Risk identification method and device, storage medium and electronic equipment

Abstract

The invention discloses a risk identification method and device, a storage medium and electronic equipment, and the method comprises the steps: determining transaction data of a to-be-identified user, and determining a transaction relation graph of the to-be-identified user according to the transaction data; and inputting the transaction relation graph into a state space subnet of the risk identification model, performing feature extraction on first information corresponding to a first user having a transaction relation with the to-be-identified user at a historical moment, and determining historical features. And performing feature extraction on second information corresponding to a second user having a transaction relationship with the to-be-identified user at the current moment, determining a current feature, inputting the historical feature and the current feature into a feature aggregation sub-network in the risk identification model, and determining an aggregation feature. And inputting the aggregated features into an identification layer of a risk identification model, and determining a risk identification result. The historical features are determined through the state space subnet, the historical features and the current features are aggregated, the risk identification result is determined, and the degree of freedom and accuracy of risk identification are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, storage medium and electronic device for risk identification. Background Art

[0002] With the development of information technology and artificial intelligence, there are more and more service providers who provide support for users to perform business, such as payment service providers. At the same time, the security of privacy data has also received widespread attention.

[0003] At present, when a user uses the functions provided by the service provider, the user may violate the rules. Therefore, for a certain user, the service provider can build a relationship graph of the user based on the historical business relationship between the user and other users. The nodes in the relationship graph represent each user or the user information corresponding to each user, and the edges between nodes represent the relationship between users, such as transaction relationships. According to the relationship graph of the user, determine whether the user is at risk. However, there are changes in the relationship between users. For example, at time 1, user A and user B conduct a transaction, then there is a transaction relationship between user A and user B, and at time 2, user A and user C conduct a transaction, then there is a transaction relationship between user A and user C. Therefore, the above relationship graph is a dynamic graph, which includes time information. In the process of identifying risks for users based on dynamic graphs, how to learn the graph representation of dynamic graphs has always been the most challenging problem. Therefore, how to identify risks for users based on dynamic graphs to determine whether users are at risk is a very important problem.

[0004] Based on this, a method for risk identification is provided in this specification. Summary of the invention

[0005] This specification provides a method, device, medium and equipment for risk identification to partially solve the above-mentioned problems existing in the prior art.

[0006] This manual adopts the following technical solutions:

[0007] This manual provides a method for risk identification, including:

[0008] Determine transaction data of the user to be identified, and determine a transaction relationship graph corresponding to the user to be identified based on the transaction data; wherein the transaction relationship graph is a dynamic graph;

[0009] Inputting the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features of first information corresponding to a first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determine historical features;

[0010] Extracting features from second information corresponding to a second user who has a transaction relationship with the user to be identified at the current moment to determine current features, and inputting the historical features and the current features into a feature aggregation subnet in the risk identification model to perform feature aggregation on the historical features and the current features through the feature aggregation subnet to determine aggregated features;

[0011] The aggregated features are input into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

[0012] Optionally, the transaction relationship graph is input into a state space subnet of a pre-trained risk identification model, so as to extract features of first information corresponding to a first user who has a transaction relationship with the user to be identified at a historical moment through the state space subnet to determine historical features, specifically including:

[0013] Determine, according to the transaction relationship graph, a first user who has a transaction relationship with the user to be identified at a historical moment;

[0014] Determining first information corresponding to the first user;

[0015] The first information is input into a state space subnet of a pre-trained risk identification model, so as to perform feature extraction on the first information through the state space subnet to determine historical features.

[0016] Optionally, inputting the first information into a state space subnet of a pre-trained risk identification model to extract features of the first information through the state space subnet to determine historical features specifically includes:

[0017] Determining a first time corresponding to the first user;

[0018] Determining a time difference between the first moment and the current moment;

[0019] The first information and the time difference are input into a state space subnet of a pre-trained risk identification model, so as to perform feature extraction on the first information through the state space subnet to determine historical features.

[0020] Optionally, the state space subnet includes a plurality of first network layers;

[0021] Inputting the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features of the first information corresponding to the first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determine the historical features, specifically including:

[0022] According to the transaction relationship graph, determining a number of first users who have a transaction relationship with the user to be identified at a historical moment;

[0023] Determine first information corresponding to each first user;

[0024] For each first user, input the first information of the first user into the state space subnet of the pre-trained risk identification model, so as to extract features of the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user;

[0025] The first features respectively corresponding to the first users are used as historical features.

[0026] Optionally, the risk identification model further includes a feature extraction layer;

[0027] Extracting features from second information corresponding to a second user who has a transaction relationship with the user to be identified at the current moment to determine current features specifically includes:

[0028] Determine, according to the transaction relationship graph, a second user who has a transaction relationship with the user to be identified at the current moment;

[0029] Determining second information corresponding to the second user;

[0030] The second information is input into the feature extraction layer of the risk identification model to determine the current feature.

[0031] Optionally, the feature aggregation subnet includes a first aggregation layer and a second aggregation layer;

[0032] Inputting the historical features and the current features into the feature aggregation subnet in the risk identification model, so as to aggregate the historical features and the current features through the feature aggregation subnet to determine the aggregated features, specifically including:

[0033] Inputting the historical features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the historical features through a first aggregation layer in the feature aggregation subnet to obtain a second feature, and inputting the current features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the current features through a second aggregation layer in the feature aggregation subnet to determine a third feature;

[0034] The second feature and the third feature are used as aggregated features.

[0035] Optionally, pre-train the risk identification model, specifically including:

[0036] Obtain historical transaction data of sample users and use it as historical data;

[0037] Determine, based on the historical data, a transaction relationship graph corresponding to the sample user and use it as a training sample, and determine the risk situation of the sample user and use it as a label for the training sample;

[0038] Inputting the training sample into the state space subnet of the risk identification model to be trained, so as to extract features of third information corresponding to a third user who has a transaction relationship with the sample user at the first sample time through the state space subnet, and determine a first sample feature;

[0039] Performing feature extraction on fourth information corresponding to a fourth user who has a transaction relationship with the sample user at the second sample time, determining a second sample feature corresponding to the fourth user, and inputting the first sample feature and the second sample feature into a feature aggregation subnet of the risk identification model to be trained, so as to perform feature aggregation on the first sample feature and the second sample feature through the feature aggregation subnet, and determine a third sample feature;

[0040] Inputting the third sample feature into the recognition layer of the risk recognition model to be trained to determine a first recognition result of the sample user;

[0041] The risk identification model to be trained is trained according to the difference between the annotation and the first identification result.

