Information processing method and device, equipment, storage medium and program product

Abstract

The invention discloses an information processing method and device, equipment, a storage medium and a program product, and belongs to the technical field of big data. The method comprises: in response to an exception identification request, querying target to-be-evaluated information of a target object from a preset graph database, the target to-be-evaluated information comprising information of the target object, graph structure information of the target object in the graph database, a correlation between the target object and an associated entity, and information of the associated entity, the associated entities comprise a target resource replacement entity, a target communication information entity and a target event entity; inputting the target to-be-evaluated information into a preset anomaly recognition model; obtaining an exception score corresponding to the target to-be-evaluated information through an exception recognition model according to a pre-fitted corresponding relationship between the to-be-evaluated information and an exception recognition score; and generating an exception recognition result of the target object based on the exception score. According to the embodiment of the invention, the efficiency and accuracy of anomaly recognition can be improved.

Description

Technical Field

[0001] The present application belongs to the field of big data technology, and in particular relates to an information processing method, device, equipment, storage medium and program product. Background Art

[0002] In scenarios such as users handling resource exchange services at resource exchange service processing equipment, users providing resource guarantees to each other, and users exchanging resources with each other, it is usually necessary to identify abnormalities of related users to reduce risks.

[0003] When performing anomaly identification, it is often necessary to process a large amount of complex relationship data between users and other users and resource replacement business processing devices.

[0004] At present, complex relational data involved in anomaly identification is usually processed with the help of relational databases. However, the data model of relational databases is mainly based on tables, and data is queried through multi-table connections, which not only increases the complexity of queries, but also may lead to decreased query performance, especially when the amount of data is large. In addition, relational databases are difficult to intuitively display the complex relationship network between entities. As a result, the potential relationship between entities may be ignored, resulting in low accuracy of anomaly identification. Summary of the invention

[0005] The embodiments of the present application provide an information processing method, apparatus, device and computer storage medium, which can improve the efficiency and accuracy of anomaly identification.

[0006] In a first aspect, an embodiment of the present application provides an information processing method, including:

[0007] In response to the abnormality identification request, query the target information to be evaluated of the target object from the preset graph database, the target information to be evaluated includes information of the target object, graph structure information of the target object in the graph database, correlation between the target object and the associated entity, and information of the associated entity, wherein the graph structure information includes node degree and clustering coefficient, the associated entity includes target resource replacement entity, target communication information entity and target event entity, and the related relationship includes relationship type and relationship strength;

[0008] Input the target information to be evaluated into the preset anomaly recognition model;

[0009] Through the anomaly recognition model, according to the pre-fitted correspondence between the information to be evaluated and the anomaly recognition score, the anomaly score corresponding to the target information to be evaluated is obtained;

[0010] Generate anomaly identification results for the target object based on the anomaly score.

[0011] In a possible implementation, the preset graph database includes a plurality of preset nodes and edges for connecting the preset nodes, the preset nodes are used to represent entity data, the entity data includes entity identifiers and entity information; the edges are used to represent the correlation between entities;

[0012] In response to the anomaly identification request, query the target object's target information to be evaluated from the preset graph database, including:

[0013] According to the entity identifier of the target object, determining a target preset node corresponding to the target object from a plurality of preset nodes;

[0014] Traversing the target edge connected to the target preset node, determining at least one associated preset node of the target preset node, where the associated preset node is a preset node corresponding to the associated entity;

[0015] Read the target object information from the target preset node;

[0016] According to the number of target edges, determine the node degree of the target object in the graph database;

[0017] Determine the clustering coefficient of the target object in the graph database according to the connection relationship between each associated preset node;

[0018] Read the relevant relationship between the target object and the associated entity from the target edge;

[0019] Read the information of the associated entity from the associated preset node.

[0020] In a possible implementation, in response to the exception identification request, before querying the target information to be evaluated of the target object from the preset graph database, the method further includes:

[0021] Get entity data of multiple preset resource replacement entities;

[0022] Based on the entity data of the plurality of preset resource replacement entities, generating a plurality of preset nodes corresponding to the plurality of preset resource replacement entities respectively;

[0023] Determining a plurality of preset communication information entities and a plurality of preset event entities associated with a plurality of preset resource replacement entities;

[0024] Obtaining entity data of a plurality of preset communication information entities and a plurality of preset event entities;

[0025] Based on the entity data of the plurality of preset communication information entities and the plurality of preset event entities, generate a plurality of preset nodes corresponding to the plurality of preset communication information entities and the plurality of preset event entities respectively;

[0026] According to the correlation between the plurality of preset resource replacement entities, the plurality of preset communication information entities, and the plurality of preset event entities, edges for connecting the preset nodes are generated to obtain a knowledge graph;

[0027] Store the knowledge graph in the preset graph database.

[0028] In a possible implementation manner, determining a plurality of preset communication information entities and a plurality of preset event entities related to a plurality of preset resource replacement entities includes:

[0029] Acquire the communication data and resource replacement behavior data of each preset resource replacement entity, wherein the communication data includes communication information; the resource replacement behavior data includes events related to the resource replacement behavior;

[0030] Extracting communication information from the communication data of each preset resource replacement entity to obtain a plurality of preset communication information entities;

[0031] Events are extracted from the resource replacement behavior data of each preset resource replacement entity to obtain a plurality of preset event entities.

[0032] In a possible implementation, the communication data also includes the communication relationship, and the resource replacement behavior data also includes the behavior information of the resource replacement entity in the event;

[0033] According to the correlation between the plurality of preset resource replacement entities, the plurality of preset communication information entities and the plurality of preset event entities, edges for connecting the preset nodes are generated, including:

[0034] Determine, according to the communication data of each preset resource replacement entity, a first correlation between each preset resource replacement entity and a second correlation between each preset resource replacement entity and each preset communication information entity;

[0035] Determining, according to the resource replacement behavior data of each preset resource replacement entity, a third correlation relationship between each preset resource replacement entity and each preset event entity;

[0036] According to the first correlation, the second correlation and the third correlation, edges for connecting the preset nodes are generated.

