Data processing method, device and equipment

Abstract

The embodiment of the invention provides a data processing method, device and equipment, and the method comprises the steps: receiving a risk detection request for a target object; in response to the risk detection request, obtaining target graph structure data corresponding to the target object, the target graph structure data including target nodes corresponding to the target object and edges between the nodes determined based on a resource transfer relationship of the target object; based on a first node having a preset association relationship with the target node in the target graph structure data, determining a detection rule used for carrying out risk detection on the target object; obtaining sub-graph data corresponding to the detection rule in the target graph structure data, and determining risk feature information corresponding to the detection rule based on attribute features of nodes included in the sub-graph data and a connection relationship between the nodes; and based on the risk feature information, determining whether the target object has a resource transfer risk.

Description

Technical Field

[0001] This document relates to the field of data processing technology, and in particular to a data processing method, device and equipment. Background Art

[0002] With the rapid development of the Internet industry, the types and quantity of business services provided by network operators to users are increasing. How to conduct risk detection on users' use of business services in order to better provide business services to users (such as detecting whether there is a risk when users trigger resource transfer services to protect users' privacy data from being leaked, etc.) has become the focus of network operators.

[0003] When performing risk detection on users' use of business services, risk detection can be performed on data related to users' use of business services according to manually set risk detection rules to determine whether there are risks in users' use of business services. However, due to the increasing number of business services, risk detection using manually set risk detection rules has low efficiency and accuracy in determining risk detection rules, resulting in an inability to quickly and accurately detect whether there are risks in users' use of business services. Therefore, a solution is needed that can improve the efficiency and accuracy of risk detection by improving the efficiency and accuracy of risk detection rules. Summary of the invention

[0004] The purpose of the embodiments of this specification is to provide a solution that can improve the efficiency and accuracy of risk detection by improving the efficiency and accuracy of determining risk detection rules.

[0005] In order to implement the above technical solution, the embodiments of this specification are implemented as follows: In a first aspect, an embodiment of the present specification provides a data processing method, comprising: receiving a risk detection request for a target object; in response to the risk detection request, obtaining target graph structure data corresponding to the target object, the target graph structure data comprising a target node corresponding to the target object, and edges between nodes determined based on a resource transfer relationship of the target object; determining a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node; obtaining subgraph data corresponding to the detection rule in the target graph structure data, and determining risk feature information corresponding to the detection rule based on attribute features of the nodes contained in the subgraph data and connection relationships between the nodes; and determining whether the target object has a resource transfer risk based on the risk feature information.

[0006] In a second aspect, an embodiment of the present specification provides a data processing device, the device comprising: a request receiving module, used to receive a risk detection request for a target object; a first acquisition module, used to respond to the risk detection request and acquire target graph structure data corresponding to the target object, the target graph structure data including a target node corresponding to the target object and edges between nodes determined based on a resource transfer relationship of the target object; a rule determination module, used to determine a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node; a second acquisition module, used to acquire subgraph data corresponding to the detection rule in the target graph structure data, and determine risk feature information corresponding to the detection rule based on attribute features of the nodes contained in the subgraph data and connection relationships between the nodes; a risk detection module, used to determine whether the target object has a resource transfer risk based on the risk feature information.

[0007] In a third aspect, an embodiment of the present specification provides a data processing device, comprising: a processor; and a memory arranged to store computer-executable instructions, wherein the executable instructions, when executed, cause the processor to: receive a risk detection request for a target object; in response to the risk detection request, obtain target graph structure data corresponding to the target object, the target graph structure data comprising a target node corresponding to the target object, and edges between nodes determined based on a resource transfer relationship of the target object; based on a first node in the target graph structure data that has a preset association relationship with the target node, determine a detection rule for performing risk detection on the target object; obtain subgraph data corresponding to the detection rule in the target graph structure data, and determine risk feature information corresponding to the detection rule based on attribute features of the nodes contained in the subgraph data and connection relationships between the nodes; based on the risk feature information, determine whether the target object has a resource transfer risk.

[0008] In a fourth aspect, an embodiment of the present specification provides a storage medium, wherein the storage medium is used to store computer-executable instructions, and the executable instructions implement the following process when executed: receiving a risk detection request for a target object; in response to the risk detection request, obtaining target graph structure data corresponding to the target object, wherein the target graph structure data includes a target node corresponding to the target object, and edges between nodes determined based on a resource transfer relationship of the target object; determining a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node; obtaining subgraph data corresponding to the detection rule in the target graph structure data, and determining risk feature information corresponding to the detection rule based on attribute features of the nodes contained in the subgraph data and connection relationships between the nodes; and determining whether the target object has a resource transfer risk based on the risk feature information. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0010] Figure 1 A schematic diagram of a data processing system for this specification; Figure 2A A flowchart of a data processing method embodiment of this specification; Figure 2B A schematic diagram of a processing process of a data processing method in this specification; Figure 3 A schematic diagram of a target graph structure data of this specification; Figure 4 A processing diagram of another data processing method of the present specification; Figure 5 A schematic diagram of another target graph structure data of this specification; Figure 6 This is a schematic diagram of the field correspondence relationship in this specification; Figure 7 A schematic diagram of a sub-graph data of this specification; Figure 8 A schematic diagram of another sub-graph data of this specification; Fig. 9 A schematic diagram of another sub-graph data of this specification; Fig.10A schematic diagram of the structure of a data processing device according to an embodiment of the present specification; Fig.11 This is a structural schematic diagram of a data processing device in this specification. DETAILED DESCRIPTION

[0011] The embodiments of this specification provide a data processing method, device and equipment.

