential abnormal object.

[0037] In a third aspect, an electronic device is proposed, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0038] In a fourth aspect, a computer-readable storage medium is proposed, on which a computer program is stored, and the computer program implements the above method when executed by a processor.

[0039] In a fifth aspect, a computer program product is proposed, comprising a computer program, wherein the computer program implements the above method when executed by a processor.

[0040] The beneficial effects of this application are as follows:

[0041] In an embodiment of the present application, a method, device, electronic device and storage medium for identifying potential abnormal objects are proposed. A directed heterogeneous graph constructed based on the association relationship between business objects in a specified business scenario is obtained, wherein the directed heterogeneous graph includes: nodes corresponding to each business object of different types, and connecting edges constructed according to the association relationship; each node includes a historical abnormal node configured with an abnormal coefficient; each connecting edge is respectively configured with an association coefficient determined according to the corresponding association relationship; then, each historical abnormal node is used as a central node, and the corresponding diffusion subgraph is diffused in the directed heterogeneous graph, and each diffusion subgraph is merged to obtain a target graph, wherein in a diffusion subgraph, the distance between the central node and other nodes is within a preset node step range; further, for each other node in the target graph except each historical abnormal node, the following operations are performed respectively: the node path between one other node and each historical abnormal node is determined respectively, and the abnormal evaluation value corresponding to the one other node is determined according to the association coefficient of the connecting edge included in each node path and the abnormal coefficient of each historical abnormal node; when the abnormal evaluation value is higher than the set threshold, the business object corresponding to the one other node is determined as a potential abnormal object.

[0042] In this way, after obtaining the directed heterogeneous graph constructed based on the full amount of data in the specified business scenario, the corresponding diffusion subgraph is obtained by diffusion in the directed heterogeneous graph with each historical abnormal node as the central node, so that when considering the business objects that interact closely with the abnormal business objects and have a greater abnormal risk, the diffusion subgraph determined by diffusion according to the preset node step range can be used to determine the node range with a close relationship for each historical abnormal node, which helps to improve the recognition effect of potential abnormal objects;

[0043] Furthermore, by merging the diffusion subgraphs determined for each historical abnormal node, the merged target graph can, on the one hand, aggregate the nodes that are closely related to each historical abnormal node as a whole; on the other hand, by merging the diffusion subgraphs, the node connection relationship between different diffusion subgraphs in the directed heterogeneous graph can be retained, so that more connection details between nodes are retained in the target graph, which helps to improve the analysis effect of potential abnormal objects;

[0044] Afterwards, when determining the abnormality assessment value used to define the abnormal situation of each other node in the target graph except for each historical abnormal node, the node path between the other node and each historical abnormal node, the correlation coefficient of the connecting edges included in each node path, and the abnormality coefficient of each historical abnormal node are comprehensively considered; this enables the determined abnormality assessment value to comprehensively consider the influence of each historical abnormal node while comprehensively considering the correlation influence of each business interaction process represented in each node path, thereby improving the interpretability of the basis for defining potential abnormal objects and helping to improve the efficiency of identifying potential abnormal objects. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A schematic diagram of possible application scenarios in the embodiments of the present application;

[0046] Figure 2 Schematic diagram of the process of identifying potential abnormal objects in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of the process of constructing a directed isomorphic graph in an embodiment of the present application;

[0048] Figure 4A This is a schematic diagram of the data cleaning process in an embodiment of the present application;

[0049] Figure 4B A schematic diagram of a directed isomeric graph constructed in an embodiment of the present application;

[0050] Figure 4C This is a schematic diagram of the process of determining the abnormal coefficient in an embodiment of the present application;

[0051] Figure 4D A schematic diagram of a process for determining the correlation coefficients corresponding to each connection edge in an embodiment of the present application;

[0052] Figure 5A A schematic diagram of a process for determining a diffusion subgraph for a historical abnormal node in an embodiment of the present application;

[0053] Figure 5B This is a schematic diagram of the process of aggregating a target graph in an embodiment of the present application;

[0054] Fig. 6A A schematic diagram of a process of determining a node path for another node in an embodiment of the present application;

[0055] Figure 6B A schematic diagram of a node path between nodes in an embodiment of the present application;

[0056] Figure 7 A schematic diagram of the calculation process of the abnormal evaluation value in the implementation of this application;

[0057] Figure 8A schematic diagram of the logical structure of a device for identifying potential abnormal objects in an embodiment of the present application;

[0058] Fig. 9 The present invention is a schematic diagram of the hardware structure of an electronic device to which the present invention is applied. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0060] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the invention described herein can be implemented in sequences other than those illustrated or described herein.

[0061] Some of the terms used in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0062] Directed graph: In a graph structure, if the connecting edges (or relationships) between nodes in the graph are directional, then such a graph is called a directed graph.

[0063] Undirected graph: In a graph structure, if the connecting edges (or relationships) between nodes in the graph are non-directional, then such a graph is called an undirected graph.

[0064] Heterogeneous graph: refers to a graph composed of different types of nodes and edges (at least one of the nodes and edges has multiple types), where different types of nodes in the heterogeneous graph have characteristics or attributes of different dimensions.

[0065] Directed heterogeneous graph: In the embodiment of the present application, it refers to a graph composed of different types of nodes and directed connecting edges.

[0066] Historical abnormal node: refers to the abnormal business object that is determined to have an abnormality, and the corresponding node in the constructed directed heterogeneous graph.

[0067] Potential abnormal object: In the embodiment of the present application, it is a concept relative to an abnormal business object determined to be abnormal, and specifically refers to a business object that is determined to be highly likely to be abnormal by analyzing the relationship between the abnormal business object.

[0068] The following is a brief introduction to the design concept of the embodiment of the present application:

[0069] Under the relevant technology, with the help of graph structure, in a specified business scenario, potential abnormal objects can be mined based on the determined abnormal business objects.

[0070] Specifically, corresponding graph nodes can be constructed for each business object in the business scenario, and connecting edges can be established between the graph nodes based on the association relationship between the business objects to obtain a relationship graph in the business scenario, wherein the relationship graph includes historical abnormal nodes corresponding to business objects with abnormalities. The correlation between the abnormal business objects and other business objects is determined by calculating the feature similarities between the historical abnormal nodes and other nodes, and then the potential abnormal objects are determined based on the obtained correlation.

[0071] However, the existing method for identifying potential abnormal objects is to analyze them in a relationship graph built based on the full data. Therefore, a large amount of computing resources is required in the process of identifying potential abnormal objects. Moreover, when the amount of data to be calculated is very high, it is very easy to have too many erroneous recognition results due to the influence of the calculation error rate. In addition, since only the feature similarities between single nodes are considered independently during the recognition process, the basis for defining potential abnormalities has weak interpretability, and it is difficult to guarantee the accuracy of the recognition results.