[0037] In a possible implementation, after generating an anomaly recognition result of the target object based on the anomaly score, the method further includes:

[0038] Based on the target information to be evaluated and the abnormal identification results, a visual evaluation report of the target object is generated.

[0039] In a second aspect, an embodiment of the present application provides an information processing device, including:

[0040] A query module, configured to query target information to be evaluated of a target object from a preset graph database in response to an abnormality identification request, wherein the target information to be evaluated includes information of the target object, graph structure information of the target object in the graph database, correlation between the target object and associated entities, and information of the associated entities, wherein the graph structure information includes node degree and clustering coefficient, the associated entities include target resource replacement entities, target communication information entities, and target event entities, and the correlation includes relationship type and relationship strength;

[0041] An input module, used to input the target information to be evaluated into a preset anomaly recognition model;

[0042] A processing module, used to obtain an anomaly score corresponding to the target information to be evaluated according to the pre-fitted correspondence between the information to be evaluated and the anomaly recognition score through an anomaly recognition model;

[0043] The generation module is used to generate anomaly recognition results of the target object based on the anomaly score.

[0044] In a third aspect, an embodiment of the present application provides an information processing device, the device comprising:

[0045] A processor and a memory storing computer program instructions; when the processor executes the computer program instructions, any one of the above information processing methods is implemented.

[0046] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, any one of the above-mentioned information processing methods is implemented.

[0047] In a fifth aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to perform any one of the above-mentioned information processing methods.

[0048] The information processing method, device, equipment and computer storage medium of the embodiment of the present application can query the target information to be evaluated of the target object from the preset graph database in response to the abnormal identification request. The target information to be evaluated includes the information of the target object, the graph structure information of the target object in the graph database, the correlation between the target object and the associated entity, and the information of the associated entity. In this way, the target information to be evaluated of the target object can be quickly queried with the help of the powerful query performance of the graph database, thereby improving the efficiency of abnormal identification. The above-mentioned graph structure information includes node degree and clustering coefficient, the associated entity includes the target resource replacement entity, the target communication information entity and the target event entity, and the correlation includes the relationship type and the relationship strength. In this way, the target information to be evaluated can be mined with the help of the powerful expression ability of the graph database, reducing the risk of ignoring the potential relationship between entities. Then the target information to be evaluated is input into the preset abnormal identification model. Through the abnormal identification model, according to the correspondence between the pre-fitted information to be evaluated and the abnormal identification score, the abnormal score corresponding to the target information to be evaluated is obtained. The abnormal identification result of the target object is generated based on the abnormal score. The target information to be evaluated includes not only the correlation between the target resource replacement entity and the target object, but also the correlation between the target communication information entity and the target event entity and the target object. By analyzing the target information to be evaluated through the anomaly recognition model, the relationship data between the target object and other entities can be deeply mined from multiple angles. Further combined with the relationship network graph structure information of the target object, the risk of abnormal data being ignored can be reduced. This is conducive to improving the accuracy of anomaly recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0050] Figure 1 It is a schematic diagram of the architecture of an information processing system provided by an embodiment of the present application;

[0051] Figure 2 is a schematic diagram of a relationship network in an information processing method provided in another embodiment of the present application;

[0052] Figure 3 is a schematic diagram of a relationship network in an information processing method provided in yet another embodiment of the present application;

[0053] Figure 4 is a flowchart of an information processing method provided by yet another embodiment of the present application;

[0054] Figure 5is a structural diagram of an information processing device provided by yet another embodiment of the present application;

[0055] Figure 6 It is a structural diagram of an information processing device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0056] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0057] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0058] It should be noted that the acquisition, storage, use and processing of data in the embodiments of the present application are in compliance with the relevant provisions of national laws and regulations.

[0059] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0060] In scenarios such as users handling resource exchange services at resource exchange service processing equipment, users providing resource guarantees to each other, and users exchanging resources with each other, it is usually necessary to identify abnormalities of related users to reduce risks.

[0061] When performing anomaly identification, it is often necessary to process a large amount of complex relationship data between users and other users and resource replacement business processing devices.

[0062] At present, complex relational data involved in anomaly identification is usually processed with the help of relational databases. Exemplarily, the implementation scheme of processing complex relational data involved in anomaly identification with the help of relational databases may include data modeling and data collection and collation. Among them, data modeling may include designing a reasonable database table structure according to the needs of anomaly identification. The database table structure may generally include a user information table, a resource transfer record table, a resource replacement record table, etc., and the association relationship between the tables is established through primary keys and foreign keys. Data collection and collation may include collecting user data from various data sources, and cleaning, collating and converting to ensure the accuracy and consistency of the data.

[0063] When dealing with complex relationships involved in credit assessment (such as resource exchange relationships and social relationships between users), relational databases need to query data through multi-table connections, which not only increases the complexity of the query, but may also lead to a decrease in query performance, especially when the amount of data is large. In scenarios where real-time analysis of user abnormalities is required, relational databases may be difficult to meet real-time requirements due to query performance limitations. In addition, in anomaly identification, a comprehensive and intuitive relationship network is crucial for identifying potential risks and assessing user credit status. However, the data model of relational databases is mainly based on tables, which makes it difficult to intuitively display the complex relationship network between entities, resulting in the potential relationships between entities being ignored, resulting in low accuracy in anomaly identification.

[0064] Moreover, as the business related to anomaly identification develops, the data model may change frequently. The relational database needs to define the table structure in advance, and its scalability and flexibility may be limited to certain extent for rapidly changing business needs.

[0065] In order to solve the problems of the prior art, the embodiments of the present application provide an information processing method, apparatus, device and computer storage medium.

[0066] The information processing method provided in the embodiment of the present application, the device executing the method may be an information processing device, or a partial module in the information processing device for executing the information processing method. In the embodiment of the present application, the information processing method provided in the embodiment of the present application is described in detail by taking the information processing device executing the information processing method as an example.