[0042] This specification provides a risk identification device, including:

[0043] A determination module, used to determine the transaction data of the user to be identified, and determine the transaction relationship graph corresponding to the user to be identified based on the transaction data; wherein the transaction relationship graph is a dynamic graph;

[0044] a characterization module, configured to input the transaction relationship graph into a state space subnet of a pre-trained risk identification model, so as to extract features of first information corresponding to a first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determine historical features;

[0045] an aggregation module, configured to extract features from second information corresponding to a second user who has a transaction relationship with the user to be identified at the current moment, determine current features, and input the historical features and the current features into a feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features and the current features through the feature aggregation subnet to determine aggregated features;

[0046] The identification module is used to input the aggregated features into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

[0047] Optionally, the characterization module is specifically used to determine, based on the transaction relationship graph, a first user who has a transaction relationship with the user to be identified at a historical moment; determine first information corresponding to the first user; and input the first information into a state space subnet of a pre-trained risk identification model to perform feature extraction on the first information through the state space subnet to determine historical features.

[0048] Optionally, the characterization module is specifically used to determine the first moment corresponding to the first user; determine the time difference between the first moment and the current moment; input the first information and the time difference into a state space subnet of a pre-trained risk identification model to perform feature extraction on the first information through the state space subnet to determine historical features.

[0049] Optionally, the state space subnet includes a plurality of first network layers;

[0050] The characterization module is specifically used to, based on the transaction relationship graph, determine a number of first users who have a transaction relationship with the user to be identified at a historical moment; determine the first information corresponding to each first user; for each first user, input the first information of the first user into the state space subnet of a pre-trained risk identification model, so as to perform feature extraction on the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user; and use the first features corresponding to each first user as historical features.

[0051] Optionally, the risk identification model further includes a feature extraction layer;

[0052] The aggregation module is specifically used to determine, based on the transaction relationship graph, a second user who has a transaction relationship with the user to be identified at the current moment; determine second information corresponding to the second user; and input the second information into a feature extraction layer of the risk identification model to determine current features.

[0053] Optionally, the feature aggregation subnet includes a first aggregation layer and a second aggregation layer;

[0054] The aggregation module is specifically used to input the historical features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the historical features through the first aggregation layer in the feature aggregation subnet to obtain a second feature, and input the current features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the current features through the second aggregation layer in the feature aggregation subnet to determine a third feature; and use the second feature and the third feature as aggregated features.

[0055] Optionally, the device further comprises:

[0056] A training module is used to obtain transaction data of sample users in history and use it as historical data; determine the transaction relationship graph corresponding to the sample users based on the historical data and use it as a training sample, and determine the risk situation of the sample users and use it as a label for the training sample; input the training sample into the state space subnet of the risk identification model to be trained, so as to extract features of third information corresponding to a third user who has a transaction relationship with the sample user at a first sample moment through the state space subnet to determine a first sample feature; extract features of fourth information corresponding to a fourth user who has a transaction relationship with the sample user at a second sample moment to determine a second sample feature corresponding to the fourth user, and input the first sample feature and the second sample feature into the feature aggregation subnet of the risk identification model to be trained, so as to perform feature aggregation on the first sample feature and the second sample feature through the feature aggregation subnet to determine a third sample feature; input the third sample feature into the recognition layer of the risk identification model to be trained to determine a first recognition result of the sample user; and train the risk identification model to be trained based on the difference between the label and the first recognition result.

[0057] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned risk identification method is implemented.

[0058] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned risk identification method when executing the program.

[0059] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0060] In the risk identification method provided in this specification, the transaction data of the user to be identified is determined, and based on the transaction data, the transaction relationship graph corresponding to the user to be identified is determined. The transaction relationship graph is input into the state space subnet of the pre-trained risk identification model, so that the state space subnet performs feature extraction on the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical moment, and determines the historical features. The second information corresponding to the second user who has a transaction relationship with the user to be identified at the current moment is subjected to feature extraction to determine the current features, and the historical features and the current features are input into the feature aggregation subnet in the risk identification model, so that the historical features and the current features are subjected to feature aggregation through the feature aggregation subnet to determine the aggregated features. The aggregated features are input into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

[0061] It can be seen from the above method that when performing risk identification, the method first determines the transaction data of the user to be identified, and determines the transaction relationship graph corresponding to the user to be identified based on the transaction data. The transaction relationship graph is input into the state space subnet of the pre-trained risk identification model, so that the state space subnet performs feature extraction on the first information corresponding to the first user who has a transaction relationship with the user to be identified at the historical moment, and determines the historical features. The second information corresponding to the second user who has a transaction relationship with the user to be identified at the current moment is extracted to determine the current features, and the historical features and the current features are input into the feature aggregation subnet in the risk identification model, so that the historical features and the current features are aggregated by the feature aggregation subnet to determine the aggregated features. The aggregated features are input into the identification layer of the risk identification model to determine the risk identification result of the user to be identified. The first information of the first user is extracted by the state space subnet to determine the historical features, so that the time information in the dynamic graph can be better used for feature extraction, and the historical features and the current features are aggregated, and then risk identification is performed based on the aggregated features to determine the risk identification result, which not only improves the degree of freedom of risk identification, but also provides the accuracy of risk identification results. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The exemplary embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification.

[0063] In the figure:

[0064] Figure 1 A flowchart of a risk identification method in this manual;

[0065] Figure 2 A schematic diagram of a transaction relationship diagram provided in this specification;

[0066] Figure 3 A schematic diagram of a transaction relationship diagram change provided in this specification;

[0067] Figure 4 A schematic diagram of another transaction relationship diagram provided in this specification;

[0068] Figure 5 A schematic diagram of risk identification provided in this manual;

[0069] Figure 6 A schematic diagram of a process for determining a first feature provided in this specification;

[0070] Figure 7 A schematic diagram of a feature aggregation process provided in this specification;

[0071] Figure 8 A schematic diagram of a risk identification device provided in this specification;

[0072] Fig. 9 The corresponding Figure 1 Schematic diagram of electronic equipment. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0074] The embodiments of this specification provide a method, device, storage medium and electronic device for risk identification. The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0075] Figure 1 The following is a flow chart of a risk identification method in this specification, which specifically includes the following steps:

[0076] S100: Determine transaction data of a user to be identified, and determine a transaction relationship graph corresponding to the user to be identified based on the transaction data; wherein the transaction relationship graph is a dynamic graph.