[0072] In view of this, the present application proposes a method, device, electronic device and storage medium for identifying potential abnormal objects. Obtain a directed heterogeneous graph constructed based on the association relationship between each business object in a specified business scenario, wherein the directed heterogeneous graph includes: nodes corresponding to each business object of different types, and connecting edges constructed according to the association relationship; each node includes a historical abnormal node configured with an abnormal coefficient; each connecting edge is respectively configured with an association coefficient determined according to the corresponding association relationship; then, each historical abnormal node is used as a central node, and the corresponding diffusion subgraph is diffused in the directed heterogeneous graph, and each diffusion subgraph is merged to obtain a target graph, wherein in a diffusion subgraph, the distance between the central node and other nodes is within a preset node step range; further, for each other node in the target graph except each historical abnormal node, the following operations are performed respectively: determine the node path between one other node and each historical abnormal node respectively, and determine the abnormal evaluation value corresponding to one other node according to the association coefficient of the connecting edge included in each node path and the abnormal coefficient of each historical abnormal node; when the abnormal evaluation value is higher than the set threshold, the business object corresponding to one other node is determined as a potential abnormal object.

[0073] In this way, after obtaining the directed heterogeneous graph constructed based on the full amount of data in the specified business scenario, the corresponding diffusion subgraph is obtained by diffusion in the directed heterogeneous graph with each historical abnormal node as the central node, so that when considering the business objects that interact closely with the abnormal business objects and have a greater abnormal risk, the diffusion subgraph determined by diffusion according to the preset node step range can be used to determine the node range with a close relationship for each historical abnormal node, which helps to improve the recognition effect of potential abnormal objects;

[0074] Furthermore, by merging the diffusion subgraphs determined for each historical abnormal node, the merged target graph can, on the one hand, aggregate the nodes that are closely related to each historical abnormal node as a whole; on the other hand, by merging the diffusion subgraphs, the node connection relationship between different diffusion subgraphs in the directed heterogeneous graph can be retained, so that more connection details between nodes are retained in the target graph, which helps to improve the analysis effect of potential abnormal objects;

[0075] Afterwards, when determining the abnormality assessment value used to define the abnormal situation of each other node in the target graph except for each historical abnormal node, the node path between the other node and each historical abnormal node, the correlation coefficient of the connecting edges included in each node path, and the abnormality coefficient of each historical abnormal node are comprehensively considered; this enables the determined abnormality assessment value to comprehensively consider the influence of each historical abnormal node while comprehensively considering the correlation influence of each business interaction process represented in each node path, thereby improving the interpretability of the basis for defining potential abnormal objects and helping to improve the efficiency of identifying potential abnormal objects.

[0076] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments of the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0077] See also Figure 1 , which is a schematic diagram of a possible application scenario in an embodiment of the present application, includes a client device 110 and a server device 120 .

[0078] In a feasible implementation method of the present application, the server device 120 can be a server that can provide services for designated businesses, and can obtain business data of each business object involved in the business service process from each client device 110 in accordance with data acquisition compliance requirements; then, a risk analysis is performed based on the obtained data, and potential abnormal objects are determined among business objects that are uncertain whether there are abnormalities. The business services provided by the server device 120 can be implemented with the aid of a mini-program application, a client application, or a web application, and the present application does not impose any specific restrictions on this.

[0079] The client device 110 includes but is not limited to mobile phones, tablet computers, notebooks, e-book readers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc.

[0080] The server device 120 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0081] In the embodiment of the present application, the client device 110 and the server device 120 can communicate through a wired network or a wireless network. The following description only describes the process of identifying potential abnormal objects from the perspective of the server device 120.

[0082] The following describes the process of identifying potential abnormal objects in combination with possible application scenarios:

[0083] Application scenario: Identify potential abnormal accounts.

[0084] Specifically, in this application scenario, the server-side device can provide resource transfer services between merchants and users. Based on this, the server-side device can obtain resource transfer data between merchant accounts and user accounts in a compliant and legal manner, and construct a directed heterogeneous graph based on the resource transfer data.

[0085] The constructed directed heterogeneous graph includes: nodes corresponding to each merchant account and each user account, and connection edges constructed between corresponding nodes according to the resource transfer relationship between each merchant account and each user account; the nodes corresponding to the merchant account and the nodes corresponding to the user account belong to different types of nodes; each node includes a historical abnormal node corresponding to the account determined as an abnormal account; each historical abnormal node is configured with a corresponding abnormal coefficient, and each connection edge is configured with a corresponding association coefficient; the association coefficient is determined according to the association relationship between the two accounts connected by the connection edge, and the larger the association coefficient, the closer the business association between the two accounts; the association relationship specifically includes a resource transfer relationship and a business binding relationship.

[0086] Furthermore, the server-side device diffuses and determines the corresponding diffusion subgraph in the directed heterogeneous graph for each historical abnormal node, and merges the diffusion subgraphs to obtain the target graph; then, for each other node in the target graph except for each historical abnormal node, the following operations are performed: a node path between another node and each historical abnormal node is determined, and an abnormal evaluation value of the other node is determined according to the correlation coefficient of the connecting edge included in each node path and the abnormal coefficient of each historical abnormal node; then, according to the relationship between the abnormal evaluation value and the set threshold, whether the account corresponding to the other node is a potential abnormal account is determined.

[0087] In addition, it should be understood that in the specific implementation of this application, it involves the acquisition and processing of business data between business objects in a specified business scenario. When the embodiments recorded in this application are applied to specific products or technologies, it is necessary to obtain the permission or consent of the relevant objects, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0088] The following is an explanation of the process of identifying potential abnormal objects from the perspective of the server device, combined with the accompanying drawings:

[0089] See also Figure 2 As shown in the figure, it is a schematic diagram of the identification process of potential abnormal objects in the embodiment of the present application. Figure 2 , the identification process of potential abnormal objects is explained:

[0090] Step 201: The server device obtains a directed heterogeneous graph constructed based on the association relationship between business objects in a specified business scenario.

[0091] In an embodiment of the present application, the directed heterogeneous graph obtained by the server-side device includes: nodes corresponding to each business object of different types, and connection edges constructed according to the association relationship between the business objects; each node includes a historical abnormal node configured with an abnormality coefficient; each connection edge is respectively configured with an association coefficient determined according to the corresponding association relationship.

[0092] It should be noted that, in a feasible embodiment, the obtained directed heterogeneous graph may be generated by a server-side device; or, the obtained directed heterogeneous graph may be obtained after other devices generate an initial directed heterogeneous graph based on the full data in a specified business scenario, and the server-side device configures coefficients for nodes and connection edges based on the initial directed heterogeneous graph.