[0067] The information processing method of the embodiment of the present application can be based on the following Figure 1 The information processing system architecture shown is implemented.

[0068] In one embodiment, Figure 1 As shown, the information processing system may include a data warehouse module 101 , a graph database module 102 , an anomaly assessment module 103 , and an application module 104 .

[0069] The data warehouse module 101 may be responsible for data cleaning, conversion, and loading, and integrating multi-source heterogeneous data into a format recognizable by a graph database.

[0070] The graph database module 102 may use a specialized graph database system to store and manage entities and their relationship networks.

[0071] Graph databases can use graph structures to represent data, where entities are represented as nodes and the relationships between entities are represented as edges. This data structure is suitable for processing complex relational data and can efficiently store, query and analyze nodes and their connections. Through graph databases, complex relational networks such as user credit maps and guarantee networks can be constructed to provide comprehensive and intuitive data support for anomaly identification. At the same time, during the anomaly identification process, institutions need to quickly obtain users' credit information in order to conduct real-time resource replacement business processing and risk management. Institutions also need to make intelligent decisions based on complex data relationships, such as resource replacement business processing, quota adjustment, risk control, etc. Graph databases are optimized for querying relational data and can provide efficient query performance. They can also be combined with technologies such as machine learning and artificial intelligence to discover potential abnormal patterns, user behavior patterns, etc. through algorithms such as graph mining and link prediction, providing scientific decision-making basis for institutions. At the same time, graph databases can also be integrated with intelligent decision-making systems to realize automated and intelligent resource replacement business processing and risk management processes.

[0072] In addition, the abnormal risk status of users changes dynamically, and the relationships in their relationship networks also change over time. Graph databases support the monitoring function of dynamic relationship networks and can capture the change information in the user update network in real time. Through the real-time query and update mechanism of graph databases, institutions can promptly detect changes in users' abnormal risk status and take corresponding risk control measures. This dynamic monitoring capability helps institutions improve business security.

[0073] The abnormality assessment module 103 can perform complex graph query and analysis based on the graph database to assess the credit risk of the user.

[0074] The application module 104 can provide a user interface to display anomaly identification results, support user query and report generation, and be used in scenarios such as resource replacement business approval, resource replacement quota adjustment, and resource replacement risk identification.

[0075] According to the information processing system of the above-mentioned implementation mode, the data warehouse module, graph database module, anomaly assessment module, and application module are used as a whole to disassemble the anomaly identification process, and the data can be traced layer by layer. The information processing system stores relational data based on the graph database. As a result, not only can the relationship between users be intuitively displayed based on the relationship map provided by the graph database, making the results of credit assessment easier to understand and analyze, but also the query speed can be effectively improved with the help of the powerful query capability of the graph database, which is conducive to the realization of real-time query analysis of the relationship. In addition, the above-mentioned information processing system can also support flexible changes in data models. As the business develops, new nodes and edges can be added to expand the relationship network without redesigning the entire database structure, which improves the scalability and flexibility of the system.

[0076] In one embodiment, the logical structure of the graph database system can be divided into a data module and a schema module. In the data module, data can be expressed in the form of "entity-relationship-entity" or "entity-attribute-value", which can be called a "triplet". All data stored in the graph database can form a huge entity relationship network.

[0077] The pattern module is above the data module. The pattern module stores refined knowledge. An ontology library is usually used to manage the pattern module of a graph database. The ontology library's support for axioms, rules, and constraints is used to standardize the connections between entities, relationships, and entity types and attributes. The ontology library's position in a graph database is equivalent to the mold of a knowledge base. A knowledge base with an ontology library has less redundant knowledge.

[0078] Taking the construction of the ontology library of risk control as an example, we can first build an ontology model, that is, define the common concepts of the industry as entities and define the relationships between entities.

[0079] Exemplarily, when performing risk control, the core subject may be a user who applies for resource replacement, and the user may include an individual user and an enterprise user. In the abnormal identification of risk control, risk assessment may be performed through the user's basic information, behavior information, business conditions, social relations, etc. Therefore, entities may be defined to include core entities related to resource replacement business and basic information entities. Resource replacement business may include credit resource replacement business and / or physical resource replacement business. Core entities may include resource replacement entities and event entities, and resource replacement entities may include, for example, individual users, enterprise users, resource replacement accounts, resource replacement business processing equipment, physical replacement resources (such as collateral), etc. Event entities may include, for example, resource replacement business application events, resource dispute events, etc. Basic information entities may include, for example, communication information entities such as telephone numbers, email addresses, and regional information (such as mailing addresses). The relationship between entities may include interpersonal relationships, subordinate relationships, related relationships between individuals and enterprises, event participation relationships, etc. and their relationship strengths.

[0080] After the ontology model is built, it can be verified by comparing it with the actual business to ensure that the ontology model can correctly describe the current business and cover all business processes.

[0081] When executing information processing methods based on the information processing system architecture, data flows into the information processing system from multiple sources, and after being processed by the data warehouse module, it is converted into nodes (such as individuals, enterprises, transaction records and other entities) and edges (such as resource replacement relationships, resource guarantee relationships, social relationships, etc.) in the graph. The graph database module is responsible for storing these nodes and edges to form a relationship network. The anomaly assessment module can use a graph query language (such as Cypher) to traverse and query the graph database, identify potential anomalies, calculate anomaly scores, and generate anomaly identification results. The anomaly identification results can be presented to users through the application module to support further decision analysis.

[0082] In one embodiment, before data processing is performed through the data warehouse module, a graph data model that meets the requirements of anomaly identification can be pre-designed, and an Extract-Transform-Load (ETL) tool that meets the requirements of the graph data model can be developed. The graph data model can specify the node type and edge type, and the ETL tool can be used to convert the original data into the format required by the graph data model, form a knowledge graph, and load it into the graph database. The construction of the knowledge graph is the prerequisite for the application of the knowledge graph. The main work of the construction is to extract data from different data sources according to the rules specified by the ontology model. For the knowledge graph in the vertical field, the main source of data is the data of the business itself, which is usually the private data of the organization stored in a structured form. Through ETL processing, the business data can be extracted and converted into graph data, and a knowledge graph can be formed.