[0012] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0013] The technical solution of this specification can be applied to data processing systems, such as Figure 1 As shown, the data processing system may include terminal devices and servers, wherein the server may be an independent server or a server cluster composed of multiple servers, and the terminal device may be a device such as a personal computer or a mobile terminal device such as a mobile phone or a tablet computer.

[0014] The data processing system may include n terminal devices and m servers, where n and m are positive integers greater than or equal to 1. The server may be a background server of an application, and the terminal device may be a client device of the application. The application may be an application that can provide resource transfer services to users.

[0015] The user may trigger the execution of a resource transfer service in a terminal device. Upon receiving the user triggering the execution of a resource transfer service, the terminal device may determine the user or the resource transfer service as a target object and send a risk detection request for the target object to the server.

[0016] In response to the risk detection request, the server may obtain the target graph structure data corresponding to the target object, and determine the detection rule for risk detection of the target object based on the first node in the target graph structure data that has a preset association relationship with the target node. Then, the server may obtain the subgraph data corresponding to the detection rule in the target graph structure data, and determine the risk feature information corresponding to the detection rule based on the attribute features of the nodes contained in the subgraph data and the connection relationship between the nodes. Finally, the server may determine whether the target object has a resource transfer risk based on the risk feature information.

[0017] The server may obtain multiple data tables related to the target object, and construct target graph structure data corresponding to the target object according to the multiple data tables.

[0018] In addition, in Figure 1 In the data processing system shown, different servers can be background servers for different applications, that is, different servers can be used to process different services. For example, server 2 can be a background server for an instant messaging application, that is, server 2 can provide users with instant messaging services and resource transfer services, etc. Server 3 can be a resource transfer account management application, that is, server 3 can provide users with resource transfer account management services (such as creation and cancellation of resource transfer accounts) and resource transfer services, etc.

[0019] In this way, data tables related to the target object can be stored in different servers, that is, when the server receives a risk detection request, it can obtain the data table related to the target object in the locally stored data table according to the object identifier of the target object. The server can also send the object identifier of the target object to other servers in the data processing system, so that the other servers can obtain the data table related to the target object in the locally stored data table according to the object identifier of the target object, and return the obtained data table to the server.

[0020] In addition, in order to improve the business processing efficiency, the data processing system may also include a central server for determining the target graph structure data corresponding to the target object, for example, Figure 1 In the data processing system shown, server 1 can be a central server. That is, when other servers receive risk detection requests for target objects, other servers can send the identifier of the target object to the central server (i.e., server 1). Then, server 1 can obtain multiple data tables related to the target object based on the identifier of the target object, wherein the multiple data tables can be obtained by server 1 from local, other servers, and terminal devices. In this way, business interruptions caused by the need for the server to generate target graph structure data can be avoided, thereby improving business processing efficiency and user satisfaction.

[0021] The data processing method in the following embodiments can be implemented based on the above data processing system structure.

[0022] Embodiment 1 like Figure 2A and Figure 2B As shown, the embodiment of this specification provides a data processing method, and the execution subject of the method can be a server, wherein the server can be an independent server or a server cluster composed of multiple servers. The method can specifically include the following steps: In S202, a risk detection request for a target object is received.

[0023] Among them, the target object can be any object that may have resource transfer risks, such as user objects, business objects, account objects, etc., that is, the server can detect whether the user is a user with resource transfer risks, and can also detect whether the resource transfer business triggered by the user has resource transfer risks, and can also detect whether a certain account is an account with resource transfer risks.

[0024] In implementation, with the rapid development of the Internet industry, the types and quantity of business services provided by network operators to users are increasing. How to perform risk detection on users' use of business services to better provide business services to users (such as detecting whether there is a risk when users trigger the execution of resource transfer services to protect the user's privacy data from being leaked, etc.) has become the focus of network operators. When performing risk detection on users' use of business services, risk detection can be performed on data related to users' use of business services according to manually set risk detection rules to determine whether there is a risk in users' use of business services. However, due to the increasing number of types of business services, risk detection is performed through manually set risk detection rules (or converted from preset regulatory rules, expert experience, and events that have occurred). The risk detection rules have low efficiency and accuracy in determining risk detection rules, resulting in the inability to quickly and accurately detect whether there is a risk in users' use of business services. Therefore, a solution that can improve the efficiency and accuracy of risk detection by improving the determination efficiency and accuracy of risk detection rules is needed. To this end, the embodiment of this specification provides a technical solution that can solve the above-mentioned problem, and the specific content can be referred to as follows.

[0025] The user can trigger the start of the resource transfer service through the resource transfer application installed in the terminal device. That is, when the terminal device detects that the user triggers the start of the resource transfer service through a resource transfer application, the terminal device can determine the user as the target object and send a risk detection request for the target object to the server.

[0026] In addition, the terminal device may also determine the resource transfer service, the resource transfer object, the resource transfer account used by the user, etc. as the target object to be detected.