[0093] For details, see Figure 3 As shown, it is a schematic diagram of the process of constructing a directed isomorphic graph in the embodiment of the present application. Figure 3 , the process of constructing a directed heterogeneous graph by the server device itself is explained:

[0094] Step 301: The server device constructs corresponding nodes for each business object in a specified business scenario, and constructs connection edges between corresponding nodes according to the association relationship between each business object to obtain an initial directed heterogeneous graph.

[0095] In the embodiment of the present application, before the server-side device constructs corresponding nodes for each business object in a specified business scenario, it is necessary to first determine each business object in the specified business scenario and the association relationship between each business object.

[0096] In the process of determining the business objects in a specified business scenario and the association relationship between the business objects, the server-side device obtains business data between different types of business objects in the specified business scenario, wherein the business data includes business operation data and business relationship data; then, in the business data, the same type of business operation data between the same business objects is merged, and duplicate data is deleted to obtain cleaned business data; then, based on the cleaned business data, the association relationship between the business objects is determined.

[0097] Specifically, when the server-side device processes the business data to obtain the cleaned business data, the server-side device merges the same type of operation data generated at different times by two business objects that have business interactions, so that only one piece of operation data of one type is retained between any two business objects that have business interactions. At the same time, the server-side device deletes the operation data that are repeatedly recorded between business objects, and deletes the business relationship data that are repeatedly recorded between business objects.

[0098] It should be noted that in the embodiments of the present application, different types of business objects refer to objects that are configured with different business function scopes in a specified business scenario; business data refers to the data generated when each business object performs business interaction in a specified business scenario, specifically including business operation data and business relationship data; the same type of operation data refers to the data generated by performing the same business operation; duplicate data refers to data that is repeatedly recorded for the same business process.

[0099] For example, see Figure 4A As shown, it is a schematic diagram of the process of data cleaning in the embodiment of the present application. Figure 4A As can be seen from the schematic content, after obtaining the business data, the business data with duplicate records and the business data of the same type can be determined based on the data content in the business data. Figure 4A The two payment transactions performed by the user 1 account to the merchant 1 account as shown in the figure can be merged, so that for the payment operation between the user 1 account and the merchant 1 account, only one piece of data after the merged payment amount is retained; in addition, for repeated data, only one piece of repeated data is retained.

[0100] Furthermore, the server-side device can determine the association relationship between each business object based on the cleaned business data, wherein the association relationship between each business object includes a business operation relationship and a business binding relationship.

[0101] For example, assuming that the specified business scenario is resource transfer, then each business object can be divided into two categories, namely merchants and customers (or users); the association relationships between business objects include: business operation relationships (such as payment relationships, transfer relationships, refund relationships, complaint relationships, etc.) and business binding relationships (such as contact relationships, etc.).

[0102] In this way, by performing data cleaning, it is possible to filter out duplicate data from the acquired business data, and aggregate data corresponding to the same type of business operations, thereby simplifying the business data and reducing the difficulty of determining the relationship between business objects.

[0103] Afterwards, after the server-side device determines the association relationship between the business objects in the specified business scenario, it can construct an initial directed heterogeneous graph in the specified business scenario based on the association relationship.

[0104] Specifically, in the process of constructing the initial directed heterogeneous graph, corresponding nodes can be constructed for different types of business objects in a specified business scenario, and then corresponding directed connection edges can be constructed based on the association relationship between the business objects.

[0105] For example, see Figure 4B As shown, it is a schematic diagram of a directed isomorphic graph constructed in an embodiment of the present application, according to Figure 4B As shown in the diagram, it is assumed that there are 7 customers in the business scenario, namely users 1 to 7, and 6 merchants, namely merchants 1 to 6; then, based on the business operation data between the user account and the merchant account, and the business binding relationship between the user account and the merchant account, a structure such as Figure 4B The initial directed heterogeneous graph shown in Figure 1 is a graph with the following structure: Figure 4B The text content marked on the connection edge is added for the convenience of explanation. In the directed heterogeneous graph usually constructed, text descriptions for the connection edges may not be marked.

[0106] Continue to combine Figure 4B For any directed connection edge, the directed connection edge connects two nodes, that is, connects two business objects of the same type or different types, wherein: Figure 4B There are two types of business objects involved, namely users and merchants. Figure 4B There are two types of nodes presented in the figure; the directed connection edge points from the initiating object to the receiving object. For example, there is a connection edge marked as a contact between the node corresponding to user 1 and the node corresponding to user 2, indicating that user 1 sets user 2 as a contact. It should be understood that "contact" does not refer to a specific person, but refers to a connection relationship between two business objects.

[0107] It should be noted that in the embodiments of the present application, when identifying potential abnormal objects in different business scenarios, corresponding directed heterogeneous graphs can be constructed for different business scenarios to achieve analysis of potential abnormal objects in different business scenarios. In the relevant description of the present application, only the specified business scenario is used as an example for schematic description. In addition, the reason for constructing a directed heterogeneous graph is, on the one hand, to characterize the relationship between the business objects corresponding to the nodes with the help of the directed connection edges in the graph; on the other hand, considering that different types of business objects have characteristics of different dimensions, the nodes in the heterogeneous graph are used for differential characterization.

[0108] Step 302: The server-side device determines the nodes corresponding to each abnormal business object in the initial directed heterogeneous graph as historical abnormal nodes, and configures the abnormal coefficient corresponding to each historical abnormal node.

[0109] It should be noted that in the embodiment of the present application, potential abnormal objects are determined after diffusion analysis based on abnormal business objects that have been determined to be abnormal; therefore, in the technical solution disclosed in the present application, there are some known abnormal business objects in a specified business scenario.

[0110] Based on this, in order to analyze potential abnormal objects based on the diffusion of abnormal business objects in each business object in a specified business scenario, it is necessary to perform the operation indicated in step 302. In the initial directed heterogeneous graph, the historical abnormal nodes corresponding to each abnormal business object are determined, and considering that different abnormal business objects have different degrees of abnormality, corresponding abnormal coefficients are configured for the historical abnormal nodes corresponding to each abnormal business object.

[0111] Specifically, in the process of configuring the abnormal coefficient corresponding to each historical abnormal node, the server device determines the abnormal accumulation behavior of each historical abnormal node respectively, and determines the abnormal coefficient corresponding to each historical abnormal node according to the matching relationship between the preset abnormal behavior and the abnormal coefficient.

[0112] It should be noted that in some feasible embodiments of the present application, the server-side device may configure a corresponding abnormality coefficient only for each historical abnormal node, or, in other feasible embodiments, the server-side device may configure corresponding abnormality coefficients for all nodes in the directed heterogeneous graph respectively. Optionally, the abnormality coefficients corresponding to nodes whose abnormality levels cannot be determined may be uniformly configured to 0.

