Bank fraud account prediction method and device based on relationship learning

Abstract

The present invention provides a method and device for predicting bank fraudulent accounts based on relationship learning, and relates to the field of information processing technology. The method includes: obtaining bank account information within a preset time period, and multiple current blacklist accounts; based on the bank account information, constructing multiple first relationship subgraphs with multiple blacklist accounts as starting points; wherein each first relationship subgraph corresponds to a relationship link type; based on multiple first relationship subgraphs, determining multiple suspicious accounts and their respective corresponding feature information; inputting the feature information of each of the multiple suspicious accounts into a fraudulent risk prediction model, and obtaining the fraudulent risk prediction value of each suspicious account output by the fraudulent risk prediction model; based on the fraudulent risk prediction value of each suspicious account, determining the fraudulent account from multiple suspicious accounts. The present invention can realize the prediction of fraudulent accounts.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a method and device for predicting bank fraudulent accounts based on relationship learning. Background Art

[0002] At present, the anti-fraud risk control system of banks tends to detect and intercept after the fact. Generally, after telecommunications network fraud occurs, the victim will take the initiative to report the fraudulent account, or the anti-fraud rules or models will identify suspicious fraud accounts and then freeze their funds. However, this method has a lag, and the funds of the accounts involved are often quickly transferred out before being frozen, resulting in irreparable financial losses of the victims. Therefore, it is necessary to warn of fraudulent accounts in advance, so as to control them before telecommunications network fraud occurs and avoid financial and property losses. Summary of the invention

[0003] The embodiment of the present invention provides a method and device for predicting bank fraudulent accounts based on relationship learning, so as to realize the prediction of fraudulent accounts in advance.

[0004] In the first aspect, an embodiment of the present invention provides a method for predicting bank fraudulent accounts based on relationship learning, comprising: obtaining bank account information within a preset time period, and multiple current blacklist accounts; based on the bank account information, constructing multiple first relationship subgraphs with the multiple blacklist accounts as starting points; wherein each of the first relationship subgraphs corresponds to a relationship link type; each of the first relationship subgraphs includes multiple risk relationship links, a starting account node and an end account node of each risk relationship link, and account feature information of each account node; the relationship link type includes multiple basic relationship link types and multiple composite relationship link types, the basic relationship link type refers to a relationship link type in which there is an association relationship between account nodes, and the composite relationship link type refers to a relationship link type in which there are multiple association relationships between account nodes; the risk relationship link refers to a relationship link in which there is a fraud risk between account nodes; based on the multiple first relationship subgraphs, determining multiple suspicious accounts and their corresponding feature information; inputting the feature information of each of the multiple suspicious accounts into a fraud risk prediction model, and obtaining a fraud risk prediction value of each of the suspicious accounts output by the fraud risk prediction model; wherein the fraud risk prediction model is trained by suspicious account feature information samples and their corresponding fraud risk labels; Based on the fraud risk prediction value of each of the suspicious accounts, a fraud-related account is determined from the multiple suspicious accounts.

[0005] In some embodiments, for the first relationship subgraph corresponding to the first relationship link type, based on the bank account information, constructing the first relationship subgraph with the multiple blacklist accounts as the starting point, including: based on the bank account information, expanding the relationship link of the first relationship link type with the i-th newly added account node set as the starting point to obtain the i+1-th expanded relationship link data set; wherein i is an integer, when i=0, the i-th newly added account node set only includes the account nodes corresponding to each of the multiple blacklist accounts; the i+1-th expanded relationship link data set includes the starting account node and the end account node of the i+1-th newly added relationship link, and the link feature information of the i+1-th newly added relationship link; the link feature information includes the starting feature information and the end feature information of the relationship link, and the relationship feature information between the account nodes involved; the link feature information of each of the i+1-th newly added relationship links is input into the first link model corresponding to the first relationship link type , obtain the link risk prediction result output by the first link model; the first link model is trained based on the link feature information sample corresponding to the first relationship link type and its corresponding risk link label; based on the link risk prediction result, determine the i+1th risk relationship link from the i+1th newly added relationship link; based on the starting account node and the end account node of the i+1th risk relationship link, and the account feature information of the account nodes involved in the i+1th risk relationship link, update the i-th extended relationship subgraph to obtain the i+1th extended relationship subgraph; wherein, when i=0, the i-th extended relationship subgraph only contains the account nodes corresponding to each of the multiple blacklist accounts; determine the i+1th newly added account node set in the i+1th extended relationship subgraph, set i to i+1, continue to expand, until the number of expansions reaches the preset expansion number threshold, and determine the i+1th extended relationship subgraph as the first relationship subgraph.

[0006] In some embodiments, the first link model is trained in the following manner: obtaining first bank account information and a first blacklist account set within a first historical time period; constructing a heterogeneous relationship graph based on the first bank account information and the first blacklist account set; wherein the heterogeneous relationship graph contains account nodes, other types of nodes, relationship edges between nodes, and feature information of nodes and feature information of edges; determining a relationship link set corresponding to the first relationship link type based on the heterogeneous relationship graph, and determining link feature information of multiple relationship links in the relationship link set based on the heterogeneous relationship graph, and determining the blacklist type corresponding to the terminal account node of each of the multiple relationship links; determining the link feature information of each of the multiple relationship links as the link feature information sample, and determining the risk link label corresponding to the link feature information sample based on the blacklist type; training the initial link model based on the link feature information sample and its corresponding link risk label to obtain the first link model.

[0007] In some embodiments, the fraud risk prediction model is trained in the following manner: obtaining the second bank account information and the second blacklist account set within the second historical time period; constructing multiple second relationship subgraphs with the second blacklist account set as the starting point based on the second bank account information and the link model corresponding to each relationship link type; each second relationship subgraph corresponds to a relationship link type; determining the subgraph account node sample set corresponding to each second relationship subgraph; the subgraph account node sample set includes multiple first account nodes, and account feature information and subgraph feature information of each first account node; the multiple first account nodes are other account nodes in the second relationship subgraph except the account nodes corresponding to the second blacklist account set; fusing the subgraph account node sample sets of each of the multiple second relationship subgraphs to obtain the fused feature information corresponding to each of the multiple first account nodes, and determining the fused feature information corresponding to each of the multiple first account nodes as the suspicious account feature information sample; determining the fraud risk label corresponding to the suspicious account feature information sample, and training the initial fraud risk prediction model based on the suspicious account feature information sample and its corresponding fraud risk label to obtain the fraud risk prediction model.

[0008] In some embodiments, the determining of multiple suspicious accounts and their respective corresponding feature information based on the multiple relationship subgraphs includes: determining a subgraph account node data set corresponding to each of the first relationship subgraphs; wherein the suspicious account node data set includes multiple second account nodes, account feature information and subgraph feature information of each of the second account nodes; the multiple second account nodes are other account nodes in the first relationship subgraph except the account nodes corresponding to the multiple blacklisted accounts; fusing the subgraph account node data sets corresponding to each of the multiple first relationship subgraphs to obtain fused feature information corresponding to each of the multiple second account nodes; determining multiple suspicious accounts based on the multiple second account nodes obtained after the fusion processing, and determining the fused feature information corresponding to each of the multiple second account nodes as the feature information corresponding to each of the multiple suspicious accounts.