[0077] In this specification, the device used for risk identification can determine the transaction data of the user to be identified, and determine the transaction relationship graph corresponding to the user to be identified based on the transaction data. Among them, the device used for risk identification can be a service provider, a server or system of the service provider, and of course it can also be an electronic device such as a desktop computer, a laptop computer, etc. For the convenience of description, the risk identification method provided in this specification is described below with the server as the execution subject. The above-mentioned user to be identified is any one of the users who use the transaction or payment function provided by the service provider. The above-mentioned transaction data is the data generated when the user to be identified conducts a transaction, and the transaction data is the transaction data at all times, and the all times are all times from the first time the user to be identified conducts a transaction to the current time. Of course, the above transaction data can also be transaction data within a preset time range, which can be pre-set, and the preset time range is a time range before and including the current time. For example, assuming that the current time is 12:00 on June 3, 2024, the preset time range can be from 1:00 on June 3, 2024 to 12:00 on June 3, 2024, or from 12:00 on June 1, 2024 to 12:00 on June 3, 2024. For the sake of convenience, the following transaction data is an example of transaction data within a preset time range. The above transaction data includes transaction time, information of the transaction recipient, information of the transaction initiator, and transaction amount, etc. The transaction initiator can be the above-mentioned user to be identified, or other users, and the transaction recipient can also be the above-mentioned user to be identified, or other users. That is, when the transaction initiator is the user to be identified, the transaction recipient can be other users, and when the transaction initiator is other users, the transaction recipient can be the user to be identified. The information of the transaction initiator may include user name, user ID, user account, gender, age, number of transactions, etc., and the information of the transaction recipient may also include user name, user ID, user account, gender, age, number of transactions, etc.

[0078] In this specification, the above-mentioned transaction relationship graph is a dynamic graph, which is constructed based on transaction data. The transaction relationship graph includes information about other users who have transaction relationships with the user to be identified within a preset time range and the time when the transaction relationship occurs. That is, the transaction relationship graph is actually a graph used to store information about other users who have transaction relationships with the user to be identified within a preset time range and the time when the transaction relationship occurs. The nodes in the transaction relationship graph represent users, and the nodes store user information, which may include user name, user ID, user account, gender, age, number of transactions, etc. Of course, the node can also store a timestamp, which represents the time when the node appears in the transaction relationship graph, that is, the time when the node has a transaction relationship with the node corresponding to the user to be identified. The edge between nodes represents the existence of a transaction relationship, and the edge can also store the time when the transaction relationship occurs between nodes. It should be noted that when a transaction is conducted between two users, it means that there is a transaction relationship between the two users, and the time when the transaction occurs is the time when the transaction relationship occurs. For the sake of convenience, the following example takes the example of nodes storing user information and edges storing the time when a transaction relationship occurs between nodes. Specifically, it can be as follows Figure 2 As shown, Figure 2 A schematic diagram of a transaction relationship diagram provided in this specification, Figure 2 Nodes A to D in represent users A to D. Nodes A to D store the information corresponding to users A to D respectively. Figure 2 The edges in represent the transaction relationship between nodes. Figure 2 T0-T2 in the figure represent the time when the transaction relationship occurs between nodes (i.e., between users), that is, the time when the transaction relationship occurs between node A (i.e., user A) and node D (i.e., user D) is T0, the time when the transaction relationship occurs between node A and node B (i.e., user B) is T1, and the time when the transaction relationship occurs between node A and node C (i.e., user C) is T2. The preset time range is T0 to T2, and the current time is T2.

[0079] Based on this, when determining the transaction relationship graph corresponding to the user to be identified based on the transaction data, the server can determine the user who has a transaction relationship with the user to be identified within a preset time range based on the transaction data, and use it as the user to be selected. Then determine the information corresponding to the user to be selected, and determine the information of the user to be identified. Construct a transaction relationship graph with nodes corresponding to the information of the user to be selected and the user to be identified, and with the transaction relationship between the user to be selected and the user to be identified as the edge. Among them, the edge in the transaction relationship graph stores the time when the transaction relationship between the user to be selected and the user to be identified occurs (i.e., the transaction time).

[0080] In this specification, the transaction relationship diagram actually includes the information of transaction changes between other users and the user to be identified within a preset time range (i.e., the information of the user to be identified and the users who have transaction relationships with the user to be identified and the transaction time). Figure 3 As shown, Figure 3 This is a schematic diagram of a transaction relationship graph change provided in this specification. Assume that the current time is T0 and T0 is the time when the user to be identified (i.e., node A representing user A) first has a transaction relationship with other users, or T0 is the time when the user to be identified first appears. The preset time range only includes T0. Therefore, the transaction relationship graph at this time includes the information of transaction changes between each other user and the user to be identified at T0, that is, Figure 3 Figure a in the figure is a transaction relationship diagram at T0, and node D in figure a represents user D. After a period of time, assuming that the current time is T1, and T0 is earlier than T1, the preset time range may include T0 and T1, so the transaction relationship diagram at this time is a diagram that accumulates the information of transaction changes between each other user and the user to be identified at T0 and the information of transaction changes between each other user and the user to be identified at T1, that is, the transaction relationship diagram includes the information of transaction changes between each other user and the user to be identified at T0 and T1, that is, figure b, which is the transaction relationship diagram at T1, and node B in figure b represents user B. After a period of time, assuming that the current moment is T2, and T1 is earlier than T2, the preset time range may include T0~T2, so the transaction relationship graph at this time is a graph that accumulates the information of transaction changes between each other user and the user to be identified at T0, the information of transaction changes between each other user and the user to be identified at T1, and the information of transaction changes between each other user and the user to be identified at T2, that is, the transaction relationship graph includes the information of transaction changes between each other user and the user to be identified from T0 to T2, that is, Figure c, which is the transaction relationship graph at T2, and node C in Figure c represents user C.