[0113] When configuring the corresponding abnormal coefficient for each historical abnormal node, the server-side device can perform the following operations for each historical abnormal node: obtain the type and number of historical violation behaviors recorded in the abnormal business object corresponding to the historical abnormal node, and determine the number of abnormalities corresponding to each historical abnormal node based on the matching relationship between the preset abnormal behavior and the abnormal coefficient.

[0114] For example, see Figure 4C As shown, it is a schematic diagram of the process of determining the abnormal coefficient in the embodiment of the present application. It is assumed that in the matching relationship between the preset abnormal behavior and the abnormal coefficient, two behaviors are constrained, namely, the behavior of "transferring with the order-brushing platform" and the behavior of "being reported for selling goods with extremely high prices". Moreover, different abnormal values ​​are set for the cumulative number of times under different behaviors. For example, if the number of transfers with the order-brushing platform is ≤1, the abnormal value is configured to be 0.6; if the number of transfers with the order-brushing platform is >1, the abnormal value is configured to be 0.8; for another example, if the number of times reported for selling goods with extremely high prices is ≤5, the abnormal value is configured to be 0.2; if 5 <number ≤10, the abnormal value is configured to be 0.6; if the number is >10, the abnormal value is configured to be 0.8.

[0115] Continue to combine Figure 4CThe schematic content is used to illustrate that, in the case where the abnormal accumulated behavior of the abnormal business object hits two preset abnormal behaviors, the maximum value can be taken from the abnormal values ​​determined for the two abnormal behaviors as the final abnormal coefficient of the abnormal business object 1; or, in some feasible implementation methods, corresponding weights can be configured for the two preset abnormal behaviors, and finally the final abnormal coefficient of the abnormal business object 1 is obtained by weighted summing up the abnormal values ​​determined when hitting different abnormal behaviors, that is, determining the abnormal coefficient of the corresponding historical abnormal node.

[0116] It should be noted that, in the embodiment of the present application, the higher the value of the abnormal coefficient of the historical abnormal node, the more serious the abnormal situation of the abnormal business object corresponding to the historical abnormal node, and the greater the risk.

[0117] In particular, in a feasible implementation, there may not be an abnormal accumulation result for each abnormal business object, but only a risk determination result for each business object, wherein the risk determination result has a range of: high risk, medium risk, low risk, and no risk; then, the server device can determine the abnormal coefficient of each corresponding node based on the risk determination result, such as the abnormal coefficient corresponding to high risk is 0.8, the abnormal coefficient corresponding to medium risk is 0.6, the abnormal coefficient corresponding to low risk is 0.2, and the abnormal coefficient corresponding to no risk is 0. According to actual processing needs, high-risk, medium-risk, and low-risk business objects can be determined as abnormal business objects, or the highest-risk and medium-risk business objects can be determined as abnormal business objects, and this application does not impose specific restrictions on this.

[0118] In this way, by configuring a corresponding anomaly coefficient for each historical abnormal node, the configured anomaly coefficient can be used to characterize abnormal situations of different degrees, so that when subsequently analyzing potential abnormal objects, the influence effects exerted by different historical abnormal nodes can be introduced, which helps to improve the accuracy of the analysis results.

[0119] Step 303: The server-side device configures the association coefficients corresponding to the respective connection edges in the initial directed heterogeneous graph according to the association relationships between the nodes connected to the respective connection edges, so as to obtain a processed directed heterogeneous graph.

[0120] When executing step 303, the server device determines the business operation relationship and business binding relationship between the business objects connected to each connection edge based on the association relationship between each node and each business object, and configures the corresponding association coefficient based on the business operation relationship and business binding relationship identified by each connection edge.

[0121] Specifically, when the server-side device configures the corresponding association coefficient of each connection edge in the initial directed graph according to the association relationship between the nodes connected to each connection edge, considering that the association relationship between the nodes can be refined into business operation relationship and business binding relationship, in a feasible implementation method, the server-side device can configure corresponding weight parameters for different types of relationships, and configure the corresponding relationship value basis for each type of relationship, wherein the relationship value is used to characterize the closeness of the relationship between the two business objects connected by the connection edge under the corresponding type of relationship.

[0122] For example, the association relationship includes business operation relationship and business binding relationship. Business operation relationship includes payment relationship and complaint relationship, etc. Business binding relationship includes binding as contact, etc. Then, for payment relationship, different relationship values ​​can be configured according to different ranges of payment amount; similarly, for complaint relationship, different relationship values ​​can be configured according to different ranges of complaint times; for "bind as contact" relationship, different relationship values ​​can be configured according to whether it is bound as contact.

[0123] For example, see Figure 4D As shown, it is a schematic diagram of the process of determining the correlation coefficient corresponding to each connection edge in the embodiment of the present application. Figure 4D As shown in the figure, it is assumed that there are four relationships, namely, refund relationship, "contact person" relationship, payment relationship, and complaint relationship, and the weight parameters configured for the four relationships are 0.4, 0.05, 0.4, and 0.15 respectively. And for different relationships, relationship values ​​in different situations are configured respectively, for example, in refund relationship and payment relationship, the accumulated amount is used as the basis for dividing different situations; in "contact person" relationship, whether there is a "contact person" relationship is used as the basis for dividing different situations; in complaint relationship, the accumulated number of complaints is used as the basis for dividing different situations.

[0124] Continue to combine Figure 4D To illustrate, after processing step 302, each historical abnormal node and the corresponding abnormal coefficient can be determined in the initial directed heterogeneous graph, specifically, user 3 (abnormal coefficient 0.6) and merchant 2 (abnormal coefficient 0.8); further, after processing step 303, the corresponding association coefficient of each connecting edge can be determined according to the association relationship corresponding to each connecting edge, combined with the configured method of determining different types of relationship values, and finally an initial directed heterogeneous graph is obtained in which the relevant connection number is configured for each connecting edge and the abnormal coefficient is configured for each historical heterogeneous node.

[0125] In this way, by configuring the corresponding correlation coefficient for each connection edge, the correlation relationship between nodes connected by different connection edges can be characterized, which is equivalent to quantifying the closeness of the relationship between the nodes.

[0126] In addition, with the help of the processing of steps 301-303, it is possible to characterize the abnormal differences of each node and the association relationship between each node from the node level and the connection edge level, enrich the content in the directed heterogeneous graph, and provide a favorable processing basis for the subsequent analysis process.

[0127] Step 202: The server device uses each historical abnormal node as the central node, diffuses in the directed heterogeneous graph to obtain a corresponding diffusion subgraph, and merges each diffusion subgraph to obtain a target graph, wherein in a diffusion subgraph, the distance between the central node and each other node is within a preset node step range.