[0083] In one embodiment, the graph query language is used to traverse and query the graph database to identify potential anomalies, which can be achieved through graph query and analysis technology. Specifically, the graph query language provided by the graph database can be used to write query statements to traverse the relationship network and find potential anomalies. For example, all users who have resource transfer records with high-risk users can be queried, or the influence index of a specific user in the relationship network can be calculated to assess the risk of abnormal behavior.

[0084] In one embodiment, the calculation of the anomaly score can be implemented by an anomaly scoring algorithm. Exemplarily, the anomaly scoring algorithm can be designed and implemented by combining the relationship network information in the graph database and traditional anomaly scoring factors (such as resource growth information, the ratio of replaced resources to held resources, etc.). The algorithm can comprehensively evaluate the user's abnormal behavior risk based on graph structure features (such as node degree, clustering coefficient, etc.) and relationship strength (such as the amount of transferred resources, resource transfer frequency, etc.).

[0085] In one example, an anomaly recognition model can be constructed by an anomaly scoring algorithm, and an anomaly score can be calculated by the anomaly recognition model. The anomaly recognition model can be constructed based on a machine learning or artificial intelligence algorithm. Before anomaly scoring is performed by the anomaly recognition model, the anomaly recognition model needs to be trained. Exemplarily, the training step of the anomaly recognition model can include the following steps S10 to S30.

[0086] S10, obtaining information to be evaluated of multiple sample objects and first abnormality scores corresponding to the multiple information to be evaluated.

[0087] The information to be evaluated may include information of preset objects obtained from a query in a graph database, graph structure information of preset objects in the graph database, correlation between preset objects and associated entities, and information of associated entities. The graph structure information may include node degrees and clustering coefficients. Associated entities may include preset resource replacement entities, preset communication information entities, and preset event entities. The correlation may include relationship types and relationship strengths. The first anomaly score may include an anomaly score corresponding to the information to be evaluated, determined according to business rules.

[0088] S20, creating anomaly recognition model training samples using the to-be-evaluated information of each sample object and the first anomaly score of each sample object.

[0089] S30, training an anomaly recognition model according to a plurality of anomaly recognition model training samples to obtain a trained anomaly recognition model.

[0090] In step S30, training an abnormality recognition model according to a plurality of abnormality recognition model training samples can be achieved by methods known in the art. Exemplarily, each abnormality recognition model training sample can be input into the abnormality recognition model, and the abnormality recognition model can calculate the second abnormality score corresponding to each abnormality recognition sample according to the preset correspondence between the information to be evaluated and the abnormality recognition score. According to the first abnormality score and the second abnormality score corresponding to each abnormality recognition sample, the loss function value of the abnormality recognition model is determined. According to the loss function value, the correspondence between the information to be evaluated and the abnormality recognition score in the abnormality recognition model is adjusted until the training stop condition is met to obtain a trained abnormality recognition model. The specific training stop condition can be selected according to the needs of the user, for example, it can be that the number of iterations reaches a certain value, or the loss function of the model reaches a preset value, which is not limited here.

[0091] In one embodiment, the functions of the application module can be implemented based on user interaction and report generation technology. Specifically, a user-friendly interactive interface can be developed to support users to input query conditions, view abnormal identification results and generate abnormal assessment reports. Exemplarily, the interactive interface can provide an intuitive graphical display function, such as displaying the relationship network diagram of the queried user, the abnormal score trend diagram, etc., to help users better understand the abnormal identification results. For example, a user can initiate an abnormal identification request through a user interface. The user interface can forward the request to the abnormal assessment module. The abnormal assessment module can query relevant data from the graph database, for example, asynchronous query can be performed through a message queue or the like. The graph database module can return relevant relationship network data in response to the query request of the abnormal assessment module. The abnormal assessment module can use the relationship network data to run the abnormal scoring algorithm, calculate the abnormal score, and generate the abnormal identification result. Subsequently, the abnormal assessment module can return the abnormal score and abnormal identification result to the user interface for the user interface to display to the user.

[0092] In one embodiment, in addition to anomaly identification, the information processing system architecture can also provide functions such as user profiling, related party detection, user mining, and risk prediction.

[0093] For example, when creating a user profile, the user's name can be directly searched in the graph database. Figure 2 As shown, the relationship network diagram of the user can be obtained through the graph database to obtain the basic information portrait of the user, such as telephone number, address, related parties and other information.

[0094] For example, when performing related party exploration, the user's related party information can be investigated based on the relationship network diagram in the graph database. For example, during the review of resource exchange business, the related party information of the user who applied for resource exchange contains resource dispute events, such as litigation events of loan disputes, too many guarantors and other risk points that can be paid attention to. After the resources are issued, the user may lose contact and cannot be contacted through the information submitted during the business processing. In this case, based on Figure 3 The relationship network diagram shown in the figure explores more "deep" related parties to find the lost users.

[0095] For example, when mining potential users, a social network can be established based on existing users, and a relationship network model of the graph can be defined based on different communication methods and frequencies. Through the relationship network model, relevant social mining can be performed on the user's relatives, friends, colleagues, classmates, strangers, etc. to evaluate the closeness of the relationship; related contacts and their hobbies can also be mined based on existing special users; or an organization with common hobbies can be found among existing users, so that service strategies can be formulated in a targeted manner for a certain part or a class of people.