[0027] In S204, in response to the risk detection request, target graph structure data corresponding to the target object is acquired.

[0028] The target graph structure data may include target nodes corresponding to the target object, and edges between the nodes determined based on the resource transfer relationship of the target object.

[0029] In implementation, the risk detection request may include the object identifier of the target object, and the server may obtain the historical business data corresponding to the target object according to the object identifier. The historical business data may include any business data corresponding to the target object, such as historical resource transfer data and historical instant messaging data corresponding to the target object within a preset detection period. The server may determine the target graph structure data corresponding to the target object according to the obtained historical business data.

[0030] Specifically, taking the target object as a user who triggers the resource transfer service as an example, the server can obtain the historical service data corresponding to the user within a preset detection period based on the user's user representation, and determine the target graph structure data based on the obtained historical service data.

[0031] Here, taking the historical business data including the historical resource transfer data triggered by the user as an example, assuming that the historical resource transfer data is that the user transferred 100 resources to user 2 at time 1, 200 resources to user 3 at time 2, and 150 resources to user 3 at time 3. Then, the server can construct the nodes included in the target graph structure data based on the user, user 2, and user 3, and determine the edges between the nodes in the target graph structure data according to the resource transfer relationship between user 1, user 2, and user 3.

[0032] In addition, the above-mentioned method for determining the target graph structure data is an optional and feasible determination method. In actual application scenarios, there may be a variety of different determination methods. Different determination methods can be selected according to different actual application scenarios. The embodiments of this specification do not make specific limitations on this.

[0033] In S206, based on the first node in the target graph structure data that has a preset association relationship with the target node, a detection rule for performing risk detection on the target object is determined.

[0034] The preset association relationship may be a resource transfer relationship, an instant messaging relationship, an information recommendation relationship, a preset corresponding relationship, or the like, and the first node may be one or more nodes that have a direct or indirect association relationship with the target node.

[0035] In implementation, taking the preset association relationship as the preset corresponding relationship as an example, assuming that the target node is a node corresponding to the user, the first node may include a first node 1 corresponding to the address, and a first node 2 corresponding to the account, that is, the user has a preset corresponding relationship with the address and the account respectively. The server may determine a detection rule for risk detection of the target object based on the first node 1 and / or the first node 2.

[0036] Among them, when determining the detection rule, the server can determine the corresponding detection rule according to the association relationship between the first node and other nodes. For example, taking the above-mentioned first node including the first node 1 corresponding to the address and the first node 2 corresponding to the account as an example, assuming that the first node also has an association relationship with other user nodes, then the detection rule 1 determined for the first node 1 can be to determine the number of different users corresponding to the address, and assuming that the first node 2 also has an association relationship with other account nodes, then the detection rule 2 determined for the first node 2 can be to determine the number of different users corresponding to the account.

[0037] In addition, the above-mentioned method for determining the detection rules is an optional and feasible determination method. In actual application scenarios, there may be a variety of different determination methods. Different determination methods can be selected according to different actual application scenarios. The embodiments of this specification do not make specific limitations on this.

[0038] In S208, subgraph data corresponding to the detection rule in the target graph structure data is obtained, and based on the attribute characteristics of the nodes contained in the subgraph data and the connection relationship between the nodes, the risk feature information corresponding to the detection rule is determined.

[0039] In implementation, the server may extract subgraph data corresponding to the detection rule from the target graph structure data. For example, assuming that the target node is a node corresponding to a user, the first node may include a first node corresponding to an address, and the detection rule may be to determine the number of risky users corresponding to the address, where Figure 3 As shown, the first node may include a first node a corresponding to address 1, and a first node b corresponding to address 2.

[0040] According to the detection rule, subgraph data corresponding to each first node can be generated based on the user node that has a connection relationship with each first node in the target graph structure data. Figure 3 As shown, subgraph data 1 corresponding to the first node a, and subgraph data 2 corresponding to the first node b can be obtained respectively.

[0041] The server may determine the risk characteristic information corresponding to each sub-graph data according to the sub-graph data and the detection rules, and then determine the risk characteristic information corresponding to the detection rules according to the risk characteristic information corresponding to each sub-graph data.

[0042] When the detection rule is to determine the number of risky users corresponding to an address, the number 1 of risky users corresponding to the first node a can be determined based on the risk label in the attribute characteristics of the user node in subgraph data 1, and the number 2 of risky users corresponding to the first node b can be determined based on the number of user nodes in subgraph data 2. Based on number 1 and number 2, the risk characteristic information corresponding to the detection rule can be determined.

[0043] In addition, the subgraph data may also correspond to multiple detection rules, and the risk characteristic information corresponding to each subgraph data may be determined based on the multiple detection rules. For example, the detection rule may also be to determine the number of different users corresponding to the address. Then, based on the detection rule and the number of user nodes in the subgraph data 1 that are connected to the first node a, the number 3 corresponding to the detection rule may be determined, and based on the number of user nodes in the subgraph data 2 that are connected to the first node b, the number 4 corresponding to the detection rule may be determined. Finally, the risk characteristic information corresponding to the detection rule may be determined based on the number 5 determined based on the number 1 and the number 2, and based on the number 3 and the number 4 determined based on the number 4.