[0128] In an embodiment of the present application, after the server-side device obtains a directed heterogeneous graph, each historical abnormal node is used as a central node, and when the corresponding diffusion subgraph is obtained by diffusion in the directed heterogeneous graph, the following operations are performed for each historical abnormal node: in the directed heterogeneous graph, a historical abnormal node is used as a central node, and while ignoring the direction of the connection edge, diffusion is performed to determine the distance between the historical abnormal node and each other node within a preset node step range, and each connection edge covered by the corresponding diffusion path; and then a diffusion subgraph consisting of the historical abnormal node, each other node, and each connection edge is obtained.

[0129] It should be noted that, in the embodiment of the present application, the preset node step range is set according to actual processing needs. For example, the preset node step range may be within 3 node steps, wherein a node step may specifically refer to a jump from one node to another connected node. In other words, when determining the distance between nodes, the distance between two nodes connected by a connecting line is 1 node step; in addition, for each other node diffused from a historical abnormal node, each other node may include other historical abnormal nodes.

[0130] For example, see Figure 5A As shown, it is a schematic diagram of the process of determining a diffusion subgraph for a historical abnormal node in an embodiment of the present application. Figure 5A From the schematic content, we can see that the obtained directed heterogeneous graph includes two historical abnormal nodes, namely the node corresponding to merchant 2 and the node corresponding to user 3. Then, assuming that the preset node step range is: no more than 2 node steps; then, ignoring the direction of the connecting edge in the directed heterogeneous graph, it can be found that Figure 5A Diffusion processing is performed in the undirected graph shown.

[0131] Specifically, continue to combine the attached Figure 5A The schematic content is used to illustrate that for the historical abnormal node - merchant 2, the nodes determined by merchant 2 as the central node and within the 2-node step length of merchant 2 include merchant 1, user 1, user 2, merchant 3, user 4, and user 5. Then, based on the determined nodes and the connecting edges of the nodes in the directed heterogeneous graph, we can get Figure 5A As shown in FIG. 1 , for the node: merchant 2, a diffusion subgraph is determined.

[0132] Similarly, continue to combine the attached Figure 5A The schematic content is used to illustrate that for the historical abnormal node - user 3, the nodes determined with user 3 as the central node and within a 2-node step from user 3 include: merchant 6, user 2, and user 7; then, based on the determined nodes and the connecting edges of the nodes in the directed heterogeneous graph, we can get Figure 5A As shown in FIG. 1 , for the node: user 3, a diffusion subgraph is determined.

[0133] In this way, considering the business objects that interact closely with the abnormal business objects and have a greater abnormal risk, by determining the corresponding diffusion subgraph for each historical abnormal node with the help of a preset node step range diffusion, the node range with a close relationship can be determined for each historical abnormal node.

[0134] Furthermore, the server device merges the obtained diffusion subgraphs to obtain a target graph determined by the union of graph contents of the diffusion subgraphs.

[0135] It should be understood that in the embodiment of the present application, for each historical abnormal node, the corresponding diffusion subgraph is diffused and determined respectively, and the process of merging each diffusion subgraph to obtain the target graph is equivalent to extracting a local relationship network from a directed isomerous graph constructed based on the full amount of data; moreover, the reason for extracting the target graph from the directed isomerous graph is that: considering that there are usually many relationship network nodes and connection edges in the directed isomerous graph, the relationship between nodes that are far apart is weak. Therefore, in order to improve the computational efficiency of the subsequent determination of potential abnormal objects and reduce the consumption of computing resources, for each historical abnormal node, the nodes and connection edges within the preset node step range around it can be extracted to form a diffusion subgraph, and then the diffusion subgraphs are aggregated to obtain the target graph.

[0136] It should be noted that, in a feasible embodiment of the present application, a diffusion subgraph can be identified in a directed isomorphic graph, or a diffusion subgraph can be additionally constructed on the basis of a directed isomorphic graph. In addition, according to actual processing needs, when merging the diffusion subgraphs to obtain a target graph, only the graph contents in the diffusion subgraphs can be merged to obtain the target graph; or, while merging the graph contents in the diffusion subgraphs, the connection relationship between the nodes in different diffusion subgraphs can be retained according to the connection relationship between the nodes in the directed isomorphic graph.

[0137] For example, see Figure 5B As shown, it is a schematic diagram of the process of aggregating the target graph in the embodiment of the present application. Figure 5B As shown in the figure, after the server device obtains the diffusion subgraph corresponding to merchant 2 and the diffusion subgraph corresponding to user 3, it merges the two diffusion subgraphs to obtain the target graph. Since user 7 and merchant 4 are located in different diffusion subgraphs, they can be merged as follows: Figure 5B As shown, according to the connection relationship between user 7 and merchant 4 illustrated in the directed heterogeneous graph, a connection edge between user 7 and merchant 4 is established in the target graph.

[0138] Step 203: The server-side device performs the following operations for each other node in the target graph except for each historical abnormal node: determine a node path between one other node and each historical abnormal node respectively; determine an abnormal evaluation value corresponding to one other node based on the association coefficient of the connecting edges included in each node path and the abnormal coefficient of each historical abnormal node; when the abnormal evaluation value is higher than a set threshold, determine a business object corresponding to one other node as a potential abnormal object.

[0139] In an embodiment of the present application, after the server-side device obtains the target graph, it uses all other nodes in the target graph except the historical abnormal nodes as the node range for determining potential abnormal nodes. In other words, the potential abnormal nodes are determined from all other nodes except the historical abnormal nodes.

[0140] The following takes any other node (assuming it is node u) in the target graph except the historical abnormal nodes as an example to illustrate the process of determining whether the business object corresponding to node u is a potential abnormal object:

[0141] The server device first determines the node path between node u and each historical abnormal node for node u, and then determines the abnormal evaluation value corresponding to node u based on the correlation coefficient of the connecting edges included in each node path and the abnormal coefficient of each historical abnormal node.

[0142] Specifically, in the process of respectively determining the node paths between node u and each historical abnormal node, the server-side device respectively takes each historical abnormal node and node u as two end nodes, points along the connection edge in the target graph, and traverses to determine the corresponding node path.

[0143] It should be noted that in the embodiment of the present application, when determining the node path, a preset node traversal algorithm can be used to determine the node path between two nodes along the direction of the connecting edge when no duplicate nodes are included in the node path.

[0144] For example, see Fig. 6A As shown, it is a schematic diagram of the process of determining a node path for another node in an embodiment of the present application, combined with the attached Fig. 6A As can be seen from the diagram, assuming that one of the current other nodes is identified as merchant 1, and the historical abnormal nodes are identified as merchant 2 and user 3, then it is necessary to determine the node paths with merchant 1 and merchant 2 as the end nodes in the target graph along the direction of the connecting edge, and determine the node paths with merchant 1 and user 3 as the end nodes without duplication of the path nodes.