[0009] As an example, determining a fraud-related account from the multiple suspicious accounts based on the fraud-related risk prediction value of each suspicious account includes: determining a suspicious account having a fraud-related risk prediction value greater than or equal to a threshold as the fraud-related account.

[0010] In a second aspect, an embodiment of the present invention provides a bank fraud account prediction device based on relationship learning, comprising: an acquisition module, used to acquire bank account information within a preset time period, and multiple current blacklist accounts; a construction module, used to construct multiple first relationship subgraphs with the multiple blacklist accounts as starting points based on the bank account information; wherein each of the first relationship subgraphs corresponds to a relationship link type; each of the first relationship subgraphs includes multiple risk relationship links, the starting account node and the end account node of each risk relationship link, and the account feature information of each account node; the relationship link type includes multiple basic relationship link types and multiple composite relationship link types, the basic relationship link type refers to a relationship link type in which there is an association relationship between account nodes, and the composite relationship link type refers to a relationship link type in which there are multiple association relationships between account nodes; the risk relationship link refers to a relationship link in which the relationship between account nodes has a risk of fraud; a first determination module, used to determine multiple suspicious accounts and their corresponding feature information based on the multiple first relationship subgraphs; A prediction module is used to input the characteristic information of each of the multiple suspicious accounts into a fraud risk prediction model to obtain a fraud risk prediction value of each of the suspicious accounts output by the fraud risk prediction model; wherein the fraud risk prediction model is trained by suspicious account characteristic information samples and their corresponding fraud risk labels; a second determination module is used to determine a fraud account from the multiple suspicious accounts based on the fraud risk prediction value of each of the suspicious accounts.

[0011] In some embodiments, for the first relationship subgraph corresponding to the first relationship link type, the construction module is specifically used to: based on the bank account information, expand the relationship link of the first relationship link type with the i-th newly added account node set as the starting point to obtain the i+1-th expanded relationship link data set; wherein i is an integer, when i=0, the i-th newly added account node set only includes the account nodes corresponding to each of the multiple blacklist accounts; the i+1-th expanded relationship link data set includes the starting account node and the end account node of the i+1-th newly added relationship link, and the link feature information of the i+1-th newly added relationship link; the link feature information includes the starting feature information and the end feature information of the relationship link, and the relationship feature information between the account nodes involved; the link feature information of each of the i+1-th newly added relationship links is input into the first link model corresponding to the first relationship link type, and the output of the first link model is obtained. Link risk prediction results; the first link model is trained based on the link feature information samples corresponding to the first relationship link type and its corresponding risk link label; based on the link risk prediction results, determine the i+1th risk relationship link from the i+1th newly added relationship link; based on the starting account node and the end account node of the i+1th risk relationship link, and the account feature information of the account nodes involved in the i+1th risk relationship link, update the i+1th extended relationship subgraph to obtain the i+1th extended relationship subgraph; wherein, when i=0, the i+1th extended relationship subgraph only contains the account nodes corresponding to each of the multiple blacklist accounts; determine the i+1th newly added account node set in the i+1th extended relationship subgraph, set i to i+1, continue to expand, until the number of expansions reaches the preset expansion number threshold, and determine the i+1th extended relationship subgraph as the first relationship subgraph.

[0012] In some embodiments, the device also includes a first training module; the first training module is used to: obtain first bank account information and a first blacklist account set within a first historical time period; construct a heterogeneous relationship graph based on the first bank account information and the first blacklist account set; wherein the heterogeneous relationship graph contains account nodes, other types of nodes, relationship edges between nodes, and feature information of nodes and feature information of edges; based on the heterogeneous relationship graph, determine the relationship link set corresponding to the first relationship link type, and based on the heterogeneous relationship graph, determine the link feature information of multiple relationship links in the relationship link set, and determine the blacklist type corresponding to the terminal account node of each of the multiple relationship links; determine the link feature information of each of the multiple relationship links as the link feature information sample, and based on the blacklist type, determine the risk link label corresponding to the link feature information sample; based on the link feature information sample and its corresponding link risk label, train the initial link model to obtain the first link model.

[0013] In some embodiments, the device also includes a second training module; the second training module is used to: obtain second bank account information and a second blacklist account set within a second historical time period; based on the second bank account information and the link model corresponding to each relationship link type, construct multiple second relationship subgraphs with the second blacklist account set as the starting point; each second relationship subgraph corresponds to a relationship link type; determine the subgraph account node sample set corresponding to each second relationship subgraph; the subgraph account node sample set includes multiple first account nodes, and account feature information and subgraph feature information of each first account node; the multiple first account nodes are other account nodes in the second relationship subgraph except the account nodes corresponding to the second blacklist account set; fuse the subgraph account node sample sets of each of the multiple second relationship subgraphs to obtain the fused feature information corresponding to each of the multiple first account nodes, and determine the fused feature information corresponding to each of the multiple first account nodes as the suspicious account feature information sample; determine the fraud risk label corresponding to the suspicious account feature information sample, and train the initial fraud risk prediction model based on the suspicious account feature information sample and its corresponding fraud risk label to obtain the fraud risk prediction model.

[0014] According to the bank fraud account prediction method and device based on relationship learning provided by the embodiment of the present invention, bank account information within a preset time period and multiple current blacklist accounts are obtained; based on the bank account information, multiple first relationship subgraphs with multiple blacklist accounts as starting points are constructed; wherein each first relationship subgraph corresponds to a relationship link type; each first relationship subgraph includes multiple risk relationship links, the starting account node and the end account node of each risk relationship link, and the account feature information of each account node; based on multiple first relationship subgraphs, multiple suspicious accounts and their corresponding feature information are determined; the feature information of each of the multiple suspicious accounts is input into the fraud risk prediction model to obtain the fraud risk prediction value of each suspicious account output by the fraud risk prediction model; based on the fraud risk prediction value of each suspicious account, the fraud account is determined from multiple suspicious accounts. The present invention determines multiple suspicious accounts by constructing multiple first relationship subgraphs containing risk relationship links, and realizes the prediction of fraud accounts based on the fraud risk prediction model, so as to more specifically predict fraud accounts and control fraud accounts in advance. In addition, the present invention takes into account different relationship link types, as well as basic relationship link types and composite relationship link types, thereby improving the accuracy of fraud-related account prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 One of the flow charts of a method for predicting bank fraudulent accounts based on relationship learning provided by an embodiment of the present invention; Figure 2 This is an example diagram of a relationship link of a basic relationship link type in an embodiment of the present invention; Figure 3 This is an example diagram of a relationship link of a composite relationship link type in an embodiment of the present invention; Figure 4 A second flow chart of a method for predicting bank fraudulent accounts based on relationship learning provided by an embodiment of the present invention; Figure 5 A third flow chart of a method for predicting bank fraudulent accounts based on relationship learning provided by an embodiment of the present invention; Figure 6 is an example diagram of a heterogeneous relationship map in an embodiment of the present invention; Figure 7A fourth flow chart of a method for predicting bank fraudulent accounts based on relationship learning provided by an embodiment of the present invention; Figure 8 A schematic diagram of the structure of a device for predicting bank fraudulent accounts based on relationship learning provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] At present, the anti-fraud risk control system of banks tends to detect and intercept after the fact. Generally, after telecommunications network fraud occurs, the victim will take the initiative to report the fraudulent account, or the anti-fraud rules or models will identify suspicious fraud accounts and then freeze their funds. However, this method has a lag, and the funds of the accounts involved are often quickly transferred out before being frozen, resulting in irreparable financial losses of the victims. Therefore, it is necessary to warn of fraudulent accounts in advance, so as to control them before telecommunications network fraud occurs and avoid financial and property losses.

