A risk identification method, device, storage medium and electronic equipment

Abstract

The specification discloses a risk identification method, device, storage medium and electronic equipment, the method comprising: determining transaction data of a user to be identified, and determining a transaction relationship graph of the user to be identified according to the transaction data. The transaction relationship graph is input into a state space subnet of a risk identification model, feature extraction is performed on first information corresponding to a first user having a transaction relationship with the user to be identified at a historical time, and historical features are determined. Feature extraction is performed on second information corresponding to a second user having a transaction relationship with the user to be identified at a current time, and current features are determined. The historical features and the current features are input into a feature aggregation subnet in the risk identification model, and aggregated features are determined. The aggregated features are input into an identification layer of the risk identification model, and a risk identification result is determined. The historical features are determined through the state space subnet, the historical features and the current features are aggregated, and the risk identification result is determined, thereby improving the degree of freedom and accuracy of risk identification.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computer technology, and in particular, to a risk identification method and device, a storage medium, and an electronic device. BACKGROUND

[0002] With the development of information technology and artificial intelligence, more and more service providers provide support for users to perform businesses, for example, service providers providing payment functions. At the same time, the security of private data has also attracted widespread attention.

[0003] At present, when a user uses a function provided by a service provider, the user may have a violation behavior. Therefore, for a certain user, the service provider can construct a relationship graph of the user according to historical business relationships between the user and other users. The nodes in the relationship graph represent each user or user information corresponding to each user, and the edges between the nodes represent the relationship between the users, such as a transaction relationship. According to the relationship graph of the user, it is determined whether the user has a risk. However, the relationship between users changes, for example, at time 1, user A and user B have a transaction, so there is a transaction relationship between user A and user B, and at time 2, user A and user C have a transaction, so there is a transaction relationship between user A and user C. Therefore, the above relationship graph is a dynamic graph, which includes time information. In the risk identification of the user based on the dynamic graph, how to perform graph representation learning on the dynamic graph has always been the most challenging problem. Therefore, how to identify the risk of the user based on the dynamic graph to determine whether the user has a risk is a very important problem.

[0004] Therefore, the present specification provides a risk identification method. SUMMARY

[0005] The present specification provides a risk identification method, device, medium, and equipment to partially solve the above problems existing in the prior art.

[0006] The present specification adopts the following technical solutions:

[0007] The present specification provides a risk identification method, comprising:

[0008] determining transaction data of a to-be-identified user, and determining a transaction relationship graph corresponding to the to-be-identified user according to the transaction data; wherein the transaction relationship graph is a dynamic graph;

[0009] inputting the transaction relationship graph into a state space subnetwork of a pre-trained risk identification model, to perform feature extraction on first information corresponding to a first user having a transaction relationship with the to-be-identified user at a historical time through the state space subnetwork, and determine historical features;

[0010] extracting second information corresponding to a second user having a transaction relationship with the to-be-identified user at a current time, determining a current feature, and inputting the historical feature and the current feature into a feature aggregation subnetwork in the risk identification model to perform feature aggregation on the historical feature and the current feature by the feature aggregation subnetwork to determine an aggregated feature;

[0011] inputting the aggregated feature into an identification layer of the risk identification model to determine a risk identification result of the to-be-identified user.

[0012] Optionally, the transaction relationship graph is input into a state space subnetwork of a pre-trained risk identification model to perform feature extraction on first information corresponding to a first user having a transaction relationship with the to-be-identified user at a historical time by the state space subnetwork to determine a historical feature, specifically including:

[0013] determining, according to the transaction relationship graph, a first user having a transaction relationship with the to-be-identified user at a historical time;

[0014] determining first information corresponding to the first user;

[0015] inputting the first information into the state space subnetwork of the pre-trained risk identification model to perform feature extraction on the first information by the state space subnetwork to determine the historical feature.

[0016] Optionally, the first information is input into the state space subnetwork of the pre-trained risk identification model to perform feature extraction on the first information by the state space subnetwork to determine the historical feature, specifically including:

[0017] determining a first time corresponding to the first user;

[0018] determining a time difference between the first time and a current time;

[0019] inputting the first information and the time difference into the state space subnetwork of the pre-trained risk identification model to perform feature extraction on the first information by the state space subnetwork to determine the historical feature.

[0020] Optionally, the state space subnetwork includes a plurality of first network layers;

[0021] inputting the transaction relationship graph into a state space subnetwork of a pre-trained risk identification model to perform feature extraction on first information corresponding to a first user having a transaction relationship with the to-be-identified user at a historical time by the state space subnetwork to determine a historical feature, specifically including:

[0022] determining, according to the transaction relationship graph, a plurality of first users having a transaction relationship with the to-be-identified user at a historical time;

[0023] determining first information corresponding to each first user respectively;

[0024] For each first user, input the first information of the first user into a state space subnetwork of a pre-trained risk identification model, to extract features of the first information of the first user through a first network layer corresponding to the first user in the state space subnetwork, and determine first features of the first user;

[0025] The first features corresponding to the first users respectively are historical features.

[0026] Optionally, the risk identification model further comprises a feature extraction layer;

[0027] extracting features of second information corresponding to a second user having a transaction relationship with the to-be-identified user at a current time, to determine current features, specifically comprising:

[0028] determining the second user having a transaction relationship with the to-be-identified user at the current time according to the transaction relationship graph;

[0029] determining second information corresponding to the second user;

[0030] inputting the second information into the feature extraction layer of the risk identification model to determine the current features.

[0031] Optionally, the feature aggregation subnetwork comprises a first aggregation layer and a second aggregation layer;

[0032] inputting the historical features and the current features into a feature aggregation subnetwork in the risk identification model, to aggregate the historical features and the current features through the feature aggregation subnetwork, and determine aggregated features, specifically comprising:

[0033] inputting the historical features into the feature aggregation subnetwork in the risk identification model, to aggregate the historical features through a first aggregation layer in the feature aggregation subnetwork, to obtain second features, and inputting the current features into the feature aggregation subnetwork in the risk identification model, to aggregate the current features through a second aggregation layer in the feature aggregation subnetwork, to determine third features;

[0034] The second features and the third features are aggregated features.