[0145] In addition, to facilitate subsequent calculations, the target graph can be represented as G = (V, E), where V represents a node set, V = {v1, ..., v n},v=<k,q> , k represents the type of node, q represents the abnormal coefficient of the node; E represents the relationship set, the relationship set E = {e1, ..., e n}; e =<v,w,l,p> , v∈V, w∈V, p∈R, indicating that relationship e is a directed edge from node v to w, its type is l, and its association coefficient is p, which can be expressed as p(<w,v> ), use p(<w,v> )>0 means that there is a relationship between two nodes w and v, p(<w,v> )=0 means that there is no relationship between the two nodes w and v.

[0146] Similarly, the server device may adopt the above method to determine the node path between each other node and each historical abnormal node in the target graph except for each historical abnormal node when a corresponding node path needs to be determined.

[0147] In this way, by constructing the node paths between each other node in the target graph except for each historical abnormal node and each historical abnormal node, a connection relationship can be established between other nodes that may correspond to potential abnormal objects and the historical abnormal nodes that are determined to correspond to the abnormal objects, so that the degree of abnormality of each other node can be quantified based on the connection between other nodes and historical abnormal nodes.

[0148] Furthermore, in the process of determining the abnormal evaluation value corresponding to node u, the server-side device performs the following operations for each historical abnormal node: determining the path correlation corresponding to the node path according to the correlation coefficient corresponding to each connecting edge in the node path between the historical abnormal node and node u, and determining the node correlation between the historical abnormal node and node u according to the path correlation and the abnormal coefficient of the historical abnormal node.

[0149] See also Figure 6B As shown, it is a schematic diagram of the path between nodes in the embodiment of the present application. Assuming that there is a historical abnormal node v in the target graph, each node path between node u and node v can be regarded as a node path set, which is expressed as To indicate that there are n node paths between node u and node v, a node path from node u to node v Each node on can be regarded as a node set, represented as

[0150] When calculating the path relevance of a node path between node u and any historical abnormal node (assuming it is node v), the following formula is used for calculation:

[0151]

[0152] Among them, f represents the path correlation calculation function, which can generally be taken as in, Represents node u and node m j 1, the corresponding correlation coefficient of the connecting edge. Similarly, Representation Node The correlation coefficient corresponding to the edge connecting node v.

[0153] Furthermore, when determining the node association degree based on the path association degree of each node path between node u and node v, the following formula is used for calculation:

[0154]

[0155] in, Among them, the value of Ni represents the total number of node paths between nodes u and vi; q vi Indicates the abnormal coefficient corresponding to the historical abnormal node vi.

[0156] Furthermore, when determining the abnormal evaluation value based on the node association degree, the following formula is used for calculation:

[0157]

[0158] Among them, V1 represents the node set composed of various historical abnormal nodes; vi represents any historical abnormal node in the node set V1; Among them, the value of Ni represents the total number of node paths between nodes u and vi; vi Indicates the abnormal coefficient corresponding to the historical abnormal node vi.

[0159] The server-side device adopts the above method. After calculating the corresponding abnormal evaluation value for node u, it can determine whether the business object corresponding to node u is a potential abnormal object based on the relationship between the abnormal evaluation value and the set threshold. If the abnormal evaluation value of node u is higher than the set threshold, the business object corresponding to node u is a potential abnormal object, and if the abnormal evaluation value corresponding to node u is not higher than the set threshold, the business object corresponding to node u is not a potential abnormal object. The value of the set threshold is set according to actual processing needs, and this application does not make specific restrictions here.

[0160] In this way, when calculating the anomaly assessment value, since the node path between a currently calculated other node and each historical anomaly node, the correlation coefficient of the connecting edges included in each node path, and the anomaly coefficient of each historical anomaly node are comprehensively considered, it is possible to comprehensively consider the impact of each historical anomaly node while comprehensively considering the correlation impact of each business interaction process represented in each node path, thereby improving the interpretability of the basis for defining potential anomaly objects and helping to improve the efficiency of identifying potential anomaly objects.

[0161] Similarly, the server-side device can use the above calculation method to calculate the corresponding abnormal evaluation value for each other node in the target graph except for the historical abnormal nodes when it is necessary to calculate the abnormal evaluation value, and determine whether the business objects corresponding to other nodes are potential abnormal objects based on the determined abnormal evaluation value.

[0162] Furthermore, for business objects determined to be potential abnormal objects, the server-side device can detect the business interaction behavior associated with the potential abnormal object; and, when it is determined that the business interaction behavior matches the preset abnormal interaction behavior, business isolation processing is performed on the potential abnormal object to refuse to provide business services to the potential abnormal object.

[0163] Specifically, for potential abnormal objects whose abnormal evaluation values ​​are higher than the set threshold, it can be recognized that there is a high abnormal risk. Therefore, it is necessary to detect the business interaction behavior of the potential abnormal object in the subsequent business interaction process, so as to timely discover the abnormality of the potential abnormal object and take timely measures. Among them, when it is found that the potential abnormal object has abnormal interaction behavior, the strategy usually adopted is to refuse to provide services to the potential abnormal object. Among them, the abnormal interaction behavior can be preset according to actual processing needs, such as business interaction with illegal and irregular platforms.

[0164] In this way, by identifying potential abnormal objects and detecting their business interaction behaviors, we can prevent problems before they occur, discover emerging risks in a timely manner, and improve the timeliness of identifying abnormal operations.

[0165] The following is a description of the process of identifying potential abnormal objects to ensure the security of resource transfer, taking the resource transfer scenario as an example, in conjunction with the accompanying drawings:

[0166] It should be noted that in the resource transfer scenario, in order to deal with the illegal operations of lawbreakers, it is necessary to use various technical means to fight against the illegal operations; in the technical solution conception stage of this application, it is considered that after the merchant payment account of the illegal operation is identified and punished, the illegal operation will continue to register and enable the payment account in batches through various channels, and these accounts have stronger correlations in registration, interaction and other links compared with normal accounts; generally, the more black accounts gather around the account, the greater the probability that the account is an illegal operation account; the closer the account is to the black account, the greater the probability that the account is an illegal operation. Based on this, in the embodiment of the present application, in the resource transfer scenario, by establishing a directed heterogeneous graph (or relationship network) between the accounts, the identification of malicious accounts with potential illegal operations is achieved.

[0167] See also Figure 7 As shown, it is a schematic diagram of the calculation process of the abnormal evaluation value in the implementation of this application. After the server-side device obtains the business data in the resource transfer scenario, it constructs a directed heterogeneous graph based on the obtained business data, wherein each node in the constructed directed heterogeneous graph includes a historical abnormal node, each historical abnormal node is configured with a corresponding abnormal coefficient, and each connecting edge is configured with a corresponding association coefficient;

[0168] Afterwards, the server device diffuses each historical abnormal node to obtain a diffusion subgraph, and aggregates each diffusion subgraph to obtain a target graph; further, the server device calculates the corresponding abnormal evaluation value for each node in the target graph except the historical abnormal node.

