Method, apparatus, computer readable medium and computer program product for identifying insurance fraud

Abstract

A method, an apparatus, a computer-readable medium, and a computer program product for identifying insurance fraud are provided. The method comprises the following steps: acquiring insurance data from a data warehouse, and creating an entity according to the acquired insurance data; constructing a first layer of network atlas through the self correlation of the entities; grouping the constructed first-layer network atlas to obtain a plurality of groups; collapsing the plurality of groups of the first-layer network atlas, and performing dimension raising by using an adversarial relationship to construct a second-layer network atlas; and capturing an abnormal topological structure from the second-layer network atlas to identify insurance fraud.

Description

Technical Field

[0001] The present disclosure relates to a method, device, computer-readable medium, and computer program product for identifying insurance fraud. Specifically, the present disclosure relates to identifying group fraud in auto insurance claims, and provides a method, device, computer-readable medium, and computer program product for identifying auto insurance group fraud, so as to complete the identification and early warning of group fraud in both post-incident and in-cident situations. Background Art

[0002] In the field of risk control, fraudsters’ methods are characterized by organized gangs, covert attacks, collusion between insiders and outsiders, and complex methods. At the same time, in reality, the data of a single company is bound to be incomplete, and there is a challenge of how to detect the possibility of potential gang fraud earlier and more accurately.

[0003] Existing technical means often use two modes to identify fraud gangs. One mode is based on supervised machine learning training methods. However, for gang fraud, there are a large number of fraud cases that cannot be identified, that is, there are still a large number of hidden fraud cases among the cases marked as non-fraud. In addition, in this mode, there are also problems such as inaccurate standards and extremely unbalanced positive and negative correlation samples, which makes it difficult for learning methods to achieve good results.

[0004] The other model is based on a single layer of simple graph association, which only captures the most intuitive graph-based cases and can only enrich entities and their connections. Although this model can be displayed in an interface, it often goes from being trapped in a piece of data to being trapped in a complex sub-graph, and does not fundamentally define the difference between normal cases and fraudulent cases.

[0005] To this end, facing the three major pain points of the auto insurance industry, namely, difficulty in discovery, difficulty in confirmation, and difficulty in recovery, the present disclosure provides a solution for identifying fraud in auto insurance gangs to promote the work of reducing compensation and loss. It should be understood that the solution of the present disclosure can also be applied to other insurance businesses besides auto insurance, and the present disclosure is not limited thereto. Summary of the invention

[0006] According to one aspect of the present disclosure, a method for identifying insurance fraud is provided, comprising: obtaining insurance data from a data warehouse, and creating entities based on the obtained insurance data; constructing a first-layer network graph through the self-correlation of the entities; grouping the constructed first-layer network graph to obtain multiple groups; collapsing the multiple groups of the first-layer network graph, and using adversarial relationships to perform dimensionality increase to construct a second-layer network graph; and capturing abnormal topological structures from the second-layer network graph to identify insurance fraud. Through this method, the abstraction and definition of insurance data under a high-dimensional network can be achieved, thereby solving the fraud identification problem more efficiently and accurately.

[0007] In one aspect, grouping the constructed first-layer network graph to obtain multiple groups further includes: extracting feature information of the multiple groups, and performing secondary grouping on the multiple groups according to the feature information to obtain multiple groups after secondary grouping. Through this method, information in the data can be mined more finely, resource allocation can be optimized, and fraud can be identified more accurately.

[0008] In one aspect, the method further includes solidifying the intermediate results of the first layer network map and the second layer network map, and constructing an in-process interface to provide an early risk alert based on the intermediate results. Through this method, an in-process interface with millisecond-level return can be constructed to provide risk warnings in the early stage of the investigation.

[0009] In one aspect, capturing abnormal topological structures from the second layer network graph to identify insurance fraud also includes capturing one or more of the following abnormal topological structures: internal collisions between entities from the same group; multiple collisions between two groups; and a ring structure formed by collisions between more than two groups. Through this method, fraud patterns can be identified and defined in the case of incomplete data, greatly improving the effectiveness of identification.