[0044] Among them, Figure 3 As shown, a computing node carrying an operator (such as an average operator, a maximum operator, a minimum operator, etc.) can be set, and the risk feature information corresponding to the detection rule can be determined through the computing node and the risk feature information corresponding to each sub-graph data.

[0045] In addition, there may be multiple computing nodes carrying different operators, and the risk feature information corresponding to each subgraph data may be processed according to different computing nodes, and the risk feature information corresponding to the detection rule may be determined according to the calculation result of each computing node.

[0046] The above-mentioned method for determining sub-graph data and risk characteristic information is an optional and feasible determination method. In actual application scenarios, there may be a variety of different determination methods. Different determination methods can be selected according to different actual application scenarios. The embodiments of this specification do not make specific limitations on this.

[0047] In S210, based on the risk characteristic information, it is determined whether the target object has a resource transfer risk.

[0048] In implementation, the server can determine whether the target object has a resource transfer risk based on historical risk data and risk feature information. For example, assuming that the risk feature information is the number of risky users corresponding to the address of the object to be detected, then the number of risky users corresponding to the address with risk can be determined based on the historical risk data, and a quantity threshold can be determined based on the number. In this way, it can be determined whether the target object has a resource transfer risk based on the quantity threshold and the risk feature information.

[0049] In addition, there may be multiple methods for determining the risk of resource transfer. For example, the server may also obtain the weight corresponding to each risk feature information, and determine the risk value corresponding to the target object based on each risk feature information and the weight, and then determine whether the target object has a resource transfer risk based on the risk value. In addition to this, there may be multiple different determination methods, and different determination methods may be selected according to different actual application scenarios. The embodiments of this specification do not specifically limit this.

[0050] The embodiment of the present specification provides a data processing method, which receives a risk detection request for a target object, responds to the risk detection request, obtains target graph structure data corresponding to the target object, the target graph structure data includes a target node corresponding to the target object, and an edge between nodes determined based on a resource transfer relationship of the target object, determines a detection rule for risk detection of the target object based on a first node in the target graph structure data that has a preset association relationship with the target node, obtains subgraph data corresponding to the detection rule in the target graph structure data, and determines risk feature information corresponding to the detection rule based on the attribute features of the nodes contained in the subgraph data and the connection relationship between the nodes, and determines whether the target object has a resource transfer risk based on the risk feature information. In this way, the detection rule can be quickly and accurately determined through the first node in the target graph structure data that has a preset association relationship with the target node, avoiding the problem of poor determination efficiency and accuracy of the risk detection rule by manually setting the detection rule, and then can be determined whether the target object has a resource transfer risk through the risk feature information determined by the detection rule and the subgraph data, thereby improving the efficiency and accuracy of risk detection.

[0051] Embodiment 2 like Figure 4 As shown, the embodiment of this specification provides a data processing method, and the execution subject of the method can be a server, wherein the server can be an independent server or a server cluster composed of multiple servers. The method can specifically include the following steps: In S202, a risk detection request for a target object is received.

[0052] In S402, multiple data tables related to the target object are obtained.

[0053] In implementation, the server can obtain a first data table including the target object based on the object identifier of the target object, and then the server can extract other fields included in the first data table and obtain a second data table including the other fields to determine multiple data tables related to the target object based on the first data table and the second data table.

[0054] For example, assuming that the target object is user 1, the server may obtain a first data table 1 including the user identifier of user 1. Assume that the first data table 1 is a user table as shown in Table 1 below, and a transaction table as shown in Table 2 below.

[0055] Table 1

[0056] Table 2

[0057] The server can determine the second data table according to the account identification field, transaction identification field and IP address field included in the above user table and transaction table. For example, the second data table determined according to the above account identification field can be the customer table shown in Table 3 below.

[0058] Table 3

[0059] In addition, there may be multiple methods for determining multiple data tables related to the target object. For example, the server may obtain a first data table including an object identifier of the target object. Then, the server may determine a third data table based on the identifier of the field in the first data table that corresponds to the object identifier of the target object, and the object identifiers of other objects in the first data table that correspond to the field. Finally, the server may determine multiple data tables related to the target object based on the first data table and the third data table. In addition to this, there may be multiple different determination methods, and different determination methods may be selected according to different actual application scenarios. The embodiments of this specification do not specifically limit this.

[0060] In S404, object features in the data table and attribute features corresponding to each object feature are extracted.

[0061] In S406, nodes in the target graph structure data are constructed according to the object features, and attribute features of the nodes in the target graph structure data are determined according to the attribute features corresponding to the object features.

[0062] In S408, the association relationship between the object features is determined according to the association relationship between the multiple data tables, and the connection relationship between the nodes in the target graph structure data is determined according to the association relationship between the object features.

[0063] In implementation, after performing data analysis on multiple data tables, the server can identify the primary key fields (i.e., object characteristics), attribute fields (i.e., attribute characteristics), and the relationship between data tables, and then construct a connection graph based on the identified primary key fields, associate the attribute fields with the corresponding primary key fields, and determine the connection relationship between the nodes in the connection graph based on the relationship between the data tables to obtain the target graph structure data.