[0096] For example, in the financial field, there may be situations where users provide false information, engage in organized abnormal behavior, etc., resulting in the low accuracy of the original risk prediction and risk avoidance solutions through single-point users. In the field of risk prediction, user-related data sources can be connected, and structured data of a graph database containing multiple data sources can be constructed. For example, the user's basic information can be integrated, and the user's consumption records, behavior records, relationship information, online log information, etc. can be integrated into structured relationship network data for analysis and prediction. By constructing relationship network data from multiple data sources, a comprehensive offline statistical analysis of the user's massive risk data can be performed, the result feedback of risk operations can be collected by subject elements, a risk feature information database can be established, and risk models and rules can be optimized, so as to timely avoid risks in the resource replacement processing and transaction stages.

[0097] The following will continue to introduce the information processing method provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0098] Figure 4 FIG. 1 is a flow chart showing an information processing method provided by an embodiment of the present application. Figure 4 As shown, the method may include the following steps S110 to S140.

[0099] S110, in response to the exception identification request, query the target information to be evaluated of the target object from the preset graph database, the target information to be evaluated includes the information of the target object, the graph structure information of the target object in the graph database, the correlation between the target object and the associated entity, and the information of the associated entity, wherein the graph structure information includes the node degree and the clustering coefficient, the associated entities include the target resource replacement entity, the target communication information entity and the target event entity, and the related relationship includes the relationship type and the relationship strength.

[0100] In step S110, the target object may include a user who needs to be identified for anomaly, and the user may include an individual user and / or an enterprise user. The information of the target object may include the user's resource holding information, resource growth information, the ratio of replacement resources to held resources, and other basic information of the user, such as personal assets, enterprise assets, income, debt ratio, personal information, enterprise information, etc. The node degree may indicate the number of connections of the corresponding node of the target object in the graph database. The node degree may be used to reflect the influence of the target object or its activity. The clustering coefficient may indicate the degree of connection between the associated nodes of the corresponding node of the target object in the graph database. The clustering coefficient may be used to reflect the closeness of the relationship between the target object in the local relationship network. The information of the associated entity has a similar meaning to the information of the target object, which will not be repeated here. The target resource replacement entity may include a user, a resource replacement account, a resource replacement business processing device, a physical replacement resource, etc. The target communication information entity may include communication information entities such as a telephone number, an email address, and regional information. The target event entity may include a resource replacement business application event, a resource dispute event, etc. The correlation between the target object and the associated entity may include a real-time correlation between the target object and the associated entity. In one example, the correlation between the target object and the associated entity may include the historical correlation between the target object and the associated entity in a preset historical period. The relationship type in step S110 may be related to the associated entity type. For example, if the associated entity is a user, the relationship type may include an interpersonal relationship; if the associated entity is a phone number, the relationship type may include a subordinate relationship, etc. The relationship strength may be determined by transaction amount, transaction frequency, communication frequency, etc.

[0101] S120, inputting the target information to be evaluated into a preset anomaly recognition model.

[0102] S130, obtaining an anomaly score corresponding to the target information to be evaluated through an anomaly recognition model according to a pre-fitted correspondence relationship between the information to be evaluated and the anomaly recognition score.

[0103] S140, generating an anomaly recognition result of the target object based on the anomaly score.

[0104] The information processing method of the embodiment of the present application can query the target information to be evaluated of the target object from the preset graph database in response to the abnormal identification request. The target information to be evaluated includes the information of the target object, the graph structure information of the target object in the graph database, the correlation between the target object and the associated entity, and the information of the associated entity. In this way, the target information to be evaluated of the target object can be quickly queried with the help of the powerful query performance of the graph database, thereby improving the efficiency of abnormal identification. The above-mentioned graph structure information includes node degree and clustering coefficient, the associated entity includes the target resource replacement entity, the target communication information entity and the target event entity, and the correlation includes the relationship type and the relationship strength. In this way, the target information to be evaluated can be mined with the help of the powerful expression ability of the graph database to reduce the risk of ignoring the potential relationship between entities. Then the target information to be evaluated is input into the preset abnormal identification model. Through the abnormal identification model, according to the correspondence between the pre-fitted information to be evaluated and the abnormal identification score, the abnormal score corresponding to the target information to be evaluated is obtained. The abnormal identification result of the target object is generated based on the abnormal score. The target information to be evaluated includes not only the correlation between the target resource replacement entity and the target object, but also the correlation between the target communication information entity and the target event entity and the target object. By analyzing the target information to be evaluated through the anomaly recognition model, we can deeply mine the relationship data between the target object and other entities from multiple angles, and further combine the relationship network graph structure information of the target object to reduce the risk of abnormal data being ignored. This is conducive to improving the accuracy of anomaly recognition.

[0105] In one embodiment, the preset graph database may include a plurality of preset nodes and edges for connecting the preset nodes, the preset nodes may be used to represent entity data, the entity data may include entity identification and entity information, and the edges may be used to represent the correlation between entities.

[0106] In response to the anomaly identification request, querying the target object's target information to be evaluated from the preset graph database may specifically include:

[0107] According to the entity identifier of the target object, a target preset node corresponding to the target object is determined from a plurality of preset nodes.

[0108] The target edges connected to the target preset node are traversed to determine at least one associated preset node of the target preset node, where the associated preset node is a preset node corresponding to the associated entity.

[0109] Read the target object's information from the target preset node.

[0110] According to the number of target edges, the node degree of the target object in the graph database is determined.

[0111] According to the connection relationship between each associated preset node, the clustering coefficient of the target object in the graph database is determined.

[0112] Read the related relationship between the target object and the associated entity from the target edge.

[0113] Read the information of the associated entity from the associated preset node.

[0114] According to the above implementation, the target edge connected to the target preset node can be traversed through the graph query function of the graph database, the associated preset node of the target preset node can be determined, and the target information to be evaluated of the target object can be read. In this way, the relationship data network of the target object can be fully obtained, which is conducive to mining the potential abnormal risk of the target object. In this way, the accuracy of abnormality identification can be improved.

[0115] In one embodiment, in response to the exception identification request, before querying the target information to be evaluated of the target object from the preset graph database, the method may further include:

[0116] Gets entity data for multiple preset resource replacement entities.