[0010] According to one aspect of the present disclosure, there is provided an apparatus for identifying insurance fraud, comprising: an entity creation module, for acquiring insurance data from a data warehouse and creating entities based on the acquired insurance data; a first network graph construction module, for constructing a first-layer network graph through the self-correlations of the entities; a clustering module, for clustering the constructed first-layer network graph to obtain a plurality of groups; a second network graph construction module, for collapsing the plurality of groups of the first-layer network graph and utilizing adversarial relationships for dimensionality increase to construct a second-layer network graph; and an identification module, for capturing abnormal topological structures from the second-layer network graph to identify insurance fraud.

[0011] In one aspect, the grouping module is further used to: extract feature information of the multiple groups, and perform secondary grouping on the multiple groups according to the feature information to obtain multiple groups after secondary grouping.

[0012] In one aspect, the device further includes a solidification module for solidifying the intermediate results of the first layer network map and the second layer network map, and constructing an in-process interface to provide an early risk alert based on the intermediate results.

[0013] In one aspect, the identification module is further configured to capture one or more of the following abnormal topological structures: internal collisions between entities from the same group; multiple collisions between two groups; and a ring structure formed by collisions between more than two groups.

[0014] According to one aspect of the present disclosure, a computer readable medium having instructions stored thereon is provided, wherein when the instructions are executed, the computing device is caused to perform the method described according to the present disclosure.

[0015] According to one aspect of the present disclosure, a computer program product is provided comprising instructions, which, when executed, cause a computing device to perform the method described according to the present disclosure.

[0016] Through the present disclosure, a high-dimensional network is used to characterize the connectivity and antagonism between entities. Further, through complete situation identification and incomplete situation approximation, the refined capture of entities involved in abnormal cases is completed. In addition, the solution provided by the present disclosure is aimed at the fact that it is impossible for insurance companies to master the data of auto insurance cases in the entire industry and all time periods, and an algorithm for approximating abnormal situations is identified. This approximation is a non-enumerated complete approximation, that is, it includes abnormal situations under all topological structures, and there is no other form of abnormal approximation. In addition, the solution provided by the present disclosure has strong interpretability. When fraud is constituted, the core entity elements appear multiple times, so that they can be captured from the constructed network topology. In addition, when the present disclosure provides an interface display, the server performs calculations within the canvas range, uses the shortest path to lock the fraud link, and uses centrality to confirm the leader of the gang organization, providing a breakthrough for verification and confirmation. In addition, the solution provided by the present disclosure creatively uses intermediate results, ignores the impact of the day's cases, and provides a millisecond-level returnable interface to achieve fraud warning during the event and prevent problems before they happen. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Specific exemplary embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, the present disclosure may be implemented in many different forms and should not be interpreted as being limited to the embodiments set forth herein; rather, these embodiments are provided to make the disclosure comprehensive and complete and will fully convey the scope of the present disclosure to those skilled in the art. The terms used in the detailed description of specific exemplary embodiments shown in the accompanying drawings are not intended to be limiting of the present disclosure. In the accompanying drawings, like numbers refer to like parts.

[0018] Figure 1 is a flow chart showing a method for identifying insurance fraud according to an embodiment of the present disclosure;

[0019] Figure 2 is a flow chart showing a method for identifying insurance fraud according to another embodiment of the present disclosure;

[0020] Figure 3 is a diagram showing a data flow and a database for identifying insurance fraud according to another embodiment of the present disclosure;

[0021] Figure 4 is a block diagram showing an apparatus for identifying insurance fraud according to another embodiment of the present disclosure;

[0022] Figure 5 is a block diagram illustrating a computing device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the present disclosure more clearly understood, the technical solutions of the present disclosure are further described below with reference to the accompanying drawings and embodiments.

[0024] As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless expressly stated otherwise. It should be further understood that, as used in this specification, the term "comprising" means the presence of stated features, integers, steps, operations, parts and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, parts, components and / or groups thereof.