[0081] In addition, the above transaction relationship diagram is a dynamic diagram, and the time in the transaction relationship diagram is continuous time, that is, the above preset time range is a continuous time range. In order to represent the changes in the transaction relationship in continuous time and to distinguish between historical moments and the current moment, the dotted line edge can represent the transaction relationship at the historical moment, and the solid line edge can represent the transaction relationship at the current moment. Figure 4 As shown, Figure 4 This is another schematic diagram of a transaction relationship diagram provided in this specification. Figure 3 The content of the nodes and edges in the above Figure 2 The nodes and edges in the table are consistent and will not be described in detail here. The preset time range is T0 to T2. Figure 3T2 in is the current moment, so the edge corresponding to T2 is a solid line, while T0 and T1 are historical moments, so the edges corresponding to T0 and T1 are dashed lines. Based on this, when determining the transaction relationship graph corresponding to the user to be identified based on the transaction data, the server can determine the user who has a transaction relationship with the user to be identified within a preset time range based on the transaction data, and use it as the user to be selected. Then determine the information corresponding to the user to be selected, and determine the information of the user to be identified. Then, from the users to be selected, determine the first user who has a transaction relationship with the user to be identified at a historical moment, and determine the second user who has a transaction relationship with the user to be identified at the current moment. Construct an initial graph with nodes corresponding to the information of the user to be selected and the user to be identified, and with the transaction relationship between the user to be selected and the user to be identified as the edge. Set the edge between the node representing the first user and the node representing the user to be identified in the initial graph as the first type of edge, and set the edge between the node representing the second user and the node representing the user to be identified in the initial graph as the second type of edge, and then use the set initial graph as the transaction relationship graph. Among them, the first type of edge is the edge represented by the dashed line, and the second type of edge is the edge represented by the solid line. The edge in the transaction relationship graph stores the time when the transaction relationship occurs between the user to be selected and the user to be identified (ie, the transaction time).

[0082] Of course, dynamic graphs refer to graph structure data that changes over time, and dynamic graphs can be represented in a variety of ways, for example, the dynamic graph can be represented in the form of a snapshot sequence, in the form of a timestamp edge list, and of course, in the form of incremental updates. Therefore, the above-mentioned transaction relationship graph can also be represented in the form of a snapshot sequence, that is, the above-mentioned transaction relationship graph can also include subgraph snapshots of several moments within a preset time range, and the subgraph is a static graph at each moment, that is, a static graph generated based on the transaction data at each moment. In addition, the above-mentioned transaction relationship graph can also be represented in the form of a timestamp edge list, that is, each edge in the transaction relationship graph has a timestamp list, which records the time when the edge was created or deleted. Specifically, taking the transaction relationship graph including subgraph snapshots of several moments within a preset time range as an example, when determining the transaction relationship graph corresponding to the user to be identified based on the transaction data, the server can determine the transaction data corresponding to the moment for several moments within the preset time range, and determine the user who has a transaction relationship with the user to be identified at the moment according to the transaction data corresponding to the moment, and use the user to be selected at the moment as the node, and construct a subgraph with the information corresponding to the user to be selected at the moment and the user to be identified as the edge. The subgraphs corresponding to each moment are used as the transaction relationship graph. Among them, each subgraph or edge in the transaction relationship graph stores the time when the transaction relationship occurs between the user to be selected and the user to be identified (i.e., the transaction time). The transaction relationship graph can be a snapshot sequence composed of subgraphs at several moments, that is, the server can sort the subgraphs in the order of time from early to late (i.e., from small to large), obtain a snapshot sequence, and use it as the transaction relationship graph.

[0083] S102: Input the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features of the first information corresponding to the first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet to determine historical features.

[0084] In this specification, the server may input the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features of the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determine the historical features. Among them, the above-mentioned risk identification model is a pre-trained model, which is used to determine the risk situation of the user to be identified based on the transaction relationship graph, that is, whether the user to be identified is at risk. Because when the first user has a transaction relationship with the user to be identified, the representation of the first information corresponding to the first user will have an impact on the representation of the user to be identified, that is, the representation of the first information corresponding to the first user acts on the representation of the user to be identified, and the role or influence is also related to time. The greater the time difference between the moment when the first user and the user to be identified have a transaction and the current moment, the longer the time of the action or influence is. Conversely, the smaller the time difference between the moment when the first user and the user to be identified have a transaction and the current moment, the shorter the time of the action or influence is. Therefore, the above-mentioned action or influence can be determined by the state space subnet in the pre-trained risk identification model, that is, the historical feature. The historical feature characterizes that the representation of the first information corresponding to the first user has an action or influence on the representation of the user to be identified, and the historical feature is a cumulative amount, that is, the cumulative action amount or cumulative influence amount from the moment when the first user and the user to be identified have a transaction to the current moment.

[0085] Based on this, the server can determine the first user who has a transaction relationship with the user to be identified at a historical moment according to the transaction relationship graph, and determine the first information corresponding to the first user. Then the first information is input into the state space subnet of the pre-trained risk identification model to extract features of the first information through the state space subnet to determine the historical features. Among them, since the above-mentioned transaction relationship graph includes the information of other users who have a transaction relationship with the user to be identified within a preset time range and the time when the transaction relationship occurred, the above-mentioned first user can be directly determined through the transaction relationship graph. Specifically, if the transaction relationship graph is Figure 2 , the server can determine the edge of the transaction relationship at the historical moment according to the transaction time stored in the edge of the transaction relationship graph, and use it as the first edge, determine the node corresponding to the first edge, and use the user represented by the node who is not the user to be identified as the first user. Figure 4As shown in the schematic diagram, the server can directly determine the first type of edge in the transaction relationship graph as the first edge, determine the node corresponding to the first edge, and use the user represented by the node who is not the user to be identified as the first user. Of course, relationship graphs in other representation forms can also directly determine the first user, which will not be repeated here. The above-mentioned first information is the information corresponding to the first user. The first information is the information stored in the node representing the first user in the transaction relationship graph. The first information may include user name, user ID, user account, gender, age, number of transactions, etc.

[0086] In the above-mentioned process of inputting the first information into the state space subnet of the pre-trained risk identification model so as to extract features of the first information through the state space subnet and determine the historical features, the server can determine the first moment corresponding to the first user. Determine the time difference between the first moment and the current moment. Then input the first information and the time difference into the state space subnet of the pre-trained risk identification model so as to extract features of the first information through the state space subnet and determine the historical features. The first moment is the time when the first user has a transaction relationship with the user to be identified, that is, the transaction time, and the transaction time can be directly determined from the transaction relationship diagram. Among them, by inputting the time difference between the first moment and the current moment into the state space subnet, the state space subnet can determine the role or influence of the historical features accumulated within the time difference on the characterization of the first information corresponding to the first user on the characterization of the user to be identified, that is, the role or influence is a cumulative amount, and the accumulated time length is the time difference, thereby enhancing the interpretability of time.

[0087] S104: Extract features of the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current moment, determine the current features, and input the historical features and the current features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the historical features and the current features through the feature aggregation subnet to determine the aggregated features.