[0064] For example, the target graph structure data constructed based on Table 1, Table 2 and Table 3 can be as follows: Figure 5 In addition, Figure 6 As shown, there can be multiple correspondences between nodes in the target graph structure data, such as a many-to-many correspondence between user identification and account identification (i.e., M user identifications can correspond to N account identifications), a many-to-one correspondence between account identification and transaction card identification (i.e., N user identifications can correspond to one transaction card identification), etc.

[0065] In S204, in response to the risk detection request, target graph structure data corresponding to the target object is acquired.

[0066] The target graph structure data may include target nodes corresponding to the target object, and edges between the nodes determined based on the resource transfer relationship of the target object.

[0067] In addition, the first node may include a first child node that has a connection relationship with the target node, and a second child node that has a connection relationship with the first child node.

[0068] In S410, the attribute characteristics of the first child node and the attribute characteristics of the second child node are obtained.

[0069] In S412, based on one or more of the first subnode, the second subnode, the attribute feature of the first subnode, and the attribute feature of the second subnode, a detection rule for performing risk detection on the target object is determined.

[0070] In implementation, it is assumed that the target node is the node corresponding to user 1, the first child node is the account node corresponding to user 1, and the second child node is a transaction node with the account node. According to the transaction table shown in Table 2 above, it can be determined that the attribute characteristics of the transaction node may include the transaction amount and transaction method.

[0071] According to the attribute characteristics of the transaction node, the generated detection rules may include detection rule 1 for determining the number of transactions conducted by each transaction card corresponding to user 1 through transaction method 1, detection rule 2 for determining the number of other users corresponding to each transaction card corresponding to user 1, and detection rule 3 for determining the number of IP addresses corresponding to each transaction card corresponding to user 1, etc.

[0072] In addition, in practical applications, the processing methods of the above S412 can be various. An optional implementation method is provided below. For details, please refer to the following step 1: Step 1: Generate a model according to pre-trained rules, and determine a detection rule for risk detection of a target object based on one or more of the first subnode, the second subnode, the attribute feature of the first subnode, and the attribute feature of the second subnode.

[0073] Among them, the rule generation model can be a model for generating detection rules built based on a preset machine learning algorithm.

[0074] In implementation, the server may input the first subnode, the second subnode, the attribute features of the first subnode, and the attribute features of the second subnode into a pre-trained rule generation model to obtain a detection rule for performing risk detection on the target object.

[0075] Alternatively, the server may also combine the first subnode, the second subnode, the attribute features of the first subnode and the attribute features of the second subnode to obtain multiple data combinations, and input the multiple data combinations into a pre-trained rule generation model to obtain detection rules corresponding to each data combination.

[0076] In S414, node information corresponding to the detection rule is obtained, and subgraph data corresponding to the detection rule in the target graph structure data is determined according to the node information.

[0077] In implementation, for example, assuming that the detection rules include detection rule 1 for determining the number of transactions conducted by each transaction card corresponding to user 1 through different transaction methods, detection rule 2 for determining the number of other users corresponding to each transaction card corresponding to user 1, and detection rule 3 for determining the number of IP addresses corresponding to each transaction card corresponding to user 1, then the server can respectively obtain node information corresponding to the three detection rules, and determine, based on the determined node information, Figure 7 The sub-graph data 1 corresponding to the detection rule 1 is shown as Figure 8 The sub-graph data 2 corresponding to the detection rule 2 shown in FIG. Fig. 9 Sub-graph data 3 corresponding to detection rule 3 is shown.

[0078] In S416, the target attribute feature corresponding to the detection rule is obtained from the attribute features corresponding to each node included in the subgraph data.

[0079] In S418, risk feature information corresponding to the detection rule is determined based on the connection relationship between the nodes contained in the subgraph data and the target attribute feature corresponding to each node.

[0080] In implementation, the server may determine the risk feature information corresponding to the detection rule based on the connection relationship between nodes contained in the subgraph data and the target attribute feature corresponding to each node by means of message broadcasting.

[0081] For example, the server can determine the inspiration node based on the connection relationship between nodes in the subgraph data, and start sending messages from the starting node, broadcasting the feature values ​​of the target attribute features that need to be calculated along the outgoing direction. If the attribute features of a certain node are target attribute features that meet the feature calculation filtering conditions (i.e., detection rules), the message aggregation processing is performed at this node. In this way, the server can perform feature calculations through operators on this node (such as aggregation operators, deduplication aggregation operators, minimum operators, maximum operators, etc.), and store the calculated feature values ​​in the structure Map<feature, feature value>.

[0082] Then, the server can continue to iterate the message broadcast along the outgoing direction of the node, send it to the next node that has a connection relationship with the node, complete the message aggregation at the next node, and continue to perform statistical feature calculations through the operators in the node. The calculated feature values ​​are stored in the structure Map<feature, feature value>.

[0083] In this way, the server can construct attribute information composed of target attribute features on the edges between nodes in the subgraph data. When broadcasting messages, it can transmit messages to features that meet the feature calculation filter conditions to complete feature calculation and obtain risk feature information.

[0084] In practical applications, the processing method of the above S418 can be various. The following provides an optional implementation method. For details, please refer to the following step 1: Step 1: Based on the connection relationship between the nodes contained in the subgraph data, as well as the target attribute characteristics and risk weight corresponding to each node, determine the risk characteristic information corresponding to the detection rule.