[0019] In order to solve the above problems, an embodiment of the present invention provides a method and device for predicting bank fraudulent accounts based on relationship learning.

[0020] Figure 1 The present invention provides a method for predicting bank fraudulent accounts based on relationship learning. Figure 1 As shown, the method may include the following steps.

[0021] Step 101, obtaining bank account information within a preset time period and multiple current blacklist accounts.

[0022] Among them, the preset time period may include the current moment and a period of time before the current moment. Bank account information may include basic account information, account transaction flow information, account login information, equity relationship information, etc. Among them, basic account information may include account identification information, customer information, certificate number information, address information, etc. Account transaction flow information may include the amount of transactions at different times, the account of the transaction, etc. Account login information may include account login time, login IP address information, login MAC address information, etc. The blacklist account here refers to an account that has been determined to be a fraudulent account or an account that has been determined to have a fraudulent risk so far.

[0023] Step 102, based on the bank account information, construct multiple first relationship subgraphs with multiple blacklist accounts as starting points; wherein each first relationship subgraph corresponds to a relationship link type; each first relationship subgraph includes multiple risk relationship links, the starting account node and the end account node of each risk relationship link, and the account feature information of each account node; the relationship link type includes multiple basic relationship link types and multiple composite relationship link types, the basic relationship link type refers to a relationship link type in which there is one association relationship between account nodes, and the composite relationship link type refers to a relationship link type in which there are multiple association relationships between account nodes; a risk relationship link refers to a relationship link in which the relationship between account nodes has a risk of fraud.

[0024] In some embodiments, the association relationship between different accounts can be determined based on bank account information, such as multiple transactions between account A and account B within a preset time period, account A and account B have logged into the same IP address within a preset time period, and there is an equity relationship between account A and account B. In order to facilitate the expression of the association relationship between accounts, the embodiment of the present invention proposes a relationship link, the starting point and end point of the relationship link are both accounts, and the relationship relationship between accounts is expressed through the relationship link.

[0025] For easy distinction, relationship links are divided into different types, each of which expresses a specific relationship between accounts. For example, the transaction relationship between accounts can be used as a relationship link type, and the relationship between accounts with the same login IP address can be used as a relationship link type.

[0026] In some embodiments, based on bank account information, starting from multiple blacklist accounts, it is possible to find information about multiple primary accounts that are associated with blacklist accounts, as well as secondary accounts that are associated with primary accounts, and to determine detailed information corresponding to each association. For example, for accounts with transaction relationships, the amount of transactions, the number of transactions, the proportion of transactions, and other information within a preset time period can be determined based on bank account information. The association between accounts is equivalent to a relationship link, and the detailed information corresponding to the association relationship and the information about the accounts involved in the association relationship can be used as feature information of the relationship link. In other words, based on bank account information, starting from multiple blacklist accounts, it is possible to determine multiple relationship links and feature information of each relationship link.

[0027] In order to find suspicious accounts from bank accounts, it is necessary to determine the risky relationship links with fraud risks from the relationship links. For example, if the starting account node of a relationship link is a blacklist account node, and the relationship link indicates that the end account node and the blacklist account node have conducted multiple transactions within a preset time period, the relationship link can be determined to be a risky relationship link. In other words, it can be determined whether it is a risky relationship link based on the characteristic information of each relationship link.

[0028] As a possible implementation method, the characteristic information of the risk relationship link can be set in advance, and the characteristic information of each of the multiple relationship links determined based on the bank account information and the blacklist account information can be matched with the characteristic information of the risk relationship link. Multiple risk relationship links can be determined from the multiple relationship links, and these risk relationship links can be constructed into multiple first relationship sub-graphs according to different relationship link types.

[0029] In order to more fully express the association relationship between account nodes, the present invention proposes a basic relationship link type and a composite relationship link type. The basic relationship link type refers to a relationship link type in which one association relationship exists between account nodes, and the composite relationship link type refers to a relationship link type in which multiple association relationships exist between account nodes. Figure 2 (a) indicates that there is a relationship link between accounts for fund transactions. Figure 2 (b) in the figure indicates the relationship link between accounts logging into the same IP address. Figure 2 (c) in the figure represents the relationship link between accounts with equity relationship, because Figure 2 The relationship links in each contain only one association relationship, so Figure 2 The three relationship links in are all basic relationship link types.

[0030] Figure 3 (a) indicates the relationship link between accounts with the same address and logged in with the same IP. Figure 3 (b) in the figure indicates that there is an important contact relationship between accounts and the relationship link of logging into the same MAC. Figure 3 Both relationship links in contain multiple associations between accounts, so Figure 3 The relationship links in are all composite relationship link types.

[0031] In some embodiments, the account nodes in multiple first relationship subgraphs may be repeated, but the account feature information of the same account node in different first relationship subgraphs is the same. The account feature information of each account node can be determined based on the bank account information within a preset time period. The account feature information of each account node may include basic account information, transaction information, login information, etc. Among them, the basic account information may include blacklist type, account identification, etc., the transaction information may include the number of transactions in the past N days, the transaction amount, the number of accounts involved in the transaction in the past N days, etc., and the login information may include the number of logins in the past N days, the number of IPs logged in in the past N days, the number of MACs logged in in the past N days, etc.

[0032] It should be noted that the nodes in the first relationship subgraph may only contain account nodes, and may also contain other nodes, such as customer nodes, MAC nodes, address nodes, etc. In other words, the risk relationship link between the account nodes in the first relationship subgraph can be expressed by the edges between the account nodes, or by Figure 2 and Figure 3 It is expressed by the different relationship edges between the account node and other nodes.

[0033] Step 103: Based on the multiple first relationship subgraphs, determine multiple suspicious accounts and their corresponding characteristic information.

[0034] It can be understood that each first relationship subgraph contains multiple risk relationship links, so all account nodes involved in the risk relationship link, except for the blacklist account nodes, can be regarded as suspicious accounts.