[0035] Optionally, the pre-trained risk identification model specifically comprises:

[0036] obtaining transaction data of sample users in history as historical data;

[0037] According to the historical data, a transaction relationship graph corresponding to the sample user is determined as a training sample, and a risk situation of the sample user is determined as a label of the training sample;

[0038] The training sample is input into a state space subnet of a risk identification model to be trained, so as to perform feature extraction on third information corresponding to a third user having a transaction relationship with the sample user at a first sample time through the state space subnet, and determine first sample features;

[0039] Feature extraction is performed on fourth information corresponding to a fourth user having a transaction relationship with the sample user at a second sample time, second sample features corresponding to the fourth user are determined, and the first sample features and the second sample features are input into a feature aggregation subnet of the risk identification model to be trained, so as to perform feature aggregation on the first sample features and the second sample features through the feature aggregation subnet, and determine third sample features;

[0040] The third sample features are input into a recognition layer of the risk identification model to be trained, and a first recognition result of the sample user is determined;

[0041] According to the difference between the label and the first recognition result, the risk identification model to be trained is trained.

[0042] The present specification provides a risk identification device, comprising:

[0043] A determination module is configured to determine transaction data of a user to be identified, and determine a transaction relationship graph corresponding to the user to be identified according to the transaction data; wherein the transaction relationship graph is a dynamic graph;

[0044] A representation module is configured to input the transaction relationship graph into a state space subnet of a pre-trained risk identification model, so as to perform feature extraction on first information corresponding to a first user having a transaction relationship with the user to be identified at a historical time through the state space subnet, and determine historical features;

[0045] An aggregation module is configured to perform feature extraction on second information corresponding to a second user having a transaction relationship with the user to be identified at a current time, determine current features, and input the historical features and the current features into a feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features and the current features through the feature aggregation subnet, and determine aggregated features;

[0046] An identification module is configured to input the aggregated features into a recognition layer of the risk identification model, and determine a risk identification result of the user to be identified.

[0047] Optionally, the characterization module is specifically configured to determine, according to the transaction relationship graph, a first user having a transaction relationship with the to-be-identified user at a historical time; determine first information corresponding to the first user; and input the first information into a state space subnetwork of a pre-trained risk identification model to extract features of the first information through the state space subnetwork to determine historical features.

[0048] Optionally, the characterization module is specifically configured to determine a first time corresponding to the first user; determine a time difference between the first time and a current time; and input the first information and the time difference into a state space subnetwork of a pre-trained risk identification model to extract features of the first information through the state space subnetwork to determine historical features.

[0049] Optionally, the state space subnetwork includes a plurality of first network layers.

[0050] The characterization module is specifically configured to determine, according to the transaction relationship graph, a plurality of first users having a transaction relationship with the to-be-identified user at a historical time; determine first information corresponding to each first user; for each first user, input the first information of the first user into a state space subnetwork of a pre-trained risk identification model to extract features of the first information of the first user through a first network layer corresponding to the first user in the state space subnetwork to determine first features of the first user; and determine the first features of the first users as historical features.

[0051] Optionally, the risk identification model further includes a feature extraction layer.

[0052] The aggregation module is specifically configured to determine, according to the transaction relationship graph, a second user having a transaction relationship with the to-be-identified user at a current time; determine second information corresponding to the second user; and input the second information into the feature extraction layer of the risk identification model to determine current features.

[0053] Optionally, the feature aggregation subnetwork includes a first aggregation layer and a second aggregation layer.

[0054] The aggregation module is specifically configured to input the historical features into a feature aggregation subnetwork in the risk identification model to aggregate the historical features through a first aggregation layer in the feature aggregation subnetwork to obtain second features, and input the current features into the feature aggregation subnetwork in the risk identification model to aggregate the current features through a second aggregation layer in the feature aggregation subnetwork to determine third features; and determine the second features and the third features as aggregated features.

[0055] Optionally, the apparatus further includes:

[0056] The training module is used to acquire historical transaction data of sample users and use it as historical data; based on the historical data, it determines the transaction relationship graph corresponding to the sample user and uses it as training samples, and determines the risk status of the sample user and uses it as the annotation of the training samples; the training samples are input into the state space subnet of the risk identification model to be trained, so as to extract features from the third information corresponding to the third user who has a transaction relationship with the sample user at the first sample time through the state space subnet, and determine the first sample features; features are extracted from the fourth information corresponding to the fourth user who has a transaction relationship with the sample user at the second sample time, and the second sample features corresponding to the fourth user are determined; the first sample features and the second sample features are input into the feature aggregation subnet of the risk identification model to be trained, so as to aggregate the first sample features and the second sample features through the feature aggregation subnet, and determine the third sample features; the third sample features are input into the recognition layer of the risk identification model to be trained, and the first recognition result of the sample user is determined; the risk identification model to be trained is trained based on the difference between the annotation and the first recognition result.

[0057] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described risk identification method.

[0058] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the aforementioned risk identification method.

[0059] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0060] The risk identification method provided in this specification involves determining the transaction data of the user to be identified and, based on the transaction data, determining the corresponding transaction relationship graph for the user. The transaction relationship graph is input into the state space subnet of a pre-trained risk identification model to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time, thus determining historical features. Features are then extracted from the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time, determining current features. The historical and current features are then input into the feature aggregation subnet of the risk identification model to aggregate the historical and current features, thus determining aggregated features. Finally, the aggregated features are input into the identification layer of the risk identification model to determine the risk identification result for the user to be identified.

[0061] As can be seen from the above method, when performing risk identification, this method first determines the transaction data of the user to be identified, and then determines the transaction relationship graph corresponding to the user based on the transaction data. The transaction relationship graph is input into the state space subnet of the pre-trained risk identification model to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time, thus determining historical features. Features are then extracted from the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time, thus determining current features. The historical and current features are then input into the feature aggregation subnet of the risk identification model to aggregate the historical and current features, thus determining aggregated features. The aggregated features are then input into the identification layer of the risk identification model to determine the risk identification result for the user to be identified. By extracting features from the first information of the first user through the state space subnet to determine historical features, this method can better utilize the time information in the dynamic graph for feature extraction, aggregate historical and current features, and then perform risk identification based on the aggregated features to determine the risk identification result. This not only improves the degree of freedom in risk identification but also enhances the accuracy of the risk identification result. Attached Figure Description

[0062] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and their descriptions, serving to explain this specification and do not constitute an undue limitation thereof.

[0063] In the picture:

[0064] Figure 1 This is a flowchart illustrating one of the risk identification methods described in this specification.

[0065] Figure 2 This is a schematic diagram of a transaction relationship provided in this specification;

[0066] Figure 3 This is a schematic diagram illustrating the changes in a transaction relationship diagram provided in this specification;

[0067] Figure 4 This is a schematic diagram of another transaction relationship provided in this specification;

[0068] Figure 5 This is a schematic diagram illustrating a risk identification method provided in this specification.