[0169] Furthermore, the business objects corresponding to other nodes whose abnormal evaluation values ​​are higher than the set threshold are identified as potential abnormal objects, and the resource transfer process related to the potential abnormal objects is monitored in detail to detect risks in a timely manner.

[0170] In this way, by assigning a quantitative anomaly coefficient to the corresponding historical anomaly node according to the risk situation of the known abnormal account in the constructed directed heterogeneous graph based on the account number (or account), it provides an analysis basis for the subsequent diffusion analysis of potential abnormal accounts, and by calculating the anomaly evaluation value corresponding to the node, determining the potential abnormal account, and focusing on the potential abnormal account, it can increase the account range of defense detection and improve the timeliness of malicious account identification and processing.

[0171] Based on the same inventive concept, see Figure 8 As shown, it is a schematic diagram of the logical structure of the potential abnormal object identification device in the embodiment of the present application. The potential abnormal object identification device 800 includes an acquisition unit 801, a diffusion unit 802, and an execution unit 803, wherein:

[0172] The acquisition unit 801 is used to acquire a directed heterogeneous graph constructed based on the association relationship between each business object in a specified business scenario; the directed heterogeneous graph includes: nodes corresponding to each business object of different types, and connection edges constructed according to the association relationship; each node includes a historical abnormal node configured with an abnormality coefficient; each connection edge is respectively configured with an association coefficient determined according to the corresponding association relationship;

[0173] The diffusion unit 802 is used to diffuse each historical abnormal node as a central node in the directed heterogeneous graph to obtain a corresponding diffusion subgraph, and merge each diffusion subgraph to obtain a target graph, wherein in a diffusion subgraph, the distance between the central node and each other node is within a preset node step range;

[0174] The execution unit 803 is used to perform the following operations for each other node in the target graph except the historical abnormal nodes: determine the node path between one other node and each historical abnormal node respectively; determine the abnormal evaluation value corresponding to one other node according to the association coefficient of the connecting edge included in each node path and the abnormal coefficient of each historical abnormal node; when the abnormal evaluation value is higher than the set threshold, determine the business object corresponding to one other node as a potential abnormal object.

[0175] Optionally, when each historical abnormal node is used as a central node and a corresponding diffusion subgraph is obtained by diffusion in a directed heterogeneous graph, the diffusion unit 802 is used to:

[0176] For each historical abnormal node, perform the following operations respectively:

[0177] In a directed heterogeneous graph, taking a historical abnormal node as the central node, ignoring the direction of the connection edge, diffusion determines the distance between the historical abnormal node and other nodes within the preset node step range, and determines the connection edges covered by the corresponding diffusion path;

[0178] A diffusion subgraph consisting of a historical abnormal node, other nodes, and connecting edges is obtained.

[0179] Optionally, when determining an abnormality assessment value corresponding to another node according to the association coefficient of the connection edge included in each node path and the abnormality coefficient of each historical abnormal node, the execution unit 803 is used to:

[0180] For each historical abnormal node, the following operations are performed: according to the association coefficients corresponding to the respective connection edges in the node path between the historical abnormal node and another node, the path association degree corresponding to the node path is determined; and according to the path association degree and the abnormal coefficient of the historical abnormal node, the node association degree between the historical abnormal node and another node is determined;

[0181] According to the correlation degree of each node, an abnormal evaluation value corresponding to another node is determined.

[0182] Optionally, when determining the node path between another node and each historical abnormal node respectively, the execution unit 803 is used to:

[0183] Each historical abnormal node and one other node are taken as two end nodes, and the corresponding node path is traversed to determine along the connection edge in the target graph.

[0184] Optionally, the directed heterogeneous graph is constructed by the acquisition unit 801 in the following manner:

[0185] Corresponding nodes are constructed for each business object in a specified business scenario, and connecting edges are constructed between corresponding nodes according to the association relationship between business objects to obtain an initial directed heterogeneous graph;

[0186] In the initial directed heterogeneous graph, nodes corresponding to each abnormal business object are respectively determined as historical abnormal nodes, and abnormal coefficients corresponding to each historical abnormal node are configured;

[0187] According to the association relationship between the nodes connected to each connection edge, in the initial directed isomeric graph, the association coefficient corresponding to each connection edge is configured to obtain a processed directed isomeric graph.

[0188] Optionally, before constructing corresponding nodes for each business object in a specified business scenario, the acquisition unit 801 is further configured to:

[0189] Obtain business data between different types of business objects in a specified business scenario, where the business data includes business operation data and business relationship data;

[0190] In the business data, merge the same type of business operation data between the same business objects and delete duplicate data to obtain cleaned business data;

[0191] Based on the cleaned business data, determine the relationship between business objects.

[0192] Optionally, when configuring the abnormal coefficient corresponding to each historical abnormal node, the acquisition unit 801 is used to:

[0193] Determine the abnormal accumulation behavior of each historical abnormal node respectively, and determine the abnormal coefficient corresponding to each historical abnormal node according to the matching relationship between the preset abnormal behavior and the abnormal coefficient;

[0194] Configure the correlation coefficients corresponding to each connection edge, including:

[0195] According to the association relationship between each node and each business object, the business operation relationship and business binding relationship between the business objects connected to each connection edge are determined, and the corresponding association coefficient is configured according to the business operation relationship and business binding relationship identified by each connection edge.

[0196] Optionally, after determining a business object corresponding to another node as a potential abnormal object, the execution unit 803 is further configured to:

[0197] Detect business interaction behaviors associated with potential abnormal objects;

[0198] When it is determined that the business interaction behavior matches the preset abnormal interaction behavior, business isolation processing is performed on the potential abnormal object to refuse to provide business services to the potential abnormal object.

[0199] After introducing the method and device for identifying a potential abnormal object according to an exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0200] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0201] Based on the same inventive concept as the above method embodiment, when the electronic device in the embodiment of the present application corresponds to a server device, refer to Fig. 9As shown, it is a schematic diagram of the hardware composition structure of an electronic device using an embodiment of the present application, and the electronic device 900 may include at least a processor 901 and a memory 902. Among them, the memory 902 stores a computer program, and when the computer program is executed by the processor 901, the processor 901 performs any of the above steps of identifying potential abnormal objects.

[0202] In some possible implementations, the electronic device according to the present application may include at least one processor and at least one memory. The memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of identifying potential abnormal objects according to various exemplary implementations of the present application described above in this specification. For example, the processor may perform the following steps: Figure 2 Follow the steps shown in .

[0203] Based on the same inventive concept as the above method embodiment, various aspects of the identification of potential abnormal objects provided by the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method for identifying potential abnormal objects according to various exemplary embodiments of the present application described above in this specification. For example, the electronic device can execute the following steps: Figure 2 Follow the steps shown in .