[0035] In some embodiments, multiple second account nodes in each first relationship subgraph can be first determined, and the second account nodes are other account nodes in the first relationship subgraph except the blacklist account nodes; the multiple second account nodes in each first relationship subgraph are taken as a union, and the duplicate account nodes in the multiple second account nodes obtained after taking the union are removed to obtain multiple different second account nodes; the accounts corresponding to the multiple different second account nodes are respectively determined as suspicious accounts, and the account feature information of the multiple different second account nodes is respectively determined as the feature information of the corresponding suspicious accounts.

[0036] In some embodiments, based on multiple relationship subgraphs, the implementation process of determining multiple suspicious accounts and their corresponding characteristic information may include the following steps.

[0037] Step S1, determining a subgraph account node data set corresponding to each first relationship subgraph; wherein the suspicious account node data set includes multiple second account nodes, account feature information and subgraph feature information of each second account node; the multiple second account nodes are other account nodes in the first relationship subgraph except the account nodes corresponding to the multiple blacklist accounts.

[0038] That is to say, for each first relationship subgraph, multiple second account nodes in the first relationship subgraph except the account nodes corresponding to the multiple blacklist accounts are determined, as well as the account feature information of each second account node and the subgraph feature information of each second account node in the first relationship subgraph.

[0039] Among them, the subgraph feature information of each second account node may include but is not limited to the node centrality, label propagation value, neighbor aggregation statistics, etc. of the node in the first relationship subgraph.

[0040] Step S2, fusing the subgraph account node data sets corresponding to each of the multiple first relationship subgraphs to obtain fused feature information corresponding to each of the multiple second account nodes.

[0041] In some embodiments, the subgraph account node data sets corresponding to each of the multiple first relationship subgraphs can be taken and combined to obtain multiple second account nodes after the combination and the account feature information and subgraph feature information of each second account node. For the overlapping nodes in the multiple second account nodes, their respective subgraph feature information is merged. In other words, if a second account node only appears in one first relationship subgraph, then after the fusion process, the fusion feature information of the second account node is still the account feature information and subgraph feature information of the second account node. If a second account node appears in multiple first relationship subgraphs, then after the fusion process, the fusion feature information of the second account node is the result of merging the account feature information of the second account node and the subgraph feature information of the second account node in different first relationship subgraphs.

[0042] Step S3, determining multiple suspicious accounts based on the multiple second account nodes obtained after the fusion processing, and determining the fused feature information corresponding to each of the multiple second account nodes as the feature information corresponding to each of the multiple suspicious accounts.

[0043] That is, the accounts corresponding to the multiple second account nodes obtained after the fusion processing are determined as suspicious accounts, multiple suspicious accounts are obtained, and the fused feature information of the second account nodes is determined as the feature information of the corresponding suspicious accounts.

[0044] Step 104, input the characteristic information of each of the multiple suspicious accounts into a fraud risk prediction model to obtain a fraud risk prediction value of each suspicious account output by the fraud risk prediction model; wherein the fraud risk prediction model is trained by suspicious account characteristic information samples and their corresponding fraud risk labels.

[0045] In some embodiments, the fraud risk prediction model may be a neural network model or a machine learning model. The fraud risk prediction model may be trained based on a binary classification algorithm, the fraud risk label may be 0 or 1, and the fraud risk prediction value output by the fraud risk prediction model may be a value between 0 and 1.

[0046] Step 105: Determine a fraud-related account from multiple suspicious accounts based on the fraud-related risk prediction value of each suspicious account.

[0047] In some embodiments, a threshold may be pre-set, and the fraud risk prediction value of each suspicious account may be compared with the threshold. Suspicious accounts with fraud risk prediction values ​​greater than or equal to the threshold may be determined as fraud-related accounts.

[0048] According to the bank fraud account prediction method based on relationship learning provided by the embodiment of the present invention, bank account information within a preset time period and multiple current blacklist accounts are obtained; based on the bank account information, multiple first relationship subgraphs with multiple blacklist accounts as starting points are constructed; wherein each first relationship subgraph corresponds to a relationship link type; each first relationship subgraph includes multiple risk relationship links, the starting account node and the end account node of each risk relationship link, and the account feature information of each account node; based on multiple first relationship subgraphs, multiple suspicious accounts and their corresponding feature information are determined; the feature information of each of the multiple suspicious accounts is input into the fraud risk prediction model to obtain the fraud risk prediction value of each suspicious account output by the fraud risk prediction model; based on the fraud risk prediction value of each suspicious account, the fraud account is determined from multiple suspicious accounts. The present invention determines multiple suspicious accounts by constructing multiple first relationship subgraphs containing risk relationship links, and realizes the prediction of fraud accounts based on the fraud risk prediction model, so as to more specifically predict fraud accounts so as to control fraud accounts in advance. In addition, the present invention takes into account different relationship link types, as well as basic relationship link types and composite relationship link types, thereby improving the accuracy of fraud-related account prediction.

[0049] Figure 4 The second flow chart of the bank fraud account prediction method based on relationship learning provided by the embodiment of the present invention. Figure 4As shown, based on the above embodiment, for the first relationship subgraph corresponding to the first relationship link type, based on the bank account information, the implementation process of constructing the first relationship subgraph with multiple blacklist accounts as starting points may include the following steps.

[0050] Step 401, based on the bank account information, the relationship link of the first relationship link type is expanded with the i-th newly added account node set as the starting point to obtain the i+1-th expanded relationship link data set; wherein i is an integer, when i=0, the i-th newly added account node set only includes the account nodes corresponding to each of the multiple blacklisted accounts; the i+1-th expanded relationship link data set includes the starting point account node and the end point account node of the i+1-th newly added relationship link, and the link feature information of the i+1-th newly added relationship link; the link feature information includes the starting point feature information and the end point feature information of the relationship link, and the relationship feature information between the account nodes involved.

[0051] The i-th newly added account node set is the account node set added to the i-th extended relationship subgraph relative to the i-1-th extended relationship subgraph. In other words, each time the relationship link is extended, the account node added in the last extension is used as the starting point.

[0052] In some embodiments, the link characteristic information of the relationship link is related to the type of the relationship link. For example, for a relationship link of a relationship link type representing a transaction relationship, the starting point characteristic information in its link characteristic information may include the blacklist type of the starting point account node, the number of transactions on that day, etc.; the end point characteristic information in its link characteristic information may include the blacklist type of the end point account node, the number of transactions in the past N days, the number of accounts that have traded in the past N days, etc.; the relationship characteristic information in its link characteristic information may include the number of transactions between the starting point account node and the end point account node in the past N days, the proportion of transaction amounts in the past N days, the number of transaction days in the past N days, etc.

[0053] For another example, for a relationship link of a relationship link type representing the same login IP, the starting point feature information in its link feature information may include the blacklist type of the starting point account node, the number of logins on the day, etc.; the end point feature information in its link feature information may include the blacklist type of the end point account node, the number of logins in the past N days, the login IP in the past N days, etc.; the relationship feature information in its link feature information includes the number of logins to the same IP on the day between the starting point account node and the end point account node, the number of logins to the same IP in the past N days, the number of login accounts that have logged in to the same IP in the past N days, etc.