[0069] Figure 6 This is a schematic diagram illustrating a process for determining a first feature as provided in this specification;

[0070] Figure 7 This is a schematic diagram of a feature aggregation process provided in this specification;

[0071] Figure 8 A schematic diagram of a risk identification device provided in this specification;

[0072] Figure 9 The corresponding information provided in this specification Figure 1 A schematic diagram of an electronic device. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0074] The embodiments of this specification provide a method, apparatus, storage medium, and electronic device for risk identification. The technical solutions provided by the embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0075] Figure 1 This is a flowchart illustrating a risk identification method described in this specification, which specifically includes the following steps:

[0076] S100: Determine the transaction data of the user to be identified, and determine the transaction relationship diagram corresponding to the user to be identified based on the transaction data; wherein the transaction relationship diagram is a dynamic diagram.

[0077] In this specification, the device used for risk identification can determine the transaction data of the user to be identified and, based on the transaction data, determine the corresponding transaction relationship diagram of the user to be identified. The device used for risk identification can be a service provider, the service provider's server, or a system; it can also be an electronic device such as a desktop computer or laptop. For ease of description, the risk identification method provided in this specification will be described below using the server as the executing entity. The user to be identified is any one of the users using the transaction or payment functions provided by the service provider. The transaction data is the data generated when the user to be identified conducts a transaction; this transaction data includes transaction data at all times, from the moment the user to be identified first conducts a transaction to the current moment. Of course, the aforementioned transaction data can also be transaction data within a preset time range. This preset time range can be pre-set, encompassing the period before and including the current time. For example, assuming the current time is 12:00 PM on June 3, 2024, the preset time range could be from 1:00 AM to 12:00 PM on June 3, 2024, or from 12:00 PM on June 1, 2024 to 12:00 PM on June 3, 2024. For ease of explanation, the following example uses transaction data within a preset time range. The aforementioned transaction data includes the transaction time, information about the transaction recipient, information about the transaction initiator, and the transaction amount. The transaction initiator can be the aforementioned user to be identified, or it can be another user. Similarly, the transaction recipient can be the aforementioned user to be identified, or it can be another user. In other words, when the transaction initiator is the user to be identified, the transaction recipient can be another user, and vice versa. The information of the transaction initiator may include user name, user ID, user account, gender, age, number of transactions, etc., and the information of the transaction recipient may also include user name, user ID, user account, gender, age, number of transactions, etc.

[0078] In this specification, the aforementioned transaction relationship diagram is a dynamic diagram constructed based on transaction data. This diagram includes information about other users who have transaction relationships with the user to be identified within a preset time range, and the times when these transactions occurred. In other words, the transaction relationship diagram is actually used to store information about other users who have transaction relationships with the user to be identified within a preset time range, and the times when these transactions occurred. Nodes in the transaction relationship diagram represent users and store user information, which may include user name, user ID, user account, gender, age, number of transactions, etc. Of course, each node may also store a timestamp, representing the time when the node appears in the transaction relationship diagram, that is, the time when the node has a transaction relationship with the node corresponding to the user to be identified. Edges between nodes represent the existence of transaction relationships, and these edges may also store the times when these transactions occur. It should be noted that when two users conduct a transaction, it indicates that a transaction relationship exists between the two users, and the time when the transaction occurs is the time when the transaction relationship begins. For ease of explanation, the following example uses nodes storing user information and edges storing the times when transactions occur between nodes. Figure 2 As shown, Figure 2 This is a schematic diagram of a transaction relationship provided in this specification. Figure 2 In this diagram, nodes A through D represent users A through D, and nodes A through D store information corresponding to users A through D respectively. Figure 2 Edges in the diagram represent transaction relationships between nodes. Figure 2 In this context, T0 to T2 represent the time intervals during which transactions occur between nodes (i.e., between users). Specifically, T0 represents the time interval between a transaction between node A (i.e., user A) and node D (i.e., user D), T1 represents the time interval between a transaction between node A and node B (i.e., user B), and T2 represents the time interval between a transaction between node A and node C (i.e., user C). The preset time range is from T0 to T2, and the current time is T2.

[0079] Based on this, when determining the transaction relationship graph corresponding to the user to be identified based on transaction data, the server can determine users who have transaction relationships with the user to be identified within a preset time range, and these users will be considered as candidate users. Then, the information corresponding to the candidate users and the information of the user to be identified are determined. A transaction relationship graph is constructed, consisting of nodes representing the information corresponding to the candidate users and the user to be identified, with the transaction relationship between the candidate users and the user to be identified as edges. The edges in the transaction relationship graph store the time when the transaction relationship occurred between the candidate users and the user to be identified (i.e., the transaction time).

[0080] In this specification, the aforementioned transaction relationship diagram actually encompasses information on transaction changes between other users and the user to be identified within a preset time frame (i.e., information on the user to be identified and users with whom the user has transaction relationships, as well as the transaction times). For example, such as Figure 3 As shown, Figure 3 This is a schematic diagram illustrating the changes in a transaction relationship graph provided in this specification. Assume the current time is T0, and that T0 is the time when the user to be identified (i.e., node A representing user A) first engages in a transaction with another user, or that T0 is the time when the user to be identified first appears. This preset time range only includes T0. Therefore, the transaction relationship graph at this time includes information on the changes in transactions between each other user and the user to be identified at time T0. Figure 3 Figure a shows the transaction relationship diagram at time T0, where node D represents user D. After a period of time, assuming the current time is T1, and T0 is earlier than T1, this preset time range can include both T0 and T1. Therefore, the transaction relationship diagram at this time is a graph that accumulates the information on the changes in transactions between other users and the user to be identified at time T0 and at time T1. That is, the transaction relationship diagram includes the information on the changes in transactions between other users and the user to be identified at both time T0 and T1, which is Figure b. Figure b shows the transaction relationship diagram at time T1, where node B represents user B. After a period of time, assuming the current time is T2, and T1 is earlier than T2, the preset time range can include T0 to T2. Therefore, the transaction relationship diagram at this time is a graph that accumulates the information on the transaction changes between other users and the user to be identified at time T0, the information on the transaction changes between other users and the user to be identified at time T1, and the information on the transaction changes between other users and the user to be identified at time T2. That is, the transaction relationship diagram includes the information on the transaction changes between other users and the user to be identified from time T0 to T2, i.e., Figure c. Figure c is the transaction relationship diagram at time T2, and node C in Figure c represents user C.