[0088] In this specification, the server can extract features from the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current moment to determine the current features. Then the historical features and the current features are input into the feature aggregation subnet in the risk identification model to aggregate the historical features and the current features through the feature aggregation subnet to determine the aggregated features. Among them, since the above-mentioned transaction relationship graph includes the information of other users who have a transaction relationship with the user to be identified within a preset time range and the time when the transaction relationship occurred, the above-mentioned second user can be directly determined through the transaction relationship graph. Specifically, if the transaction relationship graph is Figure 2, the server can determine the edge of the transaction relationship at the current time according to the transaction time stored in the edge of the transaction relationship graph, and use it as the second edge, determine the node corresponding to the second edge, and use the user represented by the node who is not the user to be identified as the second user. Figure 4 As shown in the schematic diagram, the server can directly determine the second type of edge in the transaction relationship graph as the second edge, determine the node corresponding to the second edge, and use the user represented by the node who is not the user to be identified as the second user. Of course, other representation forms of relationship graphs can also directly determine the second user, which will not be repeated here. The above-mentioned second information is the information corresponding to the second user. The second information is the information stored in the node representing the second user in the transaction relationship graph. The second information may include user name, user ID, user account, gender, age, number of transactions, etc.

[0089] The above-mentioned current feature is the feature of the second information corresponding to the second user. The above-mentioned feature extraction is performed on the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current moment. When determining the current feature, the server can determine the second user who has a transaction relationship with the user to be identified at the current moment based on the transaction relationship graph. Determine the second information corresponding to the second user. Then input the second information into the feature extraction layer of the risk identification model to determine the current feature. Among them, the above-mentioned risk identification model also includes a feature extraction layer. Of course, the server can also use any existing feature extraction layer to extract features from the second information to determine the current feature, and this specification does not make specific limitations.

[0090] S106: Input the aggregated features into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

[0091] In this specification, the server may input the aggregated features into the identification layer of the risk identification model to determine the risk identification result of the user to be identified. Among them, the above risk identification result may be one of risky and non-risky. After obtaining the risk identification result, the server may perform risk control on the user to be identified according to the risk identification result. Specifically, when the risk identification result is risky, the server may determine the risk control strategy according to the risk identification result, and then perform risk control on the user to be identified according to the risk control strategy. The risk control strategy may be pre-set by the risk control personnel.

[0092] It can be seen from the above method that when performing risk identification, the present application first determines the transaction data of the user to be identified, and determines the transaction relationship graph corresponding to the user to be identified based on the transaction data. The transaction relationship graph is input into the state space subnet of the pre-trained risk identification model, so that the state space subnet extracts the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical moment, and determines the historical features. The second information corresponding to the second user who has a transaction relationship with the user to be identified at the current moment is extracted to determine the current features, and the historical features and the current features are input into the feature aggregation subnet in the risk identification model, so that the historical features and the current features are aggregated through the feature aggregation subnet to determine the aggregated features. The aggregated features are input into the identification layer of the risk identification model to determine the risk identification result of the user to be identified. The state space subnet extracts the first information of the first user to determine the historical features, so that the time information in the dynamic graph can be better used for feature extraction, which enhances the interpretability of time, and there is no need to use the attention mechanism for feature extraction, which increases the degree of freedom of risk identification. Re-aggregate historical features and current features, perform risk identification based on the aggregated features, and determine the risk identification results, which increases the degree of freedom of risk identification and helps to control risks for users.

[0093] In this specification, the risk identification model may include a state space subnet, a feature aggregation subnet, and an identification layer. The process of risk identification based on the risk identification model may be as follows: Figure 5 As shown, Figure 5 This is a schematic diagram of risk identification provided in this specification. The server can input the transaction relationship diagram of the user to be identified into the state space subnet to determine the historical features. Then the historical features and current features are input into the feature aggregation subnet to determine the aggregated features. Then the aggregated features are input into the identification layer to determine the risk identification result of the user to be identified. The detailed process is the same as above. Figure 1 The process shown is the same and will not be repeated here.

[0094] In this specification, the state space subnet may include several first network layers, each of which corresponds to a user, that is, each first network layer can be used to extract the features of each user's information. Each first network layer has the same function as the state space subnet. In fact, each first network layer is equivalent to a state space model. The state space model is a powerful tool for sequence modeling, particularly suitable for capturing long-term dependencies in sequences. The first network layer may be a linear state space model, and the first network layer may be a HiPPO (Hierarchical PolynomialProjections for Optimal Memory) structure. Therefore, in the above step S102, the server may determine the first user who has a transaction relationship with the user to be identified at a historical moment based on the transaction relationship graph. Determine the first information corresponding to the first user. The first information is then input into the state space subnet of the pre-trained risk identification model to extract features of the first information through the first network layer corresponding to the first user in the state space subnet to determine the historical features. Among them, the server may determine the first moment corresponding to the first user when inputting the first information into the state space subnet of the pre-trained risk identification model to extract features of the first information through the first network layer corresponding to the first user in the state space subnet and determining the historical features. Determine the time difference between the first moment and the current moment. Then input the first information and the time difference into the state space subnet of the pre-trained risk identification model to extract features of the first information through the first network layer corresponding to the first user in the state space subnet and determine the historical features.

[0095] In addition, there may be multiple first users, so in the above step S102, the server may determine several first users who have a transaction relationship with the user to be identified at a historical moment according to the transaction relationship diagram. Determine the first information corresponding to each first user. Then, for each first user, the first information of the first user is input into the state space subnet of the pre-trained risk identification model, so as to extract the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user. The first feature corresponding to each first user is used as a historical feature. Among them, the above historical feature is composed of several first features, each first feature represents that the representation of the first information corresponding to each first user has an effect or influence on the representation of the user to be identified, and each first feature is a cumulative amount, that is, the cumulative effect or cumulative influence from the moment when each first user and the user to be identified have a transaction to the current moment. The process of determining the first feature is similar to the process of inputting the first information into the state space subnet of the pre-trained risk identification model, so as to extract the first information through the first network layer corresponding to the first user in the state space subnet, and determine the historical feature, and will not be repeated here.