[0117] Based on the entity data of the plurality of preset resource replacement entities, a plurality of preset nodes corresponding to the plurality of preset resource replacement entities are generated.

[0118] A plurality of preset communication information entities and a plurality of preset event entities associated with the plurality of preset resource replacement entities are determined.

[0119] Obtain entity data of multiple preset communication information entities and multiple preset event entities.

[0120] Based on the entity data of the plurality of preset communication information entities and the plurality of preset event entities, a plurality of preset nodes corresponding to the plurality of preset communication information entities and the plurality of preset event entities are generated.

[0121] According to the correlation between multiple preset resource replacement entities, multiple preset communication information entities and multiple preset event entities, edges for connecting each preset node are generated to obtain a knowledge graph.

[0122] Store the knowledge graph in the preset graph database.

[0123] In the above implementation, obtaining entity data of multiple preset resource replacement entities may include collecting user data from multiple data sources. The data sources may include but are not limited to databases and data lakes of various resource replacement business-related institutions.

[0124] According to the above implementation, the preset resource replacement entity can be used as the core, and the entity data of the relevant preset communication information entity and the preset event entity can be obtained through the preset resource replacement entity to generate the node of the knowledge graph. And the edge of the knowledge graph is generated according to the correlation between the preset resource replacement entity, the preset communication information entity and the preset event entity. In this way, for each preset resource replacement entity, the information of its associated entity can be fully obtained, which is conducive to building a more comprehensive and complete relationship data network. In this way, it is conducive to improving the accuracy of abnormal identification.

[0125] In one embodiment, determining a plurality of preset communication information entities and a plurality of preset event entities related to a plurality of preset resource replacement entities may specifically include:

[0126] The communication data and resource replacement behavior data of each preset resource replacement entity are obtained, wherein the communication data includes communication information and the resource replacement behavior data includes events related to the resource replacement behavior.

[0127] The communication information is extracted from the communication data of each preset resource replacement entity to obtain a plurality of preset communication information entities.

[0128] Events are extracted from the resource replacement behavior data of each preset resource replacement entity to obtain a plurality of preset event entities.

[0129] According to the above implementation, multiple preset communication information entities and multiple preset event entities related to each preset resource replacement entity can be determined based on the communication data and resource replacement behavior data of each preset resource replacement entity. In this way, the reliability of the relational data network can be improved by determining the associated entities of each preset resource replacement entity based on actual data. This is conducive to further improving the accuracy of abnormal identification.

[0130] In one embodiment, the communication data may further include communication relations, and the resource replacement behavior data may further include behavior information of the resource replacement entity in the event.

[0131] According to the correlation between the plurality of preset resource replacement entities, the plurality of preset communication information entities, and the plurality of preset event entities, generating edges for connecting the preset nodes may specifically include:

[0132] According to the communication data of each preset resource replacement entity, a first correlation between each preset resource replacement entity and a second correlation between each preset resource replacement entity and each preset communication information entity are determined.

[0133] According to the resource replacement behavior data of each preset resource replacement entity, a third correlation relationship between each preset resource replacement entity and each preset event entity is determined.

[0134] According to the first correlation, the second correlation and the third correlation, edges for connecting the preset nodes are generated.

[0135] In the above implementation, the communicative relationship may include, but is not limited to, the communicative relationship between users and the corresponding relationship between users and communication information. In one example, the communicative relationship may also include the strength of the communicative relationship, such as the closeness of the relationship between users. The behavioral information of the resource replacement entity in the event may include, but is not limited to, the role and behavior of the user in the event. In one example, the behavioral information of the resource replacement entity in the event may also include the strength of the relationship between the user and the event, such as the importance of the user's role in the event and the degree of participation (such as the amount of assets invested).

[0136] According to the above implementation, the relevant relationships between entities can be extracted based on actual data, and edges for connecting various preset nodes can be generated. In this way, the relationship between entities can be accurately and intuitively displayed through the relational data network. This is conducive to reducing the difficulty of relational data mining and analysis, thereby further improving the efficiency and accuracy of anomaly identification.

[0137] In one embodiment, after generating an anomaly identification result of the target object based on the anomaly score, the method may further include:

[0138] Based on the target information to be evaluated and the abnormal identification results, a visual evaluation report of the target object is generated.

[0139] In the above implementation, the visual evaluation report may include, but is not limited to, one or more of a relationship network diagram of the target object generated according to the target information to be evaluated, an abnormal score trend diagram, and an abnormal score analysis table.

[0140] According to the above implementation, the target information to be evaluated and the abnormal identification result of the target object are visualized, and the abnormal situation of the target object can be intuitively displayed to the user, which is conducive to improving the user's decision-making efficiency and user experience.

[0141] Based on the information processing method provided in the above embodiments, the present application also provides a specific implementation of the information processing device. Please refer to the following embodiments.

[0142] See first Figure 5 The information processing device 200 provided in the embodiment of the present application includes a query module 201, an input module 202, a processing module 203 and a first generating module 204.

[0143] The query module 201 is used to query the target information to be evaluated of the target object from the preset graph database in response to the exception identification request, wherein the target information to be evaluated includes the information of the target object, the graph structure information of the target object in the graph database, the correlation between the target object and the associated entity, and the information of the associated entity, wherein the graph structure information includes the node degree and the clustering coefficient, the associated entity includes the target resource replacement entity, the target communication information entity and the target event entity, and the related relationship includes the relationship type and the relationship strength.

[0144] The input module 202 is used to input the target information to be evaluated into a preset anomaly recognition model.

[0145] The processing module 203 is used to obtain the anomaly score corresponding to the target information to be evaluated according to the pre-fitted correspondence relationship between the information to be evaluated and the anomaly identification score through the anomaly identification model.

[0146] The first generating module 204 is used to generate an abnormality recognition result of the target object based on the abnormality score.