[0081] Furthermore, the aforementioned transaction relationship diagram is a dynamic diagram, and the time frame in this diagram is continuous, meaning the preset time range is a continuous time range. To represent the changes in transaction relationships over continuous time and to distinguish between historical and current moments, dashed lines can represent transaction relationships occurring in historical moments, and solid lines can represent transaction relationships occurring in the current moment. Specifically, it can be done as follows: Figure 4 As shown, Figure 4 This is a schematic diagram of another transaction relationship diagram provided in this specification. Figure 3 The content represented by nodes and edges in the above is the same as that in the above Figure 2 The nodes and edges in the code represent the same content, so we won't go into detail here. The preset time range is from T0 to T2. Figure 3In the graph, T2 represents the current time, so the edge corresponding to T2 is a solid line. T0 and T1 represent historical times, so the edges corresponding to T0 and T1 are dashed lines. Based on this, when determining the transaction relationship graph corresponding to the user to be identified based on transaction data, the server can determine users who have transaction relationships with the user to be identified within a preset time range, and these users are considered as candidate users. Then, the information corresponding to the candidate users and the information of the user to be identified are determined. From the candidate users, the first user who had a transaction relationship with the user to be identified at a historical time and the second user who has a transaction relationship with the user to be identified at the current time are determined. An initial graph is constructed with nodes representing the information of the candidate users and the user to be identified, and the transaction relationships between the candidate users and the user to be identified as edges. The edges between the nodes representing the first user and the nodes representing the user to be identified in the initial graph are set as first-type edges, and the edges between the nodes representing the second user and the nodes representing the user to be identified in the initial graph are set as second-type edges. This initial graph is then used as the transaction relationship graph. The first-type edges are represented by dashed lines, and the second-type edges are represented by solid lines. The edges in the transaction relationship graph store the time (i.e., transaction time) when a transaction relationship occurs between the candidate user and the user to be identified.

[0082] Of course, dynamic graphs refer to graph-structured data that changes over time, and they can be represented in various ways. For example, they can be represented as a sequence of snapshots, a list of timestamped edges, or through incremental updates. Therefore, the transaction relationship graph described above can also be represented as a sequence of snapshots, meaning it can include snapshots of subgraphs at several points within a preset time range. Each subgraph is a static graph at each point in time, generated based on the transaction data at that specific moment. Furthermore, the transaction relationship graph can also be represented as a list of timestamped edges, where each edge in the graph has a timestamp list recording the creation or deletion time of that edge. Specifically, taking a transaction relationship graph that includes snapshots of subgraphs within a preset time range as an example, when determining the transaction relationship graph corresponding to the user to be identified based on transaction data, the server can determine the transaction data corresponding to each of the preset time ranges. Based on the transaction data at each time, it can identify users who have a transaction relationship with the user to be identified at that time and use them as candidate users for that time. A subgraph is then constructed with the candidate users and the information corresponding to the user to be identified at that time as nodes, and the transaction relationship between the candidate users and the user to be identified at that time as edges. The subgraphs corresponding to each time point are then used as the transaction relationship graph. Each subgraph or edge in the transaction relationship graph stores the time when a transaction relationship occurred between the candidate users and the user to be identified (i.e., the transaction time). This transaction relationship graph can be a snapshot sequence composed of subgraphs at several times; that is, the server can sort the subgraphs in ascending order of time (from earliest to latest) to obtain a snapshot sequence, which is then used as the transaction relationship graph.

[0083] S102: Input the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time through the state space subnet, and determine the historical features.

[0084] In this specification, the server can input the transaction relationship graph into the state space subnet of a pre-trained risk identification model to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time, thereby determining historical features. The aforementioned risk identification model is a pre-trained model used to determine the risk status of the user to be identified, i.e., whether the user to be identified poses a risk, based on the transaction relationship graph. Since the representation of the first information corresponding to the first user affects the representation of the user to be identified after a transaction relationship occurs, meaning the representation of the first information acts on the representation of the user to be identified, and this effect is time-dependent. The greater the time difference between the moment when the first user and the user to be identified transacted and the current moment, the longer the effect or influence lasts. Conversely, the smaller the time difference between the moment when the first user and the user to be identified transacted and the current moment, the shorter the effect or influence lasts. Therefore, the above-mentioned effect or influence, i.e., historical features, can be determined by the state space subnet in the pre-trained risk identification model. These historical features represent that the representation of the first information corresponding to the first user has an effect or influence on the representation of the user to be identified. Furthermore, these historical features are cumulative, that is, the cumulative effect or influence from the moment when the first user and the user to be identified transacted to the current moment.

[0085] Based on this, the server can determine the first user with a historical transaction relationship with the user to be identified, according to the transaction relationship graph, and determine the first information corresponding to the first user. The first information is then input into the state space subnet of a pre-trained risk identification model to extract features from the first information and determine historical features. Since the aforementioned transaction relationship graph includes information on other users with transaction relationships with the user to be identified within a preset time range and the time of the transaction, the first user can be directly determined through the transaction relationship graph. Specifically, if the transaction relationship graph is... Figure 2 The diagram illustrates that the server can determine the edges where transactions occurred in the historical time frame based on the transaction times stored in the transaction relationship graph, and use these edges as the first edge. It then identifies the nodes corresponding to these first edges and identifies users among those represented by these nodes who are not the users to be identified as the first user. However, if the transaction relationship graph is... Figure 4As shown in the diagram, the server can directly determine the first type of edge in the transaction relationship graph and use it as the first edge. It then determines the node corresponding to this first edge and identifies the user among those represented by this node who is not the user to be identified as the first user. Of course, other representations of the relationship graph can also directly determine the first user, which will not be elaborated upon here. The aforementioned first information refers to the information corresponding to the first user. This first information is the information stored in the node representing the first user in the transaction relationship graph, and may include user name, user identifier, user account, gender, age, number of transactions, etc.

[0086] The aforementioned input of the first information into the state space subnet of the pre-trained risk identification model allows the server to determine the first moment corresponding to the first user by extracting features from the first information through the state space subnet and determining historical features. The time difference between the first moment and the current moment is then determined. The first information and the time difference are then input into the state space subnet of the pre-trained risk identification model to extract features from the first information and determine historical features. This first moment is the time when the first user and the user to be identified have a transaction relationship, i.e., the transaction time, which can be directly determined from the transaction relationship graph. By inputting the time difference between the first moment and the current moment into the state space subnet, the state space subnet can determine the role or influence of the accumulated historical features within the time difference on the representation of the first information corresponding to the first user and the representation of the user to be identified. This role or influence is a cumulative quantity, and the length of the accumulation is the time difference, thereby enhancing the interpretability of time.