[0054] It should be noted that, for the link feature information of the i+1th newly added relationship link, if the starting account node of the i+1th newly added relationship link is a blacklist account node, then the starting feature information takes the blacklist account node as the starting point; if the starting account node of the i+1th newly added relationship link is not a blacklist account node, then the starting feature information takes the blacklist account node corresponding to the starting account node at the time of initial expansion as the starting point.

[0055] Step 402, input the link feature information of each of the i+1th newly added relationship links into the first link model corresponding to the first relationship link type, and obtain the link risk prediction result output by the first link model; the first link model is trained based on the link feature information sample corresponding to the first relationship link type and its corresponding risk link label.

[0056] That is, each relationship link type corresponds to a link model, and the link model has learned the ability to determine whether it is a risky link based on the link feature information.

[0057] In some embodiments, the link model can be a machine learning model obtained by training a binary classification algorithm based on link feature information samples and their corresponding risk link labels. As an example, the link feature information samples corresponding to the first relationship link type can be determined in the following manner: based on the bank account information and blacklist account information in the historical time period, multiple relationship links of the first relationship link type with the blacklist account as the starting account are determined; the starting account feature information of each relationship link, the relationship feature information between the starting account and the end account, and the end account feature information are obtained, and used as the link feature information of each relationship link; based on the link feature information of each of these relationship links, the link feature information samples corresponding to the first relationship link type are determined.

[0058] Step 403: Based on the link risk prediction result, determine the i+1th risk relationship link from the i+1th newly added relationship link.

[0059] In some embodiments, the link risk prediction result includes a probability value that the i+1th newly added relationship link is a risk relationship link, and the i+1th newly added relationship link whose probability value of the risk relationship link is greater than or equal to a threshold is determined as the i+1th risk relationship link.

[0060] Step 404: Based on the starting account node and the ending account node of the i+1th risk relationship link, and the account feature information of the account nodes involved in the i+1th risk relationship link, the i+1th extended relationship subgraph is updated to obtain the i+1th extended relationship subgraph; wherein, when i=0, the i+1th extended relationship subgraph only includes the account nodes corresponding to each of the multiple blacklisted accounts.

[0061] That is to say, based on the starting account node and the end account node of the i+1th risk relationship link, the i+1th risk relationship link is added to the i-th extended relationship subgraph, and the newly added account nodes and the corresponding account feature information involved are added to obtain the i+1th extended relationship subgraph.

[0062] As an example, if is the terminal account node set of the i+1th expansion, and the account node set of the i-th expansion relationship subgraph is , is the i+1th risk relationship link set, and the account node set of the i-th extended relationship subgraph is , the risk relationship link set of the i-th extended relationship subgraph is , then the account node set in the i+1th extended relationship subgraph , the risk relationship link set in the i+1th extended relationship subgraph is .

[0063] Step 405, determine the i+1th newly added account node set in the i+1th extended relationship subgraph, set i to i+1, continue to expand until the number of expansions reaches a preset expansion number threshold, and determine the i+1th extended relationship subgraph as the first relationship subgraph.

[0064] That is to say, if i+1 is the expansion times threshold, the i+1th expanded relationship subgraph is determined as the first relationship subgraph; if i+1 is less than the expansion times threshold, the i+1th newly added account node set in the i+1th expanded relationship subgraph is determined, and i is set to i+1, and the process returns to step 401 to continue the expansion.

[0065] According to the bank fraud account prediction method based on relationship learning according to the embodiment of the present invention, the bank account information is expanded layer by layer, and the risk relationship link is identified based on the link model, and the relationship subgraph is expanded based on the expanded risk relationship link, and finally the first relationship subgraph is obtained. The present invention obtains the risk relationship link by learning the link model for different relationship link types, so that suspicious accounts can be obtained by screening the risk relationship link, thereby improving the accuracy and efficiency of fraud account prediction.

[0066] Figure 5 The third flow chart of the bank fraud account prediction method based on relationship learning provided by the embodiment of the present invention. Figure 5 As shown, the training process of the first link model may include the following steps.

[0067] Step 501, obtaining first bank account information within a first historical time period and a first blacklist account set.

[0068] The first historical time period may be a relatively long historical time period, so as to obtain sufficient training samples to train the first link model. The first blacklist account set may be a blacklist account set determined up to the start time t of the first historical time period.

[0069] Step 502, constructing a heterogeneous relationship graph based on the first bank account information and the first blacklist account set; wherein the heterogeneous relationship graph includes account nodes, other types of nodes, relationship edges between nodes, and feature information of nodes and feature information of edges.

[0070] In some embodiments, Figure 6 As shown, the heterogeneous relationship graph may include account nodes, customer nodes, certificate number nodes, address nodes, IP nodes, MAC nodes, etc. The relationship edges between nodes may include account basic relationship edges, account transaction relationship edges, account login relationship edges, and customer association relationship edges. Among them, the account basic relationship edge may be an account-customer association relationship edge, an account-certificate number association relationship edge, an account-address association relationship edge, etc. The account transaction relationship edge may be an account-account transaction (transfer) relationship edge. The account login relationship edge may be an account-IP login relationship edge, an account-MAC login relationship edge. The customer association relationship edge may be a customer-customer equity relationship edge, a customer-customer important contact relationship edge, etc.

[0071] Step 503, based on the heterogeneous relationship graph, determine the relationship link set corresponding to the first relationship link type, and based on the heterogeneous relationship graph, determine the link feature information of multiple relationship links in the relationship link set, and determine the blacklist type corresponding to the terminal account node of each of the multiple relationship links.

[0072] In some embodiments, since the heterogeneous relationship graph contains multiple relationship edges and different types of nodes, based on the association relationship between account nodes corresponding to the first relationship link type, all relationship links between account nodes with such an association relationship can be determined from the heterogeneous relationship graph to obtain a relationship link set corresponding to the first relationship link type.

[0073] It should be noted that the starting point account nodes of the multiple relationship links included in the relationship link set here are all blacklist account nodes corresponding to the first blacklist account set.

[0074] In some embodiments, a blacklist account set at time T after the start time t of the first historical time period may be obtained, with a preset time interval between time t and time T. Based on the blacklist account set at time T, it is determined whether the respective end point account nodes of multiple relationship links in the relationship link set are blacklist accounts, so as to determine the blacklist type of the respective end point account nodes of the multiple relationship links. In other words, if the end point account node of a relationship link is blacklisted after a period of time in the future, it means that the relationship link has a risk of fraud.

[0075] The blacklist type of the destination account node refers to whether the destination account node is a blacklist account.

[0076] Step 504: determine the link characteristic information of each of the multiple relationship links as a link characteristic information sample, and determine the risk link label corresponding to the link characteristic information sample based on the blacklist type.

[0077] Step 505 : Based on the link feature information samples and their corresponding link risk labels, the initial link model is trained to obtain a first link model.