[0147] The information processing device of the embodiment of the present application can query the target information to be evaluated of the target object from the preset graph database in response to the abnormal identification request. The target information to be evaluated includes the information of the target object, the graph structure information of the target object in the graph database, the correlation between the target object and the associated entity, and the information of the associated entity. In this way, the target information to be evaluated of the target object can be quickly queried with the help of the powerful query performance of the graph database, thereby improving the efficiency of abnormal identification. The above-mentioned graph structure information includes node degree and clustering coefficient, the associated entity includes the target resource replacement entity, the target communication information entity and the target event entity, and the correlation includes the relationship type and the relationship strength. In this way, the target information to be evaluated can be mined with the help of the powerful expression ability of the graph database, reducing the risk of ignoring the potential relationship between entities. Then the target information to be evaluated is input into the preset abnormal identification model. Through the abnormal identification model, according to the correspondence between the pre-fitted information to be evaluated and the abnormal identification score, the abnormal score corresponding to the target information to be evaluated is obtained. The abnormal identification result of the target object is generated based on the abnormal score. The target information to be evaluated includes not only the correlation between the target resource replacement entity and the target object, but also the correlation between the target communication information entity and the target event entity and the target object. By analyzing the target information to be evaluated through the anomaly recognition model, we can deeply mine the relationship data between the target object and other entities from multiple angles, and further combine the relationship network graph structure information of the target object to reduce the risk of abnormal data being ignored. This is conducive to improving the accuracy of anomaly recognition.

[0148] In one embodiment, the preset graph database may include a plurality of preset nodes and edges for connecting the preset nodes, the preset nodes may be used to represent entity data, the entity data may include entity identification and entity information, and the edges may be used to represent the correlation between entities.

[0149] The query module is used to query the target information to be evaluated of the target object from the preset graph database in response to the abnormal identification request, which may specifically include:

[0150] The determination submodule is used to determine a target preset node corresponding to the target object from a plurality of preset nodes according to the entity identifier of the target object.

[0151] The determination submodule is used to traverse the target edge connected to the target preset node and determine at least one associated preset node of the target preset node, where the associated preset node is a preset node corresponding to the associated entity.

[0152] The reading submodule is used to read the information of the target object from the target preset node.

[0153] The determination submodule is also used to determine the node degree of the target object in the graph database according to the number of target edges.

[0154] The determination submodule is also used to determine the clustering coefficient of the target object in the graph database according to the connection relationship between each associated preset node.

[0155] The reading submodule is also used to read the relevant relationship between the target object and the associated entity from the target edge.

[0156] The reading submodule is also used to read the information of the associated entity from the associated preset node.

[0157] In one embodiment, the apparatus may further include:

[0158] The acquisition module is used to acquire entity data of multiple preset resource replacement entities before querying the target information to be evaluated of the target object from the preset graph database in response to the exception identification request.

[0159] The second generating module is used to generate a plurality of preset nodes corresponding to the plurality of preset resource replacement entities respectively based on the entity data of the plurality of preset resource replacement entities.

[0160] The determination module is used to determine a plurality of preset communication information entities and a plurality of preset event entities related to a plurality of preset resource replacement entities.

[0161] The acquisition module is also used to acquire entity data of multiple preset communication information entities and multiple preset event entities.

[0162] The second generating module is further used to generate a plurality of preset nodes corresponding to the plurality of preset communication information entities and the plurality of preset event entities respectively based on the entity data of the plurality of preset communication information entities and the plurality of preset event entities.

[0163] The second generation module is also used to generate edges for connecting each preset node according to the correlation between multiple preset resource replacement entities, multiple preset communication information entities and multiple preset event entities to obtain a knowledge graph.

[0164] The storage module is used to store the knowledge graph in the preset graph database.

[0165] In one embodiment, the determination module is used to determine multiple preset communication information entities and multiple preset event entities related to multiple preset resource replacement entities, which may specifically include:

[0166] The acquisition submodule is used to acquire the communication data and resource replacement behavior data of each preset resource replacement entity, wherein the communication data includes communication information and the resource replacement behavior data includes events related to resource replacement behavior.

[0167] The extraction submodule is used to extract communication information from the communication data of each preset resource replacement entity to obtain a plurality of preset communication information entities.

[0168] The extraction submodule is further used to extract events from the resource replacement behavior data of each preset resource replacement entity to obtain a plurality of preset event entities.

[0169] In one embodiment, the communication data may further include communication relations, and the resource replacement behavior data may further include behavior information of the resource replacement entity in the event.

[0170] The second generating module is used to generate edges for connecting various preset nodes according to the correlation between the multiple preset resource replacement entities, the multiple preset communication information entities, and the multiple preset event entities, which may specifically include:

[0171] The determination submodule is used to determine the first correlation between each preset resource replacement entity and the second correlation between each preset resource replacement entity and each preset communication information entity according to the communication data of each preset resource replacement entity.

[0172] The determination submodule is further configured to determine a third correlation between each preset resource replacement entity and each preset event entity according to the resource replacement behavior data of each preset resource replacement entity.

[0173] The generating submodule is used to generate edges for connecting various preset nodes according to the first correlation, the second correlation and the third correlation.

[0174] In one embodiment, the apparatus may further include:

[0175] The third generating module is used to generate a visual evaluation report of the target object based on the target information to be evaluated and the abnormality identification result after generating the abnormality identification result of the target object based on the abnormality score.

[0176] Each module of the information processing device provided in the embodiment of the present application can realize Figure 4 The functions of each step of the information processing method are provided, and the corresponding technical effects can be achieved. For the sake of concise description, they will not be repeated here.

[0177] Figure 6 A schematic diagram of the hardware structure of an information processing device provided in an embodiment of the present application is shown.

[0178] The information processing device may include a processor 301 and a memory 302 storing computer program instructions.

[0179] Specifically, the processor 301 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0180] The memory 302 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 302 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 302 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 302 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 302 is a non-volatile solid-state memory.