[0087] S104: Extract features from the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time, determine the current features, and input the historical features and the current features into the feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features and the current features through the feature aggregation subnet to determine the aggregated features.

[0088] In this specification, the server can extract features from the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time, and determine the current features. Then, the historical features and the current features are input into the feature aggregation subnet of the risk identification model to aggregate the historical features and the current features, and determine the aggregated features. Since the aforementioned transaction relationship diagram includes information on other users who have transaction relationships with the user to be identified within a preset time range and the time of the transaction, the aforementioned second user can be directly determined through the transaction relationship diagram. Specifically, if the transaction relationship diagram is... Figure 2As shown in the diagram, the server can determine the edge where the transaction relationship occurs at the current time based on the transaction time stored in the edge of the transaction relationship graph, and use it as the second edge. It then determines the node corresponding to this second edge and identifies the user among the users represented by that node who is not the user to be identified as the second user. However, if the transaction relationship graph is... Figure 4 As shown in the diagram, the server can directly determine the second type of edge in the transaction relationship graph and use it as the second edge. It then determines the node corresponding to this second edge and identifies the user among those represented by that node who is not the user to be identified as the second user. Of course, other representations of the relationship graph can also directly determine the second user, which will not be elaborated upon here. The aforementioned second information refers to the information corresponding to the second user. This second information is the information stored in the node representing the second user in the transaction relationship graph, and may include user name, user identifier, user account, gender, age, number of transactions, etc.

[0089] The aforementioned current feature refers to the feature of the second information corresponding to the second user. When extracting features from the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time, and determining the current feature, the server can determine the second user who has a transaction relationship with the user to be identified at the current time based on the transaction relationship graph. The second information corresponding to the second user is then determined. This second information is then input into the feature extraction layer of the risk identification model to determine the current feature. The aforementioned risk identification model also includes a feature extraction layer. Of course, the server can also use any existing feature extraction layer to extract features from the second information to determine the current feature; this specification does not impose specific limitations.

[0090] S106: Input the aggregated features into the recognition layer of the risk recognition model to determine the risk recognition result of the user to be identified.

[0091] In this specification, the server can input aggregated features into the identification layer of the risk identification model to determine the risk identification result of the user to be identified. This risk identification result can be either risky or risk-free. After obtaining the risk identification result, the server can implement risk control for the user to be identified based on that result. Specifically, when the risk identification result is risky, the server can determine a risk control strategy based on the result, and then implement risk control for the user to be identified based on that strategy. This risk control strategy can be preset by risk control personnel.

[0092] As can be seen from the above method, when performing risk identification, this application first determines the transaction data of the user to be identified, and then determines the transaction relationship graph corresponding to the user based on the transaction data. The transaction relationship graph is input into the state space subnet of a pre-trained risk identification model to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time, thus determining historical features. Features are then extracted from the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time, determining current features. The historical and current features are then input into the feature aggregation subnet of the risk identification model to aggregate the historical and current features, determining aggregated features. The aggregated features are then input into the identification layer of the risk identification model to determine the risk identification result for the user to be identified. By extracting features from the first information of the first user through the state space subnet to determine historical features, the time information in the dynamic graph can be better utilized for feature extraction, enhancing the interpretability of time, and eliminating the need for an attention mechanism for feature extraction, thus increasing the degree of freedom in risk identification. By aggregating historical and current features and performing risk identification based on the aggregated features, the risk identification results are determined, which increases the freedom of risk identification and helps to control risks for users.

[0093] In this specification, the aforementioned risk identification model may include a state space subnet, a feature aggregation subnet, and an identification layer. The process of risk identification based on the risk identification model can be as follows: Figure 5 As shown, Figure 5 This diagram illustrates a risk identification process provided in this specification. The server inputs the transaction relationship graph of the user to be identified into the state space subnet to determine historical features. Then, it inputs the historical and current features into the feature aggregation subnet to determine the aggregated features. Finally, the aggregated features are input into the identification layer to determine the risk identification result for the user to be identified. The detailed process is the same as described above. Figure 1 The process shown is the same, so I will not repeat it here.

[0094] In this specification, the aforementioned state space subnet may include several first network layers, each corresponding to a user, meaning each first network layer can be used to extract features from the information of each user. Each first network layer functions identically to the aforementioned state space subnet. In fact, each first network layer is equivalent to a state space model, a powerful tool for sequence modeling, particularly suitable for capturing long-term dependencies in sequences. The aforementioned first network layer may be a linear state space model, and may be a HiPPO (Hierarchical Polynomial Projections for Optimal Memory) structure. Therefore, in step S102, the server can determine the first user with a transaction relationship with the user to be identified at a historical time based on the transaction relationship graph. The first information corresponding to the first user is then determined. This first information is then input into the state space subnet of the pre-trained risk identification model to extract features from the first information through the first network layer corresponding to the first user in the state space subnet, thus determining historical features. Specifically, the first information is input into the state space subnet of the pre-trained risk identification model. When extracting features from the first information using the first network layer corresponding to the first user in the state space subnet to determine historical features, the server can determine the first time point corresponding to the first user and the time difference between the first time point and the current time point. Then, the first information and the time difference are input into the state space subnet of the pre-trained risk identification model to extract features from the first information using the first network layer corresponding to the first user in the state space subnet to determine historical features.

[0095] Furthermore, there can be multiple first users. Therefore, in step S102, the server can determine several first users who have transaction relationships with the user to be identified at historical times based on the transaction relationship diagram. The first information corresponding to each first user is determined. Then, for each first user, the first information of that first user is input into the state space subnet of a pre-trained risk identification model. The first information of the first user is then extracted through the first network layer corresponding to that first user in the state space subnet to determine the first feature of that first user. The first features corresponding to each first user are used as historical features. These historical features consist of several first features, each representing the representation of the first information corresponding to each first user and its representation of the user to be identified. Each first feature is a cumulative quantity, that is, the cumulative effect or cumulative influence from the time each first user transacted with the user to be identified to the current time. The process of determining the first features is similar to the process of inputting the first information into the state space subnet of a pre-trained risk identification model to extract features from the first information through the first network layer corresponding to the first user in the state space subnet to determine historical features, and will not be elaborated further here.