[0078] In some embodiments, the first link model uses a binary classification algorithm to train a machine learning model on a training sample. Among them, the classification algorithm is not limited to a decision tree model, a logistic regression model, a Bayesian model, an ensemble learning model, a neural network model, etc. During training, the road feature information sample can be preprocessed first, and the feature preprocessing technology can be selected according to the actual data situation, including feature cleaning, feature transformation, feature standardization, feature selection, etc.; the hyperparameters of the classification algorithm are optimized, and the parameter optimization method used is not limited to grid search, random search, Bayesian optimization, particle swarm optimization, genetic algorithm, etc. For each set of hyperparameters, a cross-validation method is used to train, verify and evaluate the model; from the hyperparameter space of the classification algorithm, a set of hyperparameter combinations is output so that the evaluation index of the cross-validation of the binary classification model is optimal; according to the optimal hyperparameter combination, the initial link model is determined, and the initial link model is trained based on the link feature information sample and its corresponding link risk label to obtain the first link model.

[0079] According to the bank fraud account prediction method based on relationship learning according to the embodiment of the present invention, a set of relationship links of different link types is determined through a heterogeneous relationship graph, and a link model is trained based on link feature information samples of different relationship link types to obtain link models corresponding to different relationship link types, so that the link model can learn to obtain the ability to predict link risks based on link feature information, thereby outputting suspicious accounts based on risk link identification, and identifying fraud risks for suspicious accounts, thereby improving prediction efficiency.

[0080] Figure 7The fourth flow chart of the bank fraud account prediction method based on relationship learning provided by the embodiment of the present invention. Figure 7 As shown, the training process of the fraud risk prediction model may include the following steps.

[0081] Step 701, obtaining second bank account information within a second historical time period and a second blacklist account set.

[0082] The second historical time period may be a longer historical time period to obtain sufficient training samples to train the fraud risk prediction model. The second historical time period may be the same as the first historical time period or may be different from the first historical time period. The second blacklist account set may be a set of all blacklist accounts up to the start time of the second historical time period.

[0083] Step 702: construct multiple second relationship subgraphs starting from the second blacklist account set based on the second bank account information and the link model corresponding to each relationship link type; each second relationship subgraph corresponds to a relationship link type.

[0084] In some embodiments, the implementation process of constructing the second relationship subgraphs of the plurality of relationship link types is consistent with the implementation process of constructing the first relationship subgraph in the above embodiments, and will not be described in detail here.

[0085] Step 703, determine the subgraph account node sample set corresponding to each second relationship subgraph; the subgraph account node sample set includes multiple first account nodes, and account feature information and subgraph feature information of each first account node; the multiple first account nodes are other account nodes in the second relationship subgraph except the account nodes corresponding to the second blacklist account set.

[0086] Step 704: fuse the subgraph account node sample sets of the respective second relationship subgraphs to obtain the fused feature information corresponding to the respective first account nodes, and determine the fused feature information corresponding to the respective first account nodes as suspicious account feature information samples.

[0087] Step 705, determine the fraud-related risk labels corresponding to the suspicious account feature information samples, and train the initial fraud-related risk prediction model based on the suspicious account feature information samples and their corresponding fraud-related risk labels to obtain a fraud-related risk prediction model.

[0088] In some embodiments, a blacklist account set after a period of time may be obtained, and based on the blacklist account set after a period of time, a fraud risk label corresponding to the suspicious account feature information sample may be determined. In other words, if an account becomes a blacklist account after a certain period of time in the future, the account has a fraud risk.

[0089] According to the bank fraud account prediction method based on relationship learning according to the embodiment of the present invention, suspicious account feature information samples are constructed through multiple second relationship subgraphs obtained by expansion based on the link model, and the fraud risk labels corresponding to the suspicious account feature information samples are determined. Based on the suspicious account feature information samples and their corresponding fraud risk labels, the initial fraud risk prediction model is trained to obtain the fraud risk prediction model, so as to realize the training of the fraud risk prediction model.

[0090] Figure 8 The present invention provides a schematic diagram of a bank fraud account prediction device based on relationship learning. Figure 8 As shown, the device includes an acquisition module 810 , a construction module 820 , a first determination module 830 , a prediction module 840 and a second determination module 850 .

[0091] An acquisition module 810 is used to acquire bank account information within a preset time period and multiple current blacklist accounts; A construction module 820 is used to construct a plurality of first relationship subgraphs with a plurality of blacklist accounts as starting points based on bank account information; wherein each first relationship subgraph corresponds to a relationship link type; each first relationship subgraph includes a plurality of risk relationship links, a starting account node and an end account node of each risk relationship link, and account feature information of each account node; the relationship link type includes a plurality of basic relationship link types and a plurality of composite relationship link types, the basic relationship link type refers to a relationship link type with a single association relationship between account nodes, and the composite relationship link type refers to a relationship link type with multiple association relationships between account nodes; a risk relationship link refers to a relationship link with a fraud risk between account nodes; A first determination module 830, configured to determine a plurality of suspicious accounts and their corresponding characteristic information based on a plurality of first relationship subgraphs; Prediction module 840, used to input characteristic information of each of the multiple suspicious accounts into a fraud risk prediction model, and obtain a fraud risk prediction value of each suspicious account output by the fraud risk prediction model; wherein the fraud risk prediction model is trained by the suspicious account characteristic information samples and their corresponding fraud risk labels; The second determination module 850 is used to determine a fraud-related account from a plurality of suspicious accounts based on the fraud-related risk prediction value of each suspicious account.

[0092] In some embodiments, for the first relationship subgraph corresponding to the first relationship link type, the construction module 820 is specifically used to: based on the bank account information, expand the relationship link of the first relationship link type with the i-th newly added account node set as the starting point to obtain the i+1-th expanded relationship link data set; wherein i is an integer, when i=0, the i-th newly added account node set only includes the account nodes corresponding to each of the multiple blacklisted accounts; the i+1-th expanded relationship link data set includes the starting account node and the end account node of the i+1-th newly added relationship link, and the link feature information of the i+1-th newly added relationship link; the link feature information includes the starting feature information and the end feature information of the relationship link, and the relationship feature information between the account nodes involved; the link feature information of each of the i+1-th newly added relationship links is input into the first link model corresponding to the first relationship link type to obtain the first link model The output link risk prediction result; the first link model is obtained by training based on the link feature information sample corresponding to the first relationship link type and its corresponding risk link label; based on the link risk prediction result, determine the i+1th risk relationship link from the i+1th newly added relationship link; based on the starting account node and the end account node of the i+1th risk relationship link, and the account feature information of the account nodes involved in the i+1th risk relationship link, update the i+1th extended relationship subgraph to obtain the i+1th extended relationship subgraph; wherein, when i=0, the i+1th extended relationship subgraph only contains the account nodes corresponding to multiple blacklisted accounts; determine the i+1th newly added account node set in the i+1th extended relationship subgraph, set i to i+1, and continue to expand until the number of expansions reaches the preset expansion number threshold, and determine the i+1th extended relationship subgraph as the first relationship subgraph.