[0025] Figure 1 FIG. 1 is a flow chart showing a method 100 for identifying insurance fraud according to an embodiment of the present disclosure. Figure 1As shown in , at step 102, insurance data is obtained from a data warehouse, and entities are created based on the obtained insurance data. In one embodiment, creating entities based on the obtained insurance data may include creating various insurance participating objects involved in the insurance data as entities. For example, in the process of automobile insurance claims, the entities created based on insurance data may include, but are not limited to, the following: customer-related entities, such as the owner of the car, the insured of the vehicle (if different from the owner), the passengers involved in the vehicle accident, etc., which are one of the core entities in the process of automobile insurance claims; vehicle-related entities, such as accident vehicles, vehicle repair shops, etc.; insurance-related entities, such as insurance companies providing insurance services, insurance contracts, etc.; and accident-related entities, such as accident sites, traffic police departments (if involved), etc. In the example of applying graph theory-related algorithms and graph databases to the vehicle claims process, the above-created entities may exist as nodes in the algorithm and constitute the basic constituent units of the graph structure. In such an example, attributes related to the entity (e.g., personal information of the owner, the insured, and the passengers, etc.; vehicle information such as the brand, model, and age of the vehicle, etc.) may be attached to the corresponding nodes. The relationship between various entities (for example, the "ownership" relationship between the car owner and the car, the "insurance" relationship between the insurance company and the insured) can be reflected as edges between corresponding nodes and exist in the graph structure. In this way, the complex relationship between various participants in the auto insurance claims process can be intuitively displayed, which helps to understand the overall picture of the entire claims process and discover potential problems or patterns.

[0026] In addition, the data warehouse according to the present disclosure can be a subject-oriented, integrated, relatively stable data set that reflects historical changes, used to support management decisions, and store data from different data sources after synchronization, extraction, cleaning, processing, conversion, and loading. For example, for auto insurance claims, the data warehouse can store data obtained from multiple systems such as the claim application system, vehicle information system, and customer information system, as shown below. Figure 3 Described in more detail.

[0027] Then, Figure 1 The process of method 100 proceeds to step 104. At step 104, the first layer of network graph is constructed by the self-correlation of the entities. In one example, the first layer of network graph can be constructed by applying the overall strategy method only with the account, vehicle frame number, ID number and phone number, excluding the redundant influence caused by non-resource information such as insurance policies, reports and claims, so as to construct the first layer of network graph by using self-correlation.

[0028] More specifically, in constructing the first-layer network graph, it may include determining key entities and attributes to determine the various nodes that constitute the first-layer network graph. For example, in the above example, the entity may include an account, which includes attributes such as account ID and account type (individual or enterprise). The account is one of the key nodes in the first-layer network graph, and is connected to other entities / nodes through various business relationships, that is, the various edges that constitute the first-layer network graph are generated. The entity may also include a frame number: that is, a vehicle identification number (VIN), which has attributes such as a frame number, a vehicle brand, a model, and a production year. The frame number is the unique identifier of the vehicle, which can be associated with the detailed information of the vehicle and is one of the important nodes for constructing the first-layer network graph. The entity may also include an ID number: corresponding to the identity information of the owner, which is one of the important nodes for constructing the first-layer network graph. The entity may also include a phone number, which is associated with the account and the owner, and is also one of the important nodes for constructing the first-layer network graph. In one example, the self-connections between entities used to construct the first layer of the network graph may include one or more of the following: the correlation between the account and the ID number. The registration of the account usually requires the ID number for real-name authentication. One ID number may correspond to one or more accounts; the correlation between the account and the phone number. During the account registration or binding process, the phone number is often associated to receive notifications, verification codes and other information; the correlation between the frame number and the ID number. The frame number is used to uniquely identify the vehicle. The ownership of the vehicle is registered in the name of the owner. The owner of the vehicle can be determined by the ID number; and the correlation between the frame number and the account: when purchasing car insurance, the account is associated with the frame number of the vehicle. One account may purchase insurance for multiple vehicles, that is, corresponding to multiple frame numbers. It should be understood that according to the present disclosure, other correlations between various entities can also be mined and identified, and the present disclosure is not limited thereto. In the above manner, each node (i.e., entity) and the corresponding edge (i.e., various correlations between entities) used to construct the first layer of the network graph can be determined.