[0096] For example, such as Figure 6 As shown, Figure 6 This diagram illustrates a process for determining a first feature as provided in this specification. Assume there are n first users, i.e., first users 1 to n, and the information corresponding to each first user 1 to n is first information 1 to n. The first network layers corresponding to each first user 1 to n are first network layers 1 to n. Therefore, the server can determine several first users, i.e., first users 1 to n, who have transaction relationships with the user to be identified at historical times, based on the transaction relationship graph. The server then determines the first information corresponding to each first user, i.e., first information 1 to n. For each first user, the server inputs the first information of that first user into the state space subnet of a pre-trained risk identification model. The first information of the first user is then extracted through the first network layer corresponding to that first user in the state space subnet to determine the first feature of that first user. For example, for first user 1, the server can input the first information 1 of first user 1 into the state space subnet of the pre-trained risk identification model to extract the first information 1 of first user 1 through the first network layer 1 corresponding to first user 1 in the state space subnet to determine the first feature 1 of first user 1. The first features corresponding to each first user are then used as historical features, i.e., first features 1 to n.

[0097] In this specification, the aforementioned first feature or historical feature may be a single-dimensional feature. Of course, the aforementioned first feature or historical feature may also be a multi-dimensional feature, meaning that the aforementioned first feature or historical feature may include several dimensions of sub-features. Each dimension of sub-feature can be obtained by feature extraction based on each type of first information. Therefore, taking the example of a first feature including several dimensions of sub-features, the aforementioned first information may also include several types of sub-information. When the first information of the first user is input into the state space subnet of the pre-trained risk identification model, and the first network layer corresponding to the first user in the state space subnet performs feature extraction on the first information of the first user to determine the first feature of the first user, the server may, for each type of sub-information included in the first information of the first user, input that sub-information of the first user into the state space subnet of the pre-trained risk identification model, and the first network layer corresponding to the first user in the state space subnet performs feature extraction on that sub-information of the first user to determine the sub-feature of the first user, and use each sub-feature of the first user as the first feature of the first user.

[0098] Furthermore, the aforementioned first network layer may also include several sub-network layers. Therefore, when the sub-information of the first user is input into the state space sub-network of the pre-trained risk identification model, and the first network layer corresponding to the first user in the state space sub-network extracts features from the sub-information of the first user to determine the sub-features of the first user, the server can input the sub-information of the first user into the state space sub-network of the pre-trained risk identification model, and the sub-network layer corresponding to the sub-information of the first user in the state space sub-network extracts features from the sub-information of the first user to determine the sub-features of the first user.

[0099] In this specification, the aforementioned historical features may include several first features, and each first feature has a corresponding time, i.e., a first moment. Therefore, in step S104 above, the historical features and current features are input into the feature aggregation subnet of the risk identification model to aggregate the historical features and current features through the feature aggregation subnet. When determining the aggregated features, the server can determine the first moment corresponding to each first feature. This first moment is the time when the first user and the user to be identified have a transaction relationship, i.e., the transaction time. This first moment can be determined based on the transaction relationship diagram. Then, according to the first moment from early to late, or from small to large, the first features are sorted to obtain a feature sequence. Subsequently, for each first feature in the feature sequence, the first feature and the current feature are input into the feature aggregation subnet of the risk identification model. The feature aggregation subnet performs feature aggregation on the first feature and the current feature to obtain an initial feature. This initial feature is then used as the current feature. The process continues with the next first feature and the new current feature being input into the feature aggregation subnet of the risk identification model. The feature aggregation subnet performs feature aggregation on the next first feature and the new current feature to obtain a new initial feature. This process continues until a termination condition is met, at which point the initial feature at that point is used as the aggregated feature. The termination condition is that a next first feature cannot be determined, meaning all first features in the feature sequence have been aggregated, i.e., all have been input into the feature aggregation subnet.

[0100] In this specification, the aforementioned feature aggregation subnet includes a first aggregation layer and a second aggregation layer. The first aggregation layer is used to aggregate historical features, and the second aggregation layer is used to aggregate current features. Therefore, in step S104, when inputting historical and current features into the feature aggregation subnet of the risk identification model to aggregate historical and current features and determine aggregated features, the server can input historical features into the feature aggregation subnet of the risk identification model to aggregate historical features through the first aggregation layer of the feature aggregation subnet to obtain the second feature, and input current features into the feature aggregation subnet of the risk identification model to aggregate current features through the second aggregation layer of the feature aggregation subnet to determine the third feature. The second and third features are used as aggregated features, specifically as follows: Figure 7 As shown, Figure 7 This is a schematic diagram of a feature aggregation process provided in this specification.

[0101] In addition, the aforementioned feature aggregation subnet may also include a third aggregation layer, which is used to aggregate the second and third features. Therefore, when the second and third features are used as aggregation features, the server can input the second and third features into the third aggregation layer to perform feature aggregation on the second and third features and determine the aggregated features.

[0102] In addition, the aforementioned historical features may include several first features. Therefore, when the historical features are input into the feature aggregation subnet of the risk identification model and the historical features are aggregated through the first aggregation layer in the feature aggregation subnet to obtain the second features, the server can input each first feature into the feature aggregation subnet of the risk identification model so that the first aggregation layer in the feature aggregation subnet can aggregate each first feature to obtain the second features.

[0103] In this specification, there may be multiple second users. Therefore, when extracting features from the second information corresponding to the second users who have a transaction relationship with the user to be identified at the current time, and determining the current feature, the server can determine several second users who have a transaction relationship with the user to be identified at the current time based on the transaction relationship graph. The second information corresponding to each second user is then determined. For each second user, the second information is input into the feature extraction layer of the risk identification model to determine the fourth feature corresponding to that second user. Finally, the second features corresponding to each second user are used as the current feature.

[0104] Based on this, when the current feature is input into the feature aggregation subnet of the risk identification model to perform feature aggregation on the current feature through the second aggregation layer in the feature aggregation subnet to determine the third feature, the server can input each fourth feature into the feature aggregation subnet of the risk identification model to perform feature aggregation on each fourth feature through the second aggregation layer in the feature aggregation subnet to determine the third feature.

[0105] In this specification, there may be multiple users to be identified. Each user can be identified by following the steps S100 to S106 above, which will not be repeated here.