[0093] In some embodiments, the device also includes a first training module 860; the first training module 860 is used to: obtain the first bank account information within the first historical time period, and the first blacklist account set; construct a heterogeneous relationship graph based on the first bank account information and the first blacklist account set; wherein the heterogeneous relationship graph contains account nodes, other types of nodes, relationship edges between nodes, and feature information of nodes and feature information of edges; based on the heterogeneous relationship graph, determine the relationship link set corresponding to the first relationship link type, and based on the heterogeneous relationship graph, determine the link feature information of multiple relationship links in the relationship link set, and the blacklist type corresponding to the terminal account node of each of the multiple relationship links; determine the link feature information of each of the multiple relationship links as a link feature information sample, and based on the blacklist type, determine the risk link label corresponding to the link feature information sample; based on the link feature information sample and its corresponding link risk label, train the initial link model to obtain the first link model.

[0094] In some embodiments, the device also includes a second training module 870; the second training module 870 is used to: obtain second bank account information within a second historical time period, and a second blacklist account set; based on the second bank account information and the link model corresponding to each relationship link type, construct multiple second relationship subgraphs with the second blacklist account set as the starting point; each second relationship subgraph corresponds to a relationship link type; determine the subgraph account node sample set corresponding to each second relationship subgraph; the subgraph account node sample set includes multiple first account nodes, and account feature information and subgraph feature information of each first account node; the multiple first account nodes are other account nodes in the second relationship subgraph except the account nodes corresponding to the second blacklist account set; fuse the subgraph account node sample sets of the multiple second relationship subgraphs to obtain the fused feature information corresponding to each of the multiple first account nodes, and determine the fused feature information corresponding to each of the multiple first account nodes as suspicious account feature information samples; determine the fraud-related risk labels corresponding to the suspicious account feature information samples, and train the initial fraud-related risk prediction model based on the suspicious account feature information samples and their corresponding fraud-related risk labels to obtain a fraud-related risk prediction model.

[0095] In some embodiments, the first determination module 830 is specifically used to: determine the subgraph account node data set corresponding to each first relationship subgraph; wherein the suspicious account node data set includes multiple second account nodes, account feature information and subgraph feature information of each second account node; the multiple second account nodes are other account nodes except the account nodes corresponding to the multiple blacklist accounts; the subgraph account node data sets corresponding to each of the multiple first relationship subgraphs are fused to obtain the fused feature information corresponding to each of the multiple second account nodes; determine multiple suspicious accounts based on the multiple second account nodes obtained after the fusion process, and determine the fused feature information corresponding to each of the multiple second account nodes as the feature information corresponding to each of the multiple suspicious accounts.

[0096] As an example, the second determination module 850 is specifically used to determine a suspicious account with a fraud-related risk prediction value greater than or equal to a threshold as a fraud-related account.

[0097] It should be noted that the description of the bank fraud account prediction method based on relationship learning in the above embodiment is also applicable to the bank fraud account prediction device based on relationship learning in this embodiment, and will not be repeated here.

[0098] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0099] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for predicting bank fraud accounts based on relationship learning, characterized in that: include: Obtain bank account information within a preset time period, as well as multiple current blacklist accounts; Based on the bank account information, a plurality of first relationship subgraphs are constructed with the plurality of blacklist accounts as starting points; wherein each of the first relationship subgraphs corresponds to a relationship link type; each of the first relationship subgraphs includes a plurality of risk relationship links, a starting account node and an end account node of each risk relationship link, and account feature information of each account node; the relationship link types include a plurality of basic relationship link types and a plurality of composite relationship link types, the basic relationship link type refers to a relationship link type in which there is a type of association relationship between account nodes, and the composite relationship link type refers to a relationship link type in which there are multiple types of association relationships between account nodes; the risk relationship link refers to a relationship link in which the relationship between account nodes has a risk of fraud; Based on the multiple first relationship subgraphs, determining multiple suspicious accounts and their respective corresponding feature information; Inputting the characteristic information of each of the multiple suspicious accounts into a fraud risk prediction model to obtain a fraud risk prediction value of each of the suspicious accounts output by the fraud risk prediction model; wherein the fraud risk prediction model is trained by a sample of the characteristic information of the suspicious accounts and their corresponding fraud risk labels; Based on the fraud risk prediction value of each of the suspicious accounts, a fraud-related account is determined from the multiple suspicious accounts.

2. The method according to claim 1, characterized in that For a first relationship subgraph corresponding to the first relationship link type, based on the bank account information, constructing the first relationship subgraph with the plurality of blacklist accounts as starting points, including: Based on the bank account information, the relationship link of the first relationship link type is extended with the i-th newly added account node set as the starting point to obtain the i+1-th extended relationship link data set; wherein i is an integer, and when i=0, the i-th newly added account node set only includes the account nodes corresponding to each of the multiple blacklist accounts; the i+1-th extended relationship link data set includes the starting point account node and the end point account node of the i+1-th newly added relationship link, and the link feature information of the i+1-th newly added relationship link; the link feature information includes the starting point feature information and the end point feature information of the relationship link, and the relationship feature information between the account nodes involved; Inputting the link feature information of each of the i+1th newly added relationship links into the first link model corresponding to the first relationship link type, and obtaining the link risk prediction result output by the first link model; the first link model is trained based on the link feature information sample corresponding to the first relationship link type and its corresponding risk link label; Based on the link risk prediction result, determining the i+1th risk relationship link from the i+1th newly added relationship link; Based on the starting account node and the end account node of the i+1th risk relationship link, and the account feature information of the account nodes involved in the i+1th risk relationship link, the i-th extended relationship subgraph is updated to obtain the i+1th extended relationship subgraph; wherein, when i=0, the i-th extended relationship subgraph only includes the account nodes corresponding to each of the multiple blacklist accounts; Determine the i+1th newly added account node set in the i+1th extended relationship subgraph, set i to i+1, continue to expand until the number of expansions reaches a preset expansion number threshold, and determine the i+1th extended relationship subgraph as the first relationship subgraph.

3. The method according to claim 2, characterized in that The first link model is trained in the following way: Obtaining first bank account information and a first blacklist account set within a first historical time period; Based on the first bank account information and the first blacklist account set, a heterogeneous relationship graph is constructed; wherein the heterogeneous relationship graph includes account nodes, other types of nodes, relationship edges between nodes, and feature information of nodes and feature information of edges; Based on the heterogeneous relationship graph, determine a relationship link set corresponding to the first relationship link type, and based on the heterogeneous relationship graph, determine link feature information of multiple relationship links in the relationship link set, and determine the blacklist type corresponding to the terminal account node of each of the multiple relationship links; Determine the link feature information of each of the multiple relationship links as the link feature information sample, and determine the risk link label corresponding to the link feature information sample based on the blacklist type; Based on the link feature information samples and their corresponding link risk labels, an initial link model is trained to obtain the first link model.