[0181] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0182] The processor 301 implements any one of the information processing methods in the above embodiments by reading and executing computer program instructions stored in the memory 302 .

[0183] In one example, the information processing device may further include a communication interface 303 and a bus 310. Figure 6 As shown, the processor 301, the memory 302, and the communication interface 303 are connected via a bus 310 and communicate with each other.

[0184] The communication interface 303 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0185] Bus 310 includes hardware, software or both, and the parts of information processing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 310 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0186] The information processing device can execute the information processing method in the embodiment of the present application, thereby realizing the combination Figure 4 and Figure 5 The information processing method and device described herein. The information processing method in the above embodiments can be implemented by providing a computer storage medium in the present application embodiment. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the information processing methods in the above embodiments is implemented.

[0187] An embodiment of the present application also provides a computer program product, including a computer program, which implements any one of the information processing methods in the above embodiments when the computer program is processed and executed.

[0188] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0189] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0190] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0191] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable information processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable information processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0192] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. An information processing method, characterized in that: include: In response to the abnormality identification request, query the target information to be evaluated of the target object from the preset graph database, the target information to be evaluated includes information of the target object, graph structure information of the target object in the graph database, correlation between the target object and the associated entity, and information of the associated entity, wherein the graph structure information includes node degree and clustering coefficient, the associated entity includes target resource replacement entity, target communication information entity and target event entity, and the correlation includes relationship type and relationship strength; Inputting the target information to be evaluated into a preset anomaly recognition model; By using the anomaly recognition model, according to the pre-fitted correspondence between the information to be evaluated and the anomaly recognition score, an anomaly score corresponding to the target information to be evaluated is obtained; An anomaly identification result of the target object is generated based on the anomaly score.

2. The information processing method according to claim 1, characterized in that: The preset graph database includes a plurality of preset nodes and edges for connecting the preset nodes, the preset nodes are used to represent entity data, the entity data includes entity identification and entity information; the edges are used to represent the correlation between entities; In response to the abnormality identification request, querying the target information to be evaluated of the target object from the preset graph database includes: Determining, according to the entity identifier of the target object, a target preset node corresponding to the target object from the multiple preset nodes; Traversing the target edges connected to the target preset node, determining at least one associated preset node of the target preset node, where the associated preset node is a preset node corresponding to the associated entity; Read the information of the target object from the target preset node; Determining the node degree of the target object in the graph database according to the number of the target edges; Determine the clustering coefficient of the target object in the graph database according to the connection relationship between each associated preset node; Reading the relevant relationship between the target object and the associated entity from the target edge; The information of the associated entity is read from the associated preset node.

3. The information processing method according to claim 2, characterized in that: Before querying the target information to be evaluated of the target object from the preset graph database in response to the abnormality identification request, the method further includes: Get entity data of multiple preset resource replacement entities; Based on the entity data of the plurality of preset resource replacement entities, generating a plurality of preset nodes corresponding to the plurality of preset resource replacement entities respectively; Determining a plurality of preset communication information entities and a plurality of preset event entities associated with the plurality of preset resource replacement entities; Acquire entity data of the plurality of preset communication information entities and the plurality of preset event entities; Based on the entity data of the plurality of preset communication information entities and the plurality of preset event entities, generating a plurality of preset nodes corresponding to the plurality of preset communication information entities and the plurality of preset event entities respectively; According to the correlation between the plurality of preset resource replacement entities, the plurality of preset communication information entities and the plurality of preset event entities, edges for connecting the preset nodes are generated to obtain a knowledge graph; The knowledge graph is stored in a preset graph database.

4. The information processing method according to claim 3, characterized in that: The determining of a plurality of preset communication information entities and a plurality of preset event entities related to the plurality of preset resource replacement entities includes: Acquire the communication data and resource replacement behavior data of each preset resource replacement entity, wherein the communication data includes communication information; the resource replacement behavior data includes events related to the resource replacement behavior; Extracting the communication information from the communication data of each preset resource replacement entity to obtain the plurality of preset communication information entities; The event is extracted from the resource replacement behavior data of each preset resource replacement entity to obtain the plurality of preset event entities.

5. The information processing method according to claim 4, characterized in that: The communication data also includes the communication relationship, and the resource replacement behavior data also includes the behavior information of the resource replacement entity in the event; The generating of edges for connecting respective preset nodes according to the correlation between the plurality of preset resource replacement entities, the plurality of preset communication information entities and the plurality of preset event entities comprises: Determine, according to the communication data of each preset resource replacement entity, a first correlation between each preset resource replacement entity and a second correlation between each preset resource replacement entity and each preset communication information entity; Determining, according to the resource replacement behavior data of each preset resource replacement entity, a third correlation relationship between each preset resource replacement entity and each preset event entity; According to the first correlation, the second correlation and the third correlation, edges for connecting various preset nodes are generated.

6. The information processing method according to any one of claims 1 to 4, characterized in that: After generating an abnormality identification result of the target object based on the abnormality score, the method further includes: Based on the target information to be evaluated and the abnormality identification result, a visual evaluation report of the target object is generated.

7. An information processing device, characterized in that: include: A query module, configured to query target information to be evaluated of a target object from a preset graph database in response to an abnormality identification request, wherein the target information to be evaluated includes information of the target object, graph structure information of the target object in the graph database, a correlation between the target object and an associated entity, and information of the associated entity, wherein the graph structure information includes node degree and clustering coefficient, the associated entity includes a target resource replacement entity, a target communication information entity, and a target event entity, and the correlation includes a relationship type and a relationship strength; An input module, used for inputting the target information to be evaluated into a preset anomaly recognition model; A processing module, configured to obtain an anomaly score corresponding to the target information to be evaluated according to the pre-fitted correspondence between the information to be evaluated and the anomaly recognition score through the anomaly recognition model; A generating module is used to generate an abnormality recognition result of the target object based on the abnormality score.

8. An information processing device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the information processing method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the information processing method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the information processing method as described in any one of claims 1 to 6.

Images