[0106] In this specification, the aforementioned risk identification model can be a pre-trained model. Therefore, when pre-training the risk identification model, the server can obtain historical transaction data of sample users and use it as historical data. Based on the historical data, a transaction relationship graph corresponding to the sample users is determined and used as training samples, and the risk status of the sample users is determined and used as annotations for the training samples. The training samples are input into the state space subnet of the risk identification model to be trained, so that the third information corresponding to the third user who has a transaction relationship with the sample user at the first sample time is extracted through the state space subnet to determine the first sample features. The fourth information corresponding to the fourth user who has a transaction relationship with the sample user at the second sample time is extracted to determine the second sample features corresponding to the fourth user. The first and second sample features are then input into the feature aggregation subnet of the risk identification model to be trained, so that the first and second sample features are aggregated through the feature aggregation subnet to determine the third sample features. The third sample features are input into the recognition layer of the risk identification model to be trained to determine the first recognition result of the sample user. Based on the difference between the annotations and the first recognition result, the risk identification model to be trained is trained.

[0107] The sample users mentioned above are those who use the payment or transaction functions provided by the service provider. The historical data mentioned above can also be transaction data within a pre-set time range. The process of determining the transaction relationship diagram corresponding to the sample users based on historical data and using it as training samples is similar to the process of determining the transaction relationship diagram of the user to be identified based on transaction data in step S100 above, and will not be repeated here. The first sample time is earlier than the second sample time. The process of determining the first identification result based on the training samples is similar to the process described in steps S102 to S106 above, and will not be repeated here. The first identification result can be either risky or risk-free.

[0108] When training the risk identification model based on the difference between the annotation and the first identification result, the server can use a pre-set loss function to determine the function value based on the difference between the annotation and the first identification result, and then train the risk identification model based on the function value.

[0109] The above describes one or more embodiments of a risk identification method provided in this specification. Based on the same concept, this specification also provides corresponding risk identification devices, such as... Figure 8 As shown.

[0110] Figure 8 This specification provides a schematic diagram of a risk identification device, which specifically includes:

[0111] The determining module 200 is used to determine the transaction data of the user to be identified, and to determine the transaction relationship diagram corresponding to the user to be identified based on the transaction data; wherein the transaction relationship diagram is a dynamic diagram;

[0112] The characterization module 202 is used to input the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time through the state space subnet and determine the historical features.

[0113] The aggregation module 204 is used to extract features from the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time, determine the current features, and input the historical features and the current features into the feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features and the current features through the feature aggregation subnet to determine the aggregated features;

[0114] The identification module 206 is used to input the aggregated features into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

[0115] Optionally, the representation module 202 is specifically used to: determine, based on the transaction relationship graph, a first user who has a transaction relationship with the user to be identified at a historical time; determine the first information corresponding to the first user; input the first information into the state space subnet of a pre-trained risk identification model, so as to extract features from the first information through the state space subnet and determine historical features.

[0116] Optionally, the representation module 202 is specifically used to: determine the first moment corresponding to the first user; determine the time difference between the first moment and the current moment; input the first information and the time difference into the state space subnet of a pre-trained risk identification model, so as to extract features from the first information through the state space subnet and determine historical features.

[0117] Optionally, the state space subnet includes several first network layers;

[0118] The representation module 202 is specifically used to: determine, according to the transaction relationship graph, a number of first users who have transaction relationships with the user to be identified at historical times; determine the first information corresponding to each first user; for each first user, input the first information of the first user into the state space subnet of a pre-trained risk identification model, so as to extract features of the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user; and use the first features corresponding to each first user as historical features.

[0119] Optionally, the risk identification model further includes a feature extraction layer;

[0120] The aggregation module 204 is specifically used to: determine, based on the transaction relationship diagram, a second user who has a transaction relationship with the user to be identified at the current time; determine the second information corresponding to the second user; and input the second information into the feature extraction layer of the risk identification model to determine the current feature.

[0121] Optionally, the feature aggregation subnet includes a first aggregation layer and a second aggregation layer;

[0122] The aggregation module 204 is specifically used to: input the historical features into the feature aggregation subnet of the risk identification model, so as to perform feature aggregation on the historical features through the first aggregation layer in the feature aggregation subnet to obtain the second feature; and input the current features into the feature aggregation subnet of the risk identification model, so as to perform feature aggregation on the current features through the second aggregation layer in the feature aggregation subnet to determine the third feature; and use the second feature and the third feature as aggregated features.

[0123] Optionally, the device further includes:

[0124] Training module 208 is used to acquire historical transaction data of sample users and use it as historical data; based on the historical data, determine the transaction relationship graph corresponding to the sample user and use it as training samples, and determine the risk status of the sample user and use it as the annotation of the training samples; input the training samples into the state space subnet of the risk identification model to be trained, so as to extract features from the third information corresponding to the third user who has a transaction relationship with the sample user at the first sample time through the state space subnet, and determine the first sample features; extract features from the fourth information corresponding to the fourth user who has a transaction relationship with the sample user at the second sample time, and determine the second sample features corresponding to the fourth user; input the first sample features and the second sample features into the feature aggregation subnet of the risk identification model to be trained, so as to aggregate the first sample features and the second sample features through the feature aggregation subnet, and determine the third sample features; input the third sample features into the recognition layer of the risk identification model to be trained, and determine the first recognition result of the sample user; train the risk identification model to be trained based on the difference between the annotation and the first recognition result.

[0125] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 The method for risk identification is shown.

[0126] This instruction manual also provides Figure 9 The diagram shows a schematic structural representation of the electronic device. Figure 9 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for the business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above-mentioned functions. Figure 1 The method for risk identification is shown. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0127] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0128] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0129] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0130] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0131] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0133] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0134] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes ​ The steps of the function specified in one or more boxes.

[0135] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0136] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0137] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0138] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0139] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0140] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0141] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0142] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for risk identification, comprising: The transaction data of the user to be identified is determined, and a transaction relationship diagram corresponding to the user to be identified is determined based on the transaction data; wherein the transaction relationship diagram is a dynamic diagram. The transaction relationship graph is input into the state space subnet of the pre-trained risk identification model, so as to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time through the state space subnet, and determine the historical features. Feature extraction is performed on the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time to determine the current feature. The historical features and the current feature are then input into the feature aggregation subnet of the risk identification model to perform feature aggregation on the historical features and the current feature through the feature aggregation subnet to determine the aggregated feature. The feature aggregation subnet includes a first aggregation layer and a second aggregation layer. The historical features are input into the feature aggregation subnet to perform feature aggregation on the historical features through the first aggregation layer to obtain the second feature. The current feature is input into the feature aggregation subnet to perform feature aggregation on the current feature through the second aggregation layer to determine the third feature. The second feature and the third feature are used as the aggregated feature. The aggregated features are input into the recognition layer of the risk recognition model to determine the risk recognition result of the user to be identified.