[0085] Among them, the risk weight can be determined according to the number of nodes that have a connection relationship with each node.

[0086] In implementation, when a node is transmitting a message, it can perform weighted processing on the characteristic information transmitted to the node according to the risk weight corresponding to the node at each node, and continue to transmit the message along the connection relationship between the nodes with the processed characteristic information.

[0087] In this way, the server can convert the association relationships in the relational database into points and edges of the graph, and start sending messages from the starting node on the constructed graph structure data, complete the message accumulation at the ending node along the message propagation path, and perform corresponding processing on the accumulated messages to complete the message broadcasting process of the graph structure data and obtain the risk feature information corresponding to the detection rules.

[0088] On the one hand, based on the above distributed graph computing framework, it can not only process large-scale graph data in the field of Internet finance that exceeds the capabilities of a single machine, but also complete high-dimensional and high-complexity feature calculations, and maintain good scalability under different workloads and increasing data volumes. On the other hand, feature calculations are performed through message broadcasting, and this model can be reused in different business scenarios and has strong versatility.

[0089] In S420, according to the pre-trained risk detection model, based on the risk feature information, the risk type corresponding to the target object is determined.

[0090] Among them, the risk detection model can be a model built based on a preset tree structure algorithm for determining the risk type, and the risk type can include multiple risk types such as high risk, medium risk, low risk, and no risk.

[0091] In S422, according to the risk type of the target object, it is determined whether the target object has a resource transfer risk.

[0092] During implementation, when the server determines that the target object has a resource transfer risk based on the risk type of the target object, it can suspend processing the resource transfer business related to the target object and send the resource transfer data related to the target object to the preset management party, so that the preset management party can determine whether to continue processing the resource transfer business related to the target object based on the resource transfer data related to the target object and the risk type of the target object.

[0093] The embodiment of the present specification provides a data processing method, which receives a risk detection request for a target object, responds to the risk detection request, obtains target graph structure data corresponding to the target object, the target graph structure data includes a target node corresponding to the target object, and an edge between nodes determined based on a resource transfer relationship of the target object, determines a detection rule for risk detection of the target object based on a first node in the target graph structure data that has a preset association relationship with the target node, obtains subgraph data corresponding to the detection rule in the target graph structure data, and determines risk feature information corresponding to the detection rule based on the attribute features of the nodes contained in the subgraph data and the connection relationship between the nodes, and determines whether the target object has a resource transfer risk based on the risk feature information. In this way, the detection rule can be quickly and accurately determined through the first node in the target graph structure data that has a preset association relationship with the target node, avoiding the problem of poor determination efficiency and accuracy of the risk detection rule by manually setting the detection rule, and then can be determined whether the target object has a resource transfer risk through the risk feature information determined by the detection rule and the subgraph data, thereby improving the efficiency and accuracy of risk detection.

[0094] Embodiment 3 The above is a data processing method provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a data processing device, such as Fig.10 shown.

[0095] The data processing device includes: a request receiving module 1001, a first obtaining module 1002, a rule determining module 1003, a second obtaining module 1004 and a risk detection module 1005, wherein: The request receiving module 1001 is used to receive a risk detection request for a target object; A first acquisition module 1002 is used to acquire target graph structure data corresponding to the target object in response to the risk detection request, wherein the target graph structure data includes target nodes corresponding to the target object and edges between nodes determined based on a resource transfer relationship of the target object; A rule determination module 1003, configured to determine a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node; The second acquisition module 1004 is used to acquire subgraph data corresponding to the detection rule in the target graph structure data, and determine risk feature information corresponding to the detection rule based on attribute features of nodes contained in the subgraph data and connection relationships between nodes; The risk detection module 1005 is used to determine whether the target object has a resource transfer risk based on the risk characteristic information.

[0096] In the embodiment of this specification, the device further includes: A third acquisition module, used to acquire multiple data tables related to the target object; A feature extraction module, used to extract object features in the data table and attribute features corresponding to each of the object features; A node construction module, used to construct nodes in the target graph structure data according to the object features, and determine the attribute features of the nodes in the target graph structure data according to the attribute features corresponding to the object features; The relationship building module is used to determine the association relationship between the object features according to the association relationship between the multiple data tables, and determine the connection relationship between the nodes in the target graph structure data according to the association relationship between the object features.

[0097] In the embodiment of this specification, the first node includes a first child node connected to the target node, and a second child node connected to the first child node, and the rule determination module 1003 is used to: Acquire the attribute characteristics of the first child node and the attribute characteristics of the second child node; Based on one or more of the first sub-node, the second sub-node, an attribute feature of the first sub-node, and an attribute feature of the second sub-node, a detection rule for performing risk detection on the target object is determined.

[0098] In an embodiment of the present specification, the rule determination module 1003 is used to: determine a detection rule for risk detection on the target object based on a pre-trained rule generation model, based on one or more of the first sub-node, the second sub-node, the attribute characteristics of the first sub-node, and the attribute characteristics of the second sub-node, wherein the rule generation model is a model for generating detection rules that is constructed based on a preset machine learning algorithm.