[0029] Then, Figure 1The process of method 100 proceeds to step 106. At step 106, the constructed first-layer network graph is grouped to obtain multiple groups. In one example, the constructed first-layer network graph can be grouped once using the maximum connected component. For example, the entire network graph can be traversed by a graph theory algorithm, such as a depth-first search (DFS) or a breadth-first search (BFS), to find all the maximum connected components. The maximum connected component may refer to the largest subgraph in the network graph in which there is an edge (path) connecting any two nodes. For example, in the first-layer network graph constructed according to the present disclosure, there may be some subgraphs consisting of closely related accounts, frame numbers, ID numbers and phone numbers, which may constitute maximum connected components. Accordingly, the grouping operation may include dividing each maximum connected component into a group, thereby obtaining multiple groups. For example, a certain maximum connected component may include several accounts, corresponding frame numbers, owner ID numbers and bound phone numbers, and these elements constitute a group. In this way, a grouping operation is completed through the division of the maximal connected components, which is helpful for subsequent targeted analysis and processing of different groups.

[0030] Alternatively or additionally, grouping the constructed first-layer network graph to obtain multiple groups may also include: extracting feature information of the multiple groups, and performing secondary grouping on the multiple groups according to the feature information to obtain multiple groups after secondary grouping. In one example, since the relationship between information such as the report phone number itself is unreliable, algorithms such as Louvain can be used for secondary grouping to form a first-layer network graph of secondary grouping, which includes multiple groups after secondary grouping. More specifically, the core goal of the Louvain algorithm is to optimize modularity, which is an indicator of the quality of community division in the graph. In the example according to the present disclosure, in the initial stage, each maximal connected component node as described above is an independent community. By continuously trying to move nodes to different communities and calculating the change in modularity, the community division is gradually optimized. For example, if it is found that moving a maximal connected component from the current community to another community can improve the overall modularity, it is moved. After completing one iteration, the maximal connected components in the same community are merged into super nodes to form a new graph structure, and then iterated again. Through multiple iterations, the result of secondary clustering is finally obtained, that is, different supernode communities represent different groups. It should be understood that other algorithms can also be used for secondary partitioning according to the present disclosure, such as GN (Girvan-Newman) algorithm, Fast Greedy algorithm, etc., and the present disclosure is not limited thereto. Through secondary clustering, information in the data can be mined more finely, resource allocation can be optimized, risks can be identified more accurately, and personalized services can be provided. In the network graph application of auto insurance claims, secondary clustering can help insurance companies better manage claims cases, identify fraudulent behavior, allocate investigation resources, etc. For example, in one embodiment, the characteristics of possible fraudulent behavior can be analyzed, such as frequent reports by the same car owner, vague or contradictory evidence at the accident scene, excessive and unreasonable quotations from the repair shop, and the relationship between the car owner and the repair shop (possible conspiracy to defraud). Accordingly, the combination of vehicles, car owners and repair shops with a high possibility of fraud can be divided into high fraud risk groups. For these groups, insurance companies can invest more anti-fraud investigation resources, such as strengthening the review of the accident scene, supervision of the repair process of the repair shop, and strict review of the materials provided by the car owner. Entities with a lower likelihood of fraud are classified as normal groups and handled using regular claims procedures.