[0096] For example, Figure 6 As shown, Figure 6 This is a schematic diagram of a process of determining a first feature provided in this specification. Assuming that there are n first users, namely first users 1 to n, the information corresponding to the first users 1 to n is first information 1 to n. The first network layers corresponding to the first users 1 to n are first network layers 1 to n. Therefore, the server can determine a number of first users, namely first users 1 to n, who have a transaction relationship with the user to be identified at a historical moment according to the transaction relationship diagram. Determine the first information corresponding to each first user, namely first information 1 to n. Then, for each first user, the first information of the first user is input into the state space subnet of the pre-trained risk identification model, so as to extract the features of the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user. Assuming that for the first user 1, the server can input the first information 1 of the first user 1 into the state space subnet of the pre-trained risk identification model, so as to extract the features of the first information 1 of the first user 1 through the first network layer 1 corresponding to the first user 1 in the state space subnet, and determine the first feature 1 of the first user 1. The first features corresponding to each first user are used as historical features, namely first features 1 to n.

[0097] In this specification, the above-mentioned first feature or historical feature may be a feature of a single dimension. Of course, the above-mentioned first feature or historical feature may also be a multi-dimensional feature, that is, the above-mentioned first feature or historical feature may include sub-features of several dimensions. The sub-features of each dimension can be obtained by feature extraction based on each type of first information. Therefore, the first feature includes sub-features of several dimensions as an example for explanation. The above-mentioned first information may also include several types of sub-information. When the first information of the first user is input into the state space subnet of the pre-trained risk identification model, the first information of the first user is extracted through the first network layer corresponding to the first user in the state space subnet. When determining the first feature of the first user, the server may input the sub-information of the first user into the state space subnet of the pre-trained risk identification model for each type of sub-information included in the first information of the first user, so as to extract the sub-information of the first user through the first network layer corresponding to the first user in the state space subnet, determine the sub-features of the first user, and use each sub-feature of the first user as the first feature of the first user.

[0098] In addition, the first network layer may also include several sub-network layers. Therefore, when the sub-information of the first user is input into the state space subnet of the pre-trained risk identification model to extract features of the sub-information of the first user through the first network layer corresponding to the first user in the state space subnet and determine the sub-features of the first user, the server may input the sub-information of the first user into the state space subnet of the pre-trained risk identification model to extract features of the sub-information of the first user through the sub-network layer corresponding to the sub-information of the first network layer corresponding to the first user in the state space subnet and determine the sub-features of the first user.

[0099] In this specification, the above historical features may include several first features, and each first feature has a corresponding moment, i.e., the first moment. Therefore, in the above step S104, the historical features and the current features are input into the feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features and the current features through the feature aggregation subnet. When determining the aggregated features, the server can determine the first moment corresponding to each first feature, which is the time when the first user has a transaction relationship with the user to be identified, i.e., the transaction time. The first moment can be determined based on the transaction relationship graph. Then, the first features are sorted in order from early to late, or from small to large according to the first moment, to obtain a feature sequence. Afterwards, for each first feature in the feature sequence, the first feature and the current feature are input into the feature aggregation subnet in the risk identification model in turn, so that the first feature and the current feature are aggregated through the feature aggregation subnet to obtain the initial feature, and the initial feature is used as the current feature again, and the next first feature of the first feature and the new current feature are continuously input into the feature aggregation subnet in the risk identification model, so that the next first feature of the first feature and the new current feature are aggregated through the feature aggregation subnet to obtain the initial feature again, until the end condition is met, and the initial feature at this time is used as the aggregated feature. The end condition is that the next first feature cannot be determined, that is, all the first features of the feature sequence have been aggregated, that is, they have all been input into the feature aggregation subnet.

[0100] In the present specification, the feature aggregation subnet includes a first aggregation layer and a second aggregation layer, the first aggregation layer is used to aggregate historical features, and the second aggregation layer is used to aggregate current features. Therefore, in the above step S104, the historical features and the current features are input into the feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features and the current features through the feature aggregation subnet. When determining the aggregated features, the server may input the historical features into the feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features through the first aggregation layer in the feature aggregation subnet to obtain the second feature, and input the current features into the feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the current features through the second aggregation layer in the feature aggregation subnet to determine the third feature. The second feature and the third feature are used as aggregated features, specifically as follows: Figure 7 As shown, Figure 7 A schematic diagram of a feature aggregation process provided in this specification.

[0101] In addition, the feature aggregation subnet may further include a third aggregation layer, and the third aggregation layer is used to aggregate the second feature and the third feature. Therefore, when the second feature and the third feature are used as the aggregated feature, the server may input the second feature and the third feature into the third aggregation layer, so as to perform feature aggregation on the second feature and the third feature through the third aggregation layer to determine the aggregated feature.

[0102] In addition, the above-mentioned historical features may include several first features. Therefore, when the historical features are input into the feature aggregation subnet in the risk identification model, and the historical features are aggregated through the first aggregation layer in the feature aggregation subnet to obtain the second feature, the server may input each first feature into the feature aggregation subnet in the risk identification model to aggregate each first feature through the first aggregation layer in the feature aggregation subnet to obtain the second feature.

[0103] In this specification, there may be multiple second users, so the feature extraction is performed on the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current moment. When determining the current feature, the server can determine several second users who have a transaction relationship with the user to be identified at the current moment based on the transaction relationship graph. Determine the second information corresponding to each second user. Then, for each second user, input the second information of the second user into the feature extraction layer of the risk identification model to determine the fourth feature corresponding to the second user. Then, the second feature corresponding to each second user is used as the current feature.

[0104] Based on this, when the current feature is input into the feature aggregation subnet in the risk identification model to perform feature aggregation on the current feature through the second aggregation layer in the feature aggregation subnet to determine the third feature, the server may input each fourth feature into the feature aggregation subnet in the risk identification model to perform feature aggregation on each fourth feature through the second aggregation layer in the feature aggregation subnet to determine the third feature.

[0105] In this specification, there may be multiple users to be identified, and each user to be identified may be identified for risk according to the process of steps S100 to S106, which will not be described in detail here.

[0106] In this specification, the above-mentioned risk identification model may be a pre-trained model, so when pre-training the risk identification model, the server may obtain the transaction data of the sample users in history and use it as historical data. According to the historical data, the transaction relationship diagram corresponding to the sample users is determined and used as the training sample, and the risk situation of the sample users is determined and used as the annotation of the training sample. The training sample is input into the state space subnet of the risk identification model to be trained, so that the third information corresponding to the third user who has a transaction relationship with the sample user at the first sample moment is extracted through the state space subnet to determine the first sample feature. The fourth information corresponding to the fourth user who has a transaction relationship with the sample user at the second sample moment is extracted to determine the second sample feature corresponding to the fourth user, and the first sample feature and the second sample feature are input into the feature aggregation subnet of the risk identification model to be trained, so that the first sample feature and the second sample feature are aggregated through the feature aggregation subnet to determine the third sample feature. The third sample feature is input into the recognition layer of the risk identification model to be trained to determine the first recognition result of the sample user. According to the difference between the annotation and the first recognition result, the risk identification model to be trained is trained.