[0099] In the embodiment of this specification, the second acquisition module 1004 is used to: Node information corresponding to the detection rule is obtained, and subgraph data corresponding to the detection rule in the target graph structure data is determined according to the node information.

[0100] In the embodiment of this specification, the second acquisition module 1004 is used to: Obtaining a target attribute feature corresponding to the detection rule from the attribute features corresponding to each node contained in the subgraph data; Based on the connection relationship between the nodes contained in the subgraph data and the target attribute feature corresponding to each node, the risk feature information corresponding to the detection rule is determined.

[0101] In the embodiment of this specification, the second acquisition module 1004 is used to Based on the connection relationship between the nodes contained in the subgraph data, and the target attribute characteristics and risk weight corresponding to each of the nodes, the risk characteristic information corresponding to the detection rule is determined.

[0102] In the embodiment of this specification, the risk detection module 1005 is used to: According to a pre-trained risk detection model, based on the risk feature information, the risk type corresponding to the target object is determined, wherein the risk detection model is a model for determining the risk type constructed based on a preset tree structure algorithm; According to the risk type of the target object, it is determined whether the target object has a resource transfer risk.

[0103] The embodiment of the present specification provides a data processing device, which receives a risk detection request for a target object, responds to the risk detection request, obtains target graph structure data corresponding to the target object, the target graph structure data includes a target node corresponding to the target object, and an edge between nodes determined based on a resource transfer relationship of the target object, determines a detection rule for risk detection of the target object based on a first node in the target graph structure data that has a preset association relationship with the target node, obtains subgraph data corresponding to the detection rule in the target graph structure data, and determines risk feature information corresponding to the detection rule based on the attribute features of the nodes included in the subgraph data and the connection relationship between the nodes, and determines whether the target object has a resource transfer risk based on the risk feature information. In this way, the detection rule can be quickly and accurately determined through the first node in the target graph structure data that has a preset association relationship with the target node, avoiding the problem of poor determination efficiency and accuracy of the risk detection rule by manually setting the detection rule, and then can determine whether the target object has a resource transfer risk through the risk feature information determined by the detection rule and the subgraph data, thereby improving the efficiency and accuracy of risk detection.

[0104] Embodiment 4 Based on the same idea, the embodiment of this specification also provides a data processing device, such as Fig.11 shown.

[0105] The data processing device may have relatively large differences due to different configurations or performances, and may include one or more processors 1101 and memory 1102, and the memory 1102 may store one or more storage applications or data. Among them, the memory 1102 may be a short-term storage or a persistent storage. The application stored in the memory 1102 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the data processing device. Furthermore, the processor 1101 may be configured to communicate with the memory 1102 and execute a series of computer executable instructions in the memory 1102 on the data processing device. The data processing device may also include one or more power supplies 1103, one or more wired or wireless network interfaces 1104, one or more input and output interfaces 1105, and one or more keyboards 1106.

[0106] Specifically in this embodiment, the data processing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the data processing device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following: Receiving a risk detection request for a target object; In response to the risk detection request, acquiring target graph structure data corresponding to the target object, the target graph structure data including target nodes corresponding to the target object and edges between nodes determined based on a resource transfer relationship of the target object; Determining a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node; Acquire subgraph data corresponding to the detection rule in the target graph structure data, and determine risk feature information corresponding to the detection rule based on attribute features of nodes contained in the subgraph data and connection relationships between nodes; Based on the risk characteristic information, determine whether the target object has a resource transfer risk.

[0107] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the data processing device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0108] The embodiment of the present specification provides a data processing device, which receives a risk detection request for a target object, responds to the risk detection request, obtains target graph structure data corresponding to the target object, the target graph structure data includes a target node corresponding to the target object, and an edge between nodes determined based on a resource transfer relationship of the target object, determines a detection rule for risk detection of the target object based on a first node in the target graph structure data that has a preset association relationship with the target node, obtains subgraph data corresponding to the detection rule in the target graph structure data, and determines risk feature information corresponding to the detection rule based on the attribute features of the nodes included in the subgraph data and the connection relationship between the nodes, and determines whether the target object has a resource transfer risk based on the risk feature information. In this way, the detection rule can be quickly and accurately determined through the first node in the target graph structure data that has a preset association relationship with the target node, avoiding the problem of poor determination efficiency and accuracy of the risk detection rule by manually setting the detection rule, and then can determine whether the target object has a resource transfer risk through the risk feature information determined by the detection rule and the subgraph data, thereby improving the efficiency and accuracy of risk detection.

[0109] Embodiment 5 The embodiments of this specification also provide a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned data processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0110] The embodiment of the present specification provides a computer-readable storage medium, which receives a risk detection request for a target object, responds to the risk detection request, obtains target graph structure data corresponding to the target object, the target graph structure data includes a target node corresponding to the target object, and an edge between nodes determined based on a resource transfer relationship of the target object, determines a detection rule for risk detection of the target object based on a first node in the target graph structure data that has a preset association relationship with the target node, obtains subgraph data corresponding to the detection rule in the target graph structure data, and determines risk feature information corresponding to the detection rule based on the attribute features of the nodes included in the subgraph data and the connection relationship between the nodes, and determines whether the target object has a resource transfer risk based on the risk feature information. In this way, the detection rule can be quickly and accurately determined through the first node in the target graph structure data that has a preset association relationship with the target node, avoiding the problem of poor efficiency and accuracy in determining the risk detection rule by manually setting the detection rule, and then can be determined whether the target object has a resource transfer risk through the risk feature information determined by the detection rule and the subgraph data, thereby improving the efficiency and accuracy of risk detection.