4. The method according to claim 2, characterized in that: The fraud risk prediction model is trained in the following way: Obtaining second bank account information and a second blacklist account set within a second historical time period; Based on the second bank account information and the link model corresponding to each relationship link type, construct multiple second relationship subgraphs starting from the second blacklist account set; each second relationship subgraph corresponds to a relationship link type; Determine a subgraph account node sample set corresponding to each of the second relationship subgraphs; The subgraph account node sample set includes a plurality of first account nodes, and account feature information and subgraph feature information of each of the first account nodes; the plurality of first account nodes are other account nodes in the second relationship subgraph except the account nodes corresponding to the second blacklist account set; fusing the subgraph account node sample sets of the respective second relationship subgraphs to obtain fused feature information corresponding to the respective first account nodes, and determining the fused feature information corresponding to the respective first account nodes as the suspicious account feature information sample; Determine the fraud-related risk label corresponding to the suspicious account feature information sample, and train an initial fraud-related risk prediction model based on the suspicious account feature information sample and its corresponding fraud-related risk label to obtain the fraud-related risk prediction model.

5. The method according to claim 1, characterized in that: The determining of multiple suspicious accounts and their corresponding characteristic information based on the multiple relationship subgraphs includes: Determine a subgraph account node data set corresponding to each of the first relationship subgraphs; wherein the suspicious account node data set includes a plurality of second account nodes, account feature information and subgraph feature information of each of the second account nodes; the plurality of second account nodes are other account nodes in the first relationship subgraph except the account nodes corresponding to the plurality of blacklist accounts; The subgraph account node data sets corresponding to the plurality of first relationship subgraphs are fused to obtain fused feature information corresponding to the plurality of second account nodes; A plurality of suspicious accounts are determined based on the plurality of second account nodes obtained after the fusion processing, and the fused feature information corresponding to each of the plurality of second account nodes is determined as the feature information corresponding to each of the plurality of suspicious accounts.

6. The method according to claim 1, characterized in that The step of determining a fraud-related account from the plurality of suspicious accounts based on the fraud-related risk prediction value of each of the suspicious accounts comprises: A suspicious account whose fraud risk prediction value is greater than or equal to the threshold is determined as the fraud-related account.

7. A bank fraud account prediction device based on relationship learning, characterized in that: include: An acquisition module is used to obtain bank account information within a preset time period and multiple current blacklist accounts; A construction module is used to construct multiple first relationship subgraphs with the multiple blacklist accounts as starting points based on the bank account information; wherein each of the first relationship subgraphs corresponds to a relationship link type; each of the first relationship subgraphs includes multiple risk relationship links, the starting account node and the end account node of each risk relationship link, and the account feature information of each account node; the relationship link type includes multiple basic relationship link types and multiple composite relationship link types, the basic relationship link type refers to a relationship link type in which there is one association relationship between account nodes, and the composite relationship link type refers to a relationship link type in which there are multiple association relationships between account nodes; the risk relationship link refers to a relationship link in which the relationship between account nodes has a risk of fraud; A first determination module, configured to determine a plurality of suspicious accounts and their respective corresponding feature information based on the plurality of first relationship subgraphs; A prediction module, used to input the characteristic information of each of the multiple suspicious accounts into a fraud risk prediction model, and obtain a fraud risk prediction value of each of the suspicious accounts output by the fraud risk prediction model; wherein the fraud risk prediction model is trained by a sample of characteristic information of suspicious accounts and their corresponding fraud risk labels; The second determination module is used to determine a fraud-related account from the multiple suspicious accounts based on the fraud-related risk prediction value of each of the suspicious accounts.

8. The device according to claim 7, characterized in that For the first relationship subgraph corresponding to the first relationship link type, the construction module is specifically used to: Based on the bank account information, the relationship link of the first relationship link type is extended with the i-th newly added account node set as the starting point to obtain the i+1-th extended relationship link data set; wherein i is an integer, and when i=0, the i-th newly added account node set only includes the account nodes corresponding to each of the multiple blacklist accounts; the i+1-th extended relationship link data set includes the starting point account node and the end point account node of the i+1-th newly added relationship link, and the link feature information of the i+1-th newly added relationship link; the link feature information includes the starting point feature information and the end point feature information of the relationship link, and the relationship feature information between the account nodes involved; Inputting the link feature information of each of the i+1th newly added relationship links into the first link model corresponding to the first relationship link type, and obtaining the link risk prediction result output by the first link model; the first link model is trained based on the link feature information sample corresponding to the first relationship link type and its corresponding risk link label; Based on the link risk prediction result, determining the i+1th risk relationship link from the i+1th newly added relationship link; Based on the starting account node and the end account node of the i+1th risk relationship link, and the account feature information of the account nodes involved in the i+1th risk relationship link, the i-th extended relationship subgraph is updated to obtain the i+1th extended relationship subgraph; wherein, when i=0, the i-th extended relationship subgraph only includes the account nodes corresponding to each of the multiple blacklist accounts; Determine the i+1th newly added account node set in the i+1th extended relationship subgraph, set i to i+1, continue to expand until the number of expansions reaches a preset expansion number threshold, and determine the i+1th extended relationship subgraph as the first relationship subgraph.

9. The device according to claim 8, characterized in that The device further comprises a first training module; the first training module is used for: Obtaining first bank account information and a first blacklist account set within a first historical time period; Based on the first bank account information and the first blacklist account set, a heterogeneous relationship graph is constructed; wherein the heterogeneous relationship graph includes account nodes, other types of nodes, relationship edges between nodes, and feature information of nodes and feature information of edges; Based on the heterogeneous relationship graph, determine a relationship link set corresponding to the first relationship link type, and based on the heterogeneous relationship graph, determine link feature information of multiple relationship links in the relationship link set, and determine the blacklist type corresponding to the terminal account node of each of the multiple relationship links; Determine the link feature information of each of the multiple relationship links as the link feature information sample, and determine the risk link label corresponding to the link feature information sample based on the blacklist type; Based on the link feature information samples and their corresponding link risk labels, an initial link model is trained to obtain the first link model.

10. The device according to claim 8, characterized in that The device further comprises a second training module; the second training module is used for: Obtaining second bank account information and a second blacklist account set within a second historical time period; Based on the second bank account information and the link model corresponding to each relationship link type, construct multiple second relationship subgraphs starting from the second blacklist account set; each second relationship subgraph corresponds to a relationship link type; Determine a subgraph account node sample set corresponding to each of the second relationship subgraphs; The subgraph account node sample set includes a plurality of first account nodes, and account feature information and subgraph feature information of each of the first account nodes; the plurality of first account nodes are other account nodes in the second relationship subgraph except the account nodes corresponding to the second blacklist account set; fusing the subgraph account node sample sets of the respective second relationship subgraphs to obtain fused feature information corresponding to the respective first account nodes, and determining the fused feature information corresponding to the respective first account nodes as the suspicious account feature information sample; Determine the fraud-related risk label corresponding to the suspicious account feature information sample, and train an initial fraud-related risk prediction model based on the suspicious account feature information sample and its corresponding fraud-related risk label to obtain the fraud-related risk prediction model.

Images