[0031] Then, Figure 1The process of method 100 proceeds to step 108. At step 108, multiple groups of the first layer network graph are collapsed, and the adversarial relationship is used to increase the dimension to construct the second layer network graph. In one embodiment, group collapse may include analyzing the characteristics of multiple groups in the first layer network graph. For example, in the first layer network graph related to auto insurance claims, groups can be divided based on elements such as accounts, frame numbers, ID numbers, and telephone numbers, and the rules presented by these elements in different groups are different. For example, most of the accounts in a group correspond to vehicles of a specific brand, and the age of the owners is similar; the consumption patterns of accounts in another group are similar, and the age of vehicles is similar. Then, the nodes in each group can be merged to form a new "super node". In the embodiment of auto insurance claims according to the present disclosure, for a node group corresponding to multiple accounts, frame numbers, ID numbers, and telephone numbers, they can be merged into a super node. This supernode can represent the overall characteristics of the group, and can extract statistical information of the attributes of each node in the group as the attributes of the supernode. For example, for vehicle-related attributes, the average mileage of vehicles, the average number of accidents, etc. can be counted. Then, the edge relationship between the nodes in the original group and the nodes outside the group can be updated to connect them to the newly generated supernode. For example, an account node in the original group has an edge for business transactions with an external repair shop node. After collapse, this supernode establishes an edge with the repair shop node. In one example, the weight of the newly established edge can also be determined based on the sum of the weights of the relevant edges in the original group or the average weight, so as to reflect the strength of the association between the group as a whole and the external entity.

[0032] In addition, in the embodiment of the auto insurance claim according to the present disclosure, a variety of adversarial relationships may exist. For example, an adversarial relationship is formed between an insurance company and a fraudulent subject (which may be a situation where some car owners, repair shops, etc. conspire to defraud the claim money). According to the present disclosure, various methods can be used to quantify this adversarial relationship to be reflected in the constructed network map. For example, for the adversarial relationship between an insurance company and a fraudulent subject, the degree of fraud suspicion (for example, by analyzing abnormal indicators in the claim case, such as the number of frequent accidents, excessive and unreasonable amounts of repair costs, etc.) can be used as a quantitative indicator. Then, based on the identified adversarial relationship, node groups representing different adversarial subjects are added to the network map, such as a "fraudulent subject" node group, which may include different types of fraudulent subjects (such as malicious car owner nodes, bad repair shop nodes, etc.). Then, edges can be established based on the interaction between adversarial subjects, and corresponding attributes can be set. Taking insurance companies and fraud subjects as an example, if a supernode (representing the collapsed group) is found to have a high suspicion of fraud, an edge is established between the node representing the supernode and the corresponding fraud subject node in the "fraud subject" node group. The attributes of the edge can include the degree of fraud suspicion, the number of abnormal clues found, etc. Then, the information after the collapsed group (i.e., the supernode and its related edge relationship) can be fused with the newly constructed adversarial dimension information to form the second-layer network map. In this way, abstraction and definition under high-dimensional networks can be achieved, thereby solving the problem of fraud identification.

[0033] Alternatively or additionally, Figure 1The method 100 may also include solidifying the intermediate results of the first layer network map and the second layer network map, and constructing an in-process interface to provide an early risk alert based on the intermediate results. In a big data-based solution, it is usually necessary to participate in the calculation in full. Even if a more convenient technical architecture means such as a library is used, it still takes more than 10 minutes to complete the calculation. According to an embodiment of the present disclosure, the intermediate results of the two-layer network map are creatively utilized, ignoring the impact of the case on the same day, and providing a millisecond-level returnable interface to achieve in-process fraud warning and prevent problems before they occur. Specifically, in one embodiment, various intermediate results generated in the process of constructing the first layer network map and the second layer network map (for example, node information, group division information, edge information, characteristics of different groups, and data on identified adversarial relationships, etc.) can be solidified and stored in a suitable manner for subsequent rapid call. In addition, in one embodiment, an in-process interface can be constructed to receive the above intermediate results and perform corresponding processing to output risk alerts, thereby providing early risk alerts in the process. In this way, a real-time interface can be provided, so that during the reporting and investigation stages, the information of the car owner and the third parties can be transmitted through the interface, and the table of entities and entity relationships (or other data structures), group tables, and connected components and group relationship tables in the two-layer network graph formed in the above process can be used to quickly return a judgment on whether there is suspicion of gang fraud.