[0107] Among them, the above-mentioned sample users are users who use the payment or transaction functions provided by the service provider. The above-mentioned historical data may also be transaction data within a sample time range, and the sample time range is pre-set. The above-mentioned process of determining the transaction relationship graph corresponding to the sample user based on the historical data and using it as a training sample is similar to the process of determining the transaction relationship graph of the user to be identified based on the transaction data in the above-mentioned step S100, and will not be repeated here. The above-mentioned first sample moment is earlier than the above-mentioned second sample moment. The above-mentioned process of determining the first recognition result based on the training sample is similar to the process described in the above-mentioned steps S102 to S106, and will not be repeated here. The above-mentioned first recognition result may be one of risky and risk-free.

[0108] When the risk identification model to be trained is trained according to the difference between the annotation and the first recognition result, the server can use a preset loss function to determine the function value according to the difference between the annotation and the first recognition result, and train the risk identification model to be trained according to the function value.

[0109] The above is a method for risk identification provided by one or more embodiments of this specification. Based on the same idea, this specification also provides a corresponding risk identification device, such as Figure 8 shown.

[0110] Figure 8 A schematic diagram of a risk identification device provided in this manual specifically includes:

[0111] The determination module 200 is used to determine the transaction data of the user to be identified, and determine the transaction relationship graph corresponding to the user to be identified based on the transaction data; wherein the transaction relationship graph is a dynamic graph;

[0112] A characterization module 202, configured to input the transaction relationship graph into a state space subnet of a pre-trained risk identification model, so as to extract features of first information corresponding to a first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determine historical features;

[0113] Aggregation module 204, used to extract features from second information corresponding to a second user who has a transaction relationship with the user to be identified at the current moment, determine current features, and input the historical features and the current features into a feature aggregation subnet in the risk identification model, so as to aggregate the historical features and the current features through the feature aggregation subnet to determine aggregated features;

[0114] The identification module 206 is used to input the aggregated features into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

[0115] Optionally, the characterization module 202 is specifically used to determine, based on the transaction relationship graph, a first user who has a transaction relationship with the user to be identified at a historical moment; determine first information corresponding to the first user; and input the first information into a state space subnet of a pre-trained risk identification model to perform feature extraction on the first information through the state space subnet to determine historical features.

[0116] Optionally, the characterization module 202 is specifically used to determine the first moment corresponding to the first user; determine the time difference between the first moment and the current moment; input the first information and the time difference into a state space subnet of a pre-trained risk identification model to perform feature extraction on the first information through the state space subnet to determine historical features.

[0117] Optionally, the state space subnet includes a plurality of first network layers;

[0118] The characterization module 202 is specifically used to determine, based on the transaction relationship graph, a number of first users who have a transaction relationship with the user to be identified at a historical moment; determine the first information corresponding to each first user; for each first user, input the first information of the first user into the state space subnet of a pre-trained risk identification model, so as to perform feature extraction on the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user; and use the first features corresponding to each first user as historical features.

[0119] Optionally, the risk identification model further includes a feature extraction layer;

[0120] The aggregation module 204 is specifically used to determine, based on the transaction relationship graph, a second user who has a transaction relationship with the user to be identified at the current moment; determine second information corresponding to the second user; and input the second information into the feature extraction layer of the risk identification model to determine the current feature.

[0121] Optionally, the feature aggregation subnet includes a first aggregation layer and a second aggregation layer;

[0122] The aggregation module 204 is specifically used to input the historical features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the historical features through the first aggregation layer in the feature aggregation subnet to obtain a second feature, and input the current features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the current features through the second aggregation layer in the feature aggregation subnet to determine a third feature; and use the second feature and the third feature as aggregated features.

[0123] Optionally, the device further comprises:

[0124] The training module 208 is used to obtain the transaction data of the sample users in history and use it as the historical data; determine the transaction relationship graph corresponding to the sample users according to the historical data and use it as the training samples, and determine the risk situation of the sample users and use it as the annotation of the training samples; input the training samples into the state space subnet of the risk identification model to be trained, so as to extract the features of the third information corresponding to the third user who has a transaction relationship with the sample user at the first sample time through the state space subnet, and determine the first sample features; extract the features of the fourth information corresponding to the fourth user who has a transaction relationship with the sample user at the second sample time, and determine the second sample features corresponding to the fourth user, and input the first sample features and the second sample features into the feature aggregation subnet of the risk identification model to be trained, so as to perform feature aggregation on the first sample features and the second sample features through the feature aggregation subnet, and determine the third sample features; input the third sample features into the recognition layer of the risk identification model to be trained, and determine the first recognition result of the sample user; and train the risk identification model to be trained according to the difference between the annotation and the first recognition result.

[0125] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 The risk identification method shown.

[0126] This manual also provides Fig. 9 The schematic structure diagram of the electronic device shown in FIG. Fig. 9 As mentioned above, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Of course, in addition to the software implementation, this specification does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0127] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0128] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0129] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0130] For the convenience of description, the above device is described by dividing it into various units according to its functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0131] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0135] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0136] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0137] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0138] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0139] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0140] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0141] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0142] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A method for risk identification, comprising: Determine transaction data of the user to be identified, and determine a transaction relationship graph corresponding to the user to be identified based on the transaction data; wherein the transaction relationship graph is a dynamic graph; Inputting the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features of first information corresponding to a first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determine historical features; Extracting features from second information corresponding to a second user who has a transaction relationship with the user to be identified at the current moment to determine current features, and inputting the historical features and the current features into a feature aggregation subnet in the risk identification model to perform feature aggregation on the historical features and the current features through the feature aggregation subnet to determine aggregated features; The aggregated features are input into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

2. The method according to claim 1, inputting the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features of the first information corresponding to the first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determining the historical features, specifically includes: Determine, according to the transaction relationship graph, a first user who has a transaction relationship with the user to be identified at a historical moment; Determining first information corresponding to the first user; The first information is input into a state space subnet of a pre-trained risk identification model, so as to extract features of the first information through the state space subnet and determine historical features.