2. The method as described in claim 1, wherein the transaction relationship graph is input into the state space subnet of a pre-trained risk identification model, and features are extracted from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time through the state space subnet to determine historical features, specifically including: Based on the transaction relationship diagram, identify the first user who has a transaction relationship with the user to be identified at a historical time. Determine the first information corresponding to the first user; The first information is input into the state space subnet of a pre-trained risk identification model to extract features from the first information and determine historical features.

3. The method as described in claim 2, wherein the first information is input into the state space subnet of a pre-trained risk identification model, and features are extracted from the first information through the state space subnet to determine historical features, specifically including: Determine the first moment corresponding to the first user; Determine the time difference between the first moment and the current moment; The first information and the time difference are input into the state space subnet of a pre-trained risk identification model to extract features from the first information and determine historical features.

4. The method as described in claim 1, wherein the state space subnet comprises a plurality of first network layers; The transaction relationship graph is input into the state space subnet of a pre-trained risk identification model to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time through the state space subnet, and to determine historical features, specifically including: Based on the transaction relationship diagram, a number of first users who have transaction relationships with the user to be identified at historical times are determined; Determine the first information corresponding to each first user; For each first user, the first information of the first user is input into the state space subnet of the pre-trained risk identification model, so that the first information of the first user is extracted through the first network layer corresponding to the first user in the state space subnet, and the first feature of the first user is determined. The first feature corresponding to each first user is taken as the historical feature.

5. The method as described in claim 1, wherein the risk identification model further includes a feature extraction layer; Feature extraction is performed on the second information corresponding to the second user who has a transaction relationship with the user to be identified at the current time to determine the current features, specifically including: Based on the transaction relationship diagram, determine the second user who has a transaction relationship with the user to be identified at the current time; Determine the second information corresponding to the second user; The second information is input into the feature extraction layer of the risk identification model to determine the current feature.

6. The method as described in claim 1, wherein the risk identification model is pre-trained, specifically includes: Obtain historical transaction data of sample users and use it as historical data; Based on the historical data, a transaction relationship graph corresponding to the sample user is determined and used as a training sample, and the risk status of the sample user is determined and used as a label for the training sample; The training samples are input into the state space subnet of the risk identification model to be trained, so as to extract features of the third information corresponding to the third user who has a transaction relationship with the sample user at the first sample time through the state space subnet, and determine the features of the first sample. Feature extraction is performed on the fourth information corresponding to the fourth user who has a transaction relationship with the sample user at the second sample time to determine the second sample feature corresponding to the fourth user. The first sample feature and the second sample feature are then input into the feature aggregation subnet of the risk identification model to be trained, so as to perform feature aggregation on the first sample feature and the second sample feature through the feature aggregation subnet to determine the third sample feature. The third sample features are input into the recognition layer of the risk recognition model to be trained to determine the first recognition result of the sample user; The risk identification model to be trained is trained based on the difference between the annotation and the first identification result.

7. A risk identification device, comprising: The determination module is used to determine the transaction data of the user to be identified, and to determine the transaction relationship diagram corresponding to the user to be identified based on the transaction data; wherein the transaction relationship diagram is a dynamic diagram; The representation module is used to input the transaction relationship graph into the state space subnet of the pre-trained risk identification model, so as to extract features from the first information corresponding to the first user who has a transaction relationship with the user to be identified at a historical time through the state space subnet and determine the historical features. An aggregation module is used to extract features from second information corresponding to a second user who has a transaction relationship with the user to be identified at the current time, determine the current feature, and input the historical features and the current feature into a feature aggregation subnet in the risk identification model, so as to perform feature aggregation on the historical features and the current feature through the feature aggregation subnet to determine the aggregated feature; wherein, the feature aggregation subnet includes a first aggregation layer and a second aggregation layer; the historical features are input into the feature aggregation subnet, so as to perform feature aggregation on the historical features through the first aggregation layer to obtain a second feature, and the current feature is input into the feature aggregation subnet, so as to perform feature aggregation on the current feature through the second aggregation layer to determine a third feature; the second feature and the third feature are used as the aggregated feature; The identification module is used to input the aggregated features into the identification layer of the risk identification model to determine the risk identification result of the user to be identified.

8. The apparatus of claim 7, wherein the characterization module is specifically configured to: determine, based on the transaction relationship graph, a first user having a transaction relationship with the user to be identified at a historical time; determine first information corresponding to the first user; input the first information into the state space subnet of a pre-trained risk identification model, so as to extract features from the first information through the state space subnet and determine historical features.

9. The apparatus of claim 8, wherein the characterization module is specifically configured to: determine a first moment corresponding to the first user; determine the time difference between the first moment and the current moment; input the first information and the time difference into the state space subnet of a pre-trained risk identification model, so as to extract features from the first information through the state space subnet and determine historical features.

10. The apparatus of claim 7, wherein the state space subnet comprises a plurality of first network layers; The representation module is specifically used to: determine, based on the transaction relationship graph, a number of first users who have transaction relationships with the user to be identified at historical times; determine the first information corresponding to each first user; for each first user, input the first information of the first user into the state space subnet of a pre-trained risk identification model, so as to extract features of the first information of the first user through the first network layer corresponding to the first user in the state space subnet, and determine the first feature of the first user; and use the first features corresponding to each first user as historical features.

11. The apparatus of claim 7, wherein the risk identification model further comprises a feature extraction layer; The aggregation module is specifically used to: determine, based on the transaction relationship graph, a second user who has a transaction relationship with the user to be identified at the current time; determine the second information corresponding to the second user; and input the second information into the feature extraction layer of the risk identification model to determine the current feature.

12. The apparatus of claim 7, further comprising: The training module is used to acquire historical transaction data of sample users and use it as historical data. Based on the historical data, a transaction relationship graph corresponding to the sample user is determined and used as a training sample, and the risk status of the sample user is determined and used as a label for the training sample; The training samples are input into the state space subnet of the risk identification model to be trained, so as to extract features of the third information corresponding to the third user who has a transaction relationship with the sample user at the first sample time through the state space subnet, and determine the features of the first sample. Feature extraction is performed on the fourth information corresponding to the fourth user who has a transaction relationship with the sample user at the second sample time to determine the second sample feature corresponding to the fourth user. The first sample feature and the second sample feature are then input into the feature aggregation subnet of the risk identification model to be trained, so as to perform feature aggregation on the first sample feature and the second sample feature through the feature aggregation subnet to determine the third sample feature. The third sample feature is then input into the identification layer of the risk identification model to be trained to determine the first identification result of the sample user. The risk identification model to be trained is then trained based on the difference between the annotation and the first identification result.

13. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 6.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 6.

Images