[0204] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0205] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0206] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for identifying a potential abnormal object, characterized in that: include: Obtain a directed heterogeneous graph based on the association relationship between business objects in a specified business scenario; The directed heterogeneous graph includes: nodes corresponding to the business objects of different types, and connection edges constructed according to the association relationships; each node includes a historical abnormal node configured with an abnormality coefficient; each connection edge is respectively configured with an association coefficient determined according to the corresponding association relationship; Taking each historical abnormal node as the central node, diffusely obtaining a corresponding diffusion subgraph in the directed heterogeneous graph, and merging each diffusion subgraph to obtain a target graph, wherein in a diffusion subgraph, the distance between the central node and each other node is within a preset node step range; For each other node in the target graph except the historical abnormal nodes, the following operations are performed respectively: the node paths between one other node and each historical abnormal node are determined respectively; the abnormality evaluation value corresponding to the one other node is determined according to the association coefficient of the connecting edges included in each node path and the abnormality coefficient of each historical abnormal node; when the abnormality evaluation value is higher than a set threshold, the business object corresponding to the one other node is determined as a potential abnormal object.

2. The method according to claim 1, characterized in that The method of taking each historical abnormal node as a central node and diffusing in the directed heterogeneous graph to obtain a corresponding diffusion subgraph includes: For each historical abnormal node, perform the following operations respectively: In the directed heterogeneous graph, taking a historical abnormal node as a central node, ignoring the direction of the connection edge, diffusion determines the distance between the historical abnormal node and each other node within a preset node step range, and determines each connection edge covered by the corresponding diffusion path; A diffusion subgraph consisting of the one historical abnormal node, the other nodes, and the connecting edges is obtained.

3. The method according to claim 1, characterized in that The determining, according to the association coefficients of the connecting edges included in each node path and the abnormality coefficients of each historical abnormal node, the abnormality evaluation value corresponding to the other node includes: For each historical abnormal node, the following operations are performed: determining the path correlation corresponding to the node path according to the correlation coefficients corresponding to the connecting edges in the node path between the historical abnormal node and the other node, and determining the node correlation between the historical abnormal node and the other node according to the path correlation and the abnormal coefficient of the historical abnormal node; According to the relevance of each node, an abnormality assessment value corresponding to the one other node is determined.

4. The method according to claim 1, characterized in that The step of respectively determining a node path between another node and each of the historical abnormal nodes includes: Each of the historical abnormal nodes and one other node is respectively used as the two end nodes, and the corresponding node path is traversed and determined along the connection edge in the target graph.

5. The method according to any one of claims 1 to 4, characterized in that: The directed isomeric graph is constructed in the following manner: Construct corresponding nodes for each business object in a specified business scenario, and construct connection edges between corresponding nodes according to the association relationship between the business objects to obtain an initial directed heterogeneous graph; Determine the nodes corresponding to the abnormal business objects in the initial directed heterogeneous graph as historical abnormal nodes, and configure the abnormal coefficients corresponding to the historical abnormal nodes; According to the association relationship between the nodes connected to each connection edge, in the initial directed isomeric graph, the association coefficient corresponding to each connection edge is configured to obtain a processed directed isomeric graph.

6. The method according to claim 5, characterized in that Before constructing corresponding nodes for each business object in the specified business scenario, the method further includes: Acquire business data between business objects of different types in a specified business scenario, wherein the business data includes business operation data and business relationship data; In the business data, the same type of business operation data between the same business objects are merged, and duplicate data is deleted to obtain cleaned business data; According to the cleaned business data, the association relationship between the business objects is determined.

7. The method according to claim 5, characterized in that The configuration of the abnormal coefficient corresponding to each historical abnormal node includes: Determine the abnormal accumulation behavior of each historical abnormal node respectively, and determine the abnormal coefficient corresponding to each historical abnormal node according to the matching relationship between the preset abnormal behavior and the abnormal coefficient; The configuring the association coefficients corresponding to the respective connection edges includes: According to the association relationship between each node and each business object, the business operation relationship and business binding relationship between the business objects connected to each connection edge are determined, and the corresponding association coefficient is configured according to the business operation relationship and business binding relationship identified by each connection edge.

8. The method according to any one of claims 1 to 4, characterized in that: After determining the business object corresponding to the one other node as a potential abnormal object, the method further includes: Detecting business interaction behaviors associated with the potential abnormal object; When it is determined that the business interaction behavior matches the preset abnormal interaction behavior, business isolation processing is performed on the potential abnormal object to refuse to provide business services for the potential abnormal object.

9. A device for identifying a potential abnormal object, characterized in that: include: An acquisition unit, used to acquire a directed heterogeneous graph constructed based on the association relationship between business objects in a specified business scenario; The directed heterogeneous graph includes: nodes corresponding to the business objects of different types, and connection edges constructed according to the association relationships; each node includes a historical abnormal node configured with an abnormality coefficient; each connection edge is respectively configured with an association coefficient determined according to the corresponding association relationship; A diffusion unit is used to diffuse each historical abnormal node as a central node in the directed heterogeneous graph to obtain a corresponding diffusion subgraph, and merge each diffusion subgraph to obtain a target graph, wherein in a diffusion subgraph, the distance between the central node and each other node is within a preset node step range; The execution unit is used to perform the following operations for each other node in the target graph except the historical abnormal nodes: determine the node path between one other node and each historical abnormal node respectively; determine the abnormality evaluation value corresponding to the one other node according to the association coefficient of the connecting edge included in each node path and the abnormality coefficient of each historical abnormal node; when the abnormality evaluation value is higher than a set threshold, determine the business object corresponding to the one other node as a potential abnormal object.

10. The device according to claim 9, characterized in that When each historical abnormal node is used as a central node and diffused in the directed heterogeneous graph to obtain a corresponding diffusion subgraph, the diffusion unit is used to: For each historical abnormal node, perform the following operations respectively: In the directed heterogeneous graph, taking a historical abnormal node as a central node, ignoring the direction of the connection edge, diffusion determines the distance between the historical abnormal node and each other node within a preset node step range, and determines each connection edge covered by the corresponding diffusion path; A diffusion subgraph consisting of the one historical abnormal node, the other nodes, and the connecting edges is obtained.

11. The device according to claim 9, characterized in that When determining the abnormality evaluation value corresponding to the other node according to the association coefficient of the connecting edge included in each node path and the abnormality coefficient of each historical abnormal node, the execution unit is used to: For each historical abnormal node, the following operations are performed: determining the path correlation corresponding to the node path according to the correlation coefficients corresponding to the connecting edges in the node path between the historical abnormal node and the other node, and determining the node correlation between the historical abnormal node and the other node according to the path correlation and the abnormal coefficient of the historical abnormal node; According to the relevance of each node, an abnormality assessment value corresponding to the one other node is determined.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images