[0111] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0112] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0113] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0114] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0115] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0116] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0117] The embodiments of this specification are described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0118] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0119] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0120] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0121] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0122] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0123] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0124] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, one or more embodiments of this specification may be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0125] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0126] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0127] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A data processing method, comprising: Receiving a risk detection request for a target object; In response to the risk detection request, acquiring target graph structure data corresponding to the target object, the target graph structure data including target nodes corresponding to the target object and edges between nodes determined based on a resource transfer relationship of the target object; Determining a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node; Acquire subgraph data corresponding to the detection rule in the target graph structure data, and determine risk feature information corresponding to the detection rule based on attribute features of nodes contained in the subgraph data and connection relationships between nodes; Based on the risk characteristic information, determine whether the target object has a resource transfer risk.

2. The method according to claim 1, before acquiring the target graph structure data corresponding to the target object, further comprising: Acquire multiple data tables related to the target object; Extracting object features in the data table and attribute features corresponding to each of the object features; Constructing nodes in the target graph structure data according to the object features, and determining attribute features of the nodes in the target graph structure data according to attribute features corresponding to the object features; According to the association relationship between the multiple data tables, the association relationship between the object features is determined, and according to the association relationship between the object features, the connection relationship between the nodes in the target graph structure data is determined.

3. The method according to claim 2, wherein the first node includes a first child node having a connection relationship with the target node, and a second child node having a connection relationship with the first child node, and the determining of a detection rule for performing risk detection on the target object based on the first node having a preset association relationship with the target node in the target graph structure data comprises: Acquire the attribute characteristics of the first child node and the attribute characteristics of the second child node; Based on one or more of the first sub-node, the second sub-node, an attribute feature of the first sub-node, and an attribute feature of the second sub-node, a detection rule for performing risk detection on the target object is determined.

4. The method according to claim 3, wherein the step of determining a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node comprises: According to a pre-trained rule generation model, based on one or more of the first sub-node, the second sub-node, the attribute characteristics of the first sub-node and the attribute characteristics of the second sub-node, a detection rule for performing risk detection on the target object is determined, and the rule generation model is a model for generating detection rules constructed based on a preset machine learning algorithm.

5. According to the method of claim 3, the step of obtaining subgraph data corresponding to the detection rule in the target graph structure data comprises: Node information corresponding to the detection rule is obtained, and subgraph data corresponding to the detection rule in the target graph structure data is determined according to the node information.

6. The method according to claim 5, wherein determining the risk feature information corresponding to the detection rule based on the attribute features of the nodes contained in the subgraph data and the connection relationship between the nodes comprises: Obtaining a target attribute feature corresponding to the detection rule from the attribute features corresponding to each node contained in the subgraph data; Based on the connection relationship between the nodes contained in the subgraph data and the target attribute feature corresponding to each node, the risk feature information corresponding to the detection rule is determined.

7. According to the method of claim 6, the step of determining the risk feature information corresponding to the detection rule based on the connection relationship between the nodes contained in the subgraph data and the target attribute feature corresponding to each node comprises: Based on the connection relationship between the nodes contained in the subgraph data, and the target attribute characteristics and risk weight corresponding to each of the nodes, the risk characteristic information corresponding to the detection rule is determined.

8. The method according to claim 7, wherein determining whether the target object has a resource transfer risk based on the risk characteristic information comprises: According to a pre-trained risk detection model, based on the risk feature information, the risk type corresponding to the target object is determined, wherein the risk detection model is a model for determining the risk type constructed based on a preset tree structure algorithm; According to the risk type of the target object, it is determined whether the target object has a resource transfer risk.

9. A data processing device, comprising: A request receiving module, used to receive a risk detection request for a target object; A first acquisition module, configured to acquire, in response to the risk detection request, target graph structure data corresponding to the target object, wherein the target graph structure data includes target nodes corresponding to the target object and edges between the nodes determined based on a resource transfer relationship of the target object; A rule determination module, configured to determine a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node; A second acquisition module is used to acquire subgraph data corresponding to the detection rule in the target graph structure data, and determine risk feature information corresponding to the detection rule based on attribute features of nodes contained in the subgraph data and connection relationships between nodes; The risk detection module is used to determine whether the target object has a resource transfer risk based on the risk characteristic information.

10. A data processing device, comprising: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: Receiving a risk detection request for a target object; In response to the risk detection request, acquiring target graph structure data corresponding to the target object, the target graph structure data including target nodes corresponding to the target object and edges between nodes determined based on a resource transfer relationship of the target object; Determining a detection rule for performing risk detection on the target object based on a first node in the target graph structure data that has a preset association relationship with the target node; Acquire subgraph data corresponding to the detection rule in the target graph structure data, and determine risk feature information corresponding to the detection rule based on attribute features of nodes contained in the subgraph data and connection relationships between nodes; Based on the risk characteristic information, determine whether the target object has a resource transfer risk.

Images