3. The method according to claim 2, inputting the first information into a state space subnet of a pre-trained risk identification model to extract features of the first information through the state space subnet to determine historical features, specifically comprising: Determining a first time corresponding to the first user; Determining a time difference between the first moment and the current moment; The first information and the time difference are input into a state space subnet of a pre-trained risk identification model, so as to perform feature extraction on the first information through the state space subnet to determine historical features.

4. The method of claim 1, wherein the state space subnet comprises a plurality of first network layers; Inputting the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features of the first information corresponding to the first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determine the historical features, specifically including: According to the transaction relationship graph, determining a number of first users who have a transaction relationship with the user to be identified at a historical moment; Determine first information corresponding to each first user; For each first user, input the first information of the first user into the state space subnet of the pre-trained risk identification model, so as to extract features of the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user; The first features respectively corresponding to the first users are used as historical features.

5. The method according to claim 1, wherein the risk identification model further comprises a feature extraction layer; Extracting features from second information corresponding to a second user who has a transaction relationship with the user to be identified at the current moment to determine current features specifically includes: Determine, according to the transaction relationship graph, a second user who has a transaction relationship with the user to be identified at the current moment; Determining second information corresponding to the second user; The second information is input into the feature extraction layer of the risk identification model to determine the current feature.

6. The method of claim 1, wherein the feature aggregation subnet comprises a first aggregation layer and a second aggregation layer; Inputting the historical features and the current features into the feature aggregation subnet in the risk identification model, so as to aggregate the historical features and the current features through the feature aggregation subnet to determine the aggregated features, specifically including: Inputting the historical features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the historical features through a first aggregation layer in the feature aggregation subnet to obtain a second feature, and inputting the current features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the current features through a second aggregation layer in the feature aggregation subnet, Determine the third characteristic; The second feature and the third feature are used as aggregated features.

7. The method according to claim 1, wherein the risk identification model is pre-trained, specifically comprising: Obtain historical transaction data of sample users and use it as historical data; Determine, based on the historical data, a transaction relationship graph corresponding to the sample user and use it as a training sample, and determine the risk situation of the sample user and use it as a label for the training sample; Inputting the training sample into the state space subnet of the risk identification model to be trained, so as to extract features of third information corresponding to a third user who has a transaction relationship with the sample user at the first sample time through the state space subnet, and determine a first sample feature; Performing feature extraction on fourth information corresponding to a fourth user who has a transaction relationship with the sample user at the second sample time, determining a second sample feature corresponding to the fourth user, and inputting the first sample feature and the second sample feature into a feature aggregation subnet of the risk identification model to be trained, so as to perform feature aggregation on the first sample feature and the second sample feature through the feature aggregation subnet, and determine a third sample feature; Inputting the third sample feature into the recognition layer of the risk recognition model to be trained to determine a first recognition result of the sample user; The risk identification model to be trained is trained according to the difference between the annotation and the first identification result.

8. A risk identification device, comprising: A determination module, used to determine the transaction data of the user to be identified, and determine the transaction relationship graph corresponding to the user to be identified based on the transaction data; wherein the transaction relationship graph is a dynamic graph; a characterization module, configured to input the transaction relationship graph into a state space subnet of a pre-trained risk identification model, so as to extract features of first information corresponding to a first user who had a transaction relationship with the user to be identified at a historical moment through the state space subnet, and determine historical features; an aggregation module, configured to extract features from second information corresponding to a second user who has a transaction relationship with the user to be identified at the current moment, determine current features, and input the historical features and the current features into a feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features and the current features through the feature aggregation subnet to determine aggregated features; The identification module is used to input the aggregated features into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

9. In the device as described in claim 8, the characterization module is specifically used to determine, based on the transaction relationship graph, a first user who has a transaction relationship with the user to be identified at a historical moment; determine first information corresponding to the first user; and input the first information into a state space subnet of a pre-trained risk identification model to extract features of the first information through the state space subnet to determine historical features.

10. In the device as described in claim 9, the characterization module is specifically used to determine the first moment corresponding to the first user; determine the time difference between the first moment and the current moment; input the first information and the time difference into the state space subnet of a pre-trained risk identification model, so as to extract features of the first information through the state space subnet and determine historical features.

11. The apparatus of claim 8, wherein the state space subnet comprises a plurality of first network layers; The characterization module is specifically used to, based on the transaction relationship graph, determine a number of first users who have a transaction relationship with the user to be identified at a historical moment; determine the first information corresponding to each first user; for each first user, input the first information of the first user into the state space subnet of a pre-trained risk identification model, so as to perform feature extraction on the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user; and use the first features corresponding to each first user as historical features.

12. The apparatus of claim 8, wherein the risk identification model further comprises a feature extraction layer; The aggregation module is specifically used to determine, based on the transaction relationship graph, a second user who has a transaction relationship with the user to be identified at the current moment; determine second information corresponding to the second user; and input the second information into a feature extraction layer of the risk identification model to determine current features.

13. The apparatus of claim 8, wherein the feature aggregation subnetwork comprises a first aggregation layer and a second aggregation layer; The aggregation module is specifically used to input the historical features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the historical features through the first aggregation layer in the feature aggregation subnet to obtain a second feature, and input the current features into the feature aggregation subnet in the risk identification model to perform feature aggregation on the current features through the second aggregation layer in the feature aggregation subnet to determine a third feature; and use the second feature and the third feature as aggregated features.

14. The apparatus of claim 8, further comprising: The training module is used to obtain historical transaction data of sample users and use it as historical data; Determine, based on the historical data, a transaction relationship graph corresponding to the sample user and use it as a training sample, and determine the risk situation of the sample user and use it as a label for the training sample; Inputting the training sample into the state space subnet of the risk identification model to be trained, so as to extract features of third information corresponding to a third user who has a transaction relationship with the sample user at the first sample time through the state space subnet, and determine a first sample feature; Perform feature extraction on the fourth information corresponding to the fourth user who has a transaction relationship with the sample user at the second sample moment, determine the second sample feature corresponding to the fourth user, and input the first sample feature and the second sample feature into the feature aggregation subnet of the risk identification model to be trained, so as to perform feature aggregation on the first sample feature and the second sample feature through the feature aggregation subnet to determine the third sample feature; input the third sample feature into the recognition layer of the risk identification model to be trained to determine the first recognition result of the sample user; and train the risk identification model to be trained according to the difference between the annotation and the first recognition result.

15. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

16. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the program.

Images