[0034] Then, Figure 1 The process of method 100 proceeds to step 110. At step 110, abnormal topological structures are captured from the second-layer network graph to identify insurance fraud. According to one embodiment of the present disclosure, in the second-layer network graph after group collapse, different communities can represent different business groups. Under normal circumstances, the connection density between communities is relatively stable and conforms to business rules. For example, some insurance company communities and closely cooperating repair shop communities can have a higher connection density, while the connections with other non-related communities are relatively sparse. If there is fraud, a large number of abnormal connections may appear between two communities that should not have a high connection density. For example, a small repair shop community that usually only serves local customers has established dense connections with multiple high-risk car owner communities from other places, accompanied by frequent claims cases, which may indicate the presence of fraud. In addition, abnormal topological structures may also include: isolated nodes or abnormal subgraph connections, for example, a node has frequent connections with other unrelated, distant and unconventional nodes (possibly related parties involved in fraud), forming a subgraph structure that is isolated from normal business logic but closely connected; and abnormal node degree (i.e., the number of edges connected to the node) distribution, for example, the degree of nodes involved in fraud (such as fraudulent car owners or bad repair shops) may be abnormally high or low, for example, higher or lower than a predetermined threshold.

[0035] Alternatively or additionally, capturing abnormal topological structures from the second layer of network graph to identify insurance fraud also includes capturing one or more of the following abnormal topological structures: internal collisions between entities from the same group; multiple collisions between two groups; and a ring structure formed by collisions between more than two groups. According to one embodiment of the present disclosure, internal collisions between entities of the same group mean that there are edge connections between nodes in the same group; multiple collisions between two groups mean that there are multiple edge connections between nodes of two different groups; and a ring structure formed by collisions between more than two groups means that the nodes of the ring structure in the network graph come from more than two groups. Further, in one example, by capturing the above three abnormal topological structures, the output of a list of all gang fraud cases can be completed. In addition, for complex collision loop structures, all nodes and collision accidents that constitute the abnormal structure can be found through algorithms such as k-core. In one example, the k-core algorithm can be used to capture a structure that conforms to 2-core (the largest subgraph with a degree of at least 2 for all nodes in the graph), remove the influence of the branch and leaf structure, and output collision cases between groups that constitute a ring structure. For example, each ring structure can be traversed to check the groups to which the nodes in the ring belong to determine whether there are more than two groups. If so, the ring structure and the group information involved are added to the list as collision cases.

[0036] Alternatively or additionally, a graphical display can be made for each case anomaly of the identified insurance fraud. Specifically, in one example, the entities in the collapsed group can be expanded, so that the abnormal structure formed by the first layer network map and the second layer network map is output on the canvas, thereby indicating possible insurance fraud. In one example, calculations can be performed within the canvas range, and the organizational nodes of the fraud gang can be found using the betweenness centrality algorithm. For example, the centrality index of the node, degree centrality, betweenness centrality, proximity centrality, and eigenvector centrality can be displayed, and the betweenness centrality node with the most reasonable business representation can be selected from them, providing a starting point for business personnel to conduct further investigation. In one example, calculations can be performed between any two nodes within the canvas range, and the shortest path algorithm can be used to find the direct connection between the nodes in the complex graph, thereby indicating the related parties involved in possible insurance fraud.

[0037] Through this disclosure, the connection relationship and adversarial relationship of entities are simultaneously utilized, wherein a two-layer network is constructed through adversarial relationships, and the fraud paradigm / fraud pattern is characterized through three topological structures in the high-dimensional network. In addition, this disclosure also utilizes the k-core algorithm to find all participants in the fraud in a complex loop structure, and finds the organizer of the fraud gang through the betweenness centrality.

[0038] Figure 2 FIG. 2 is a flow chart showing a method 200 for identifying insurance fraud according to another embodiment of the present disclosure. Figure 2 As shown in FIG. 2 , at step 202, an entity is created. In one embodiment, the entity can be created from a source end system library (such as Figure 3 As shown in ), through data synchronization, the required data is extracted to the data warehouse, and data cleaning and processing and data materialization are carried out. For example, as mentioned above Figure 1 As described in step 102 of the above, each insurance participant object involved in the insurance data can be created as an entity. Then, the process of method 200 proceeds to step 204. At step 204, a maximal connected subgraph is found to form groups G1, G2, ... For example, as described above with reference to Figure 1 As described in steps 104 and 106, in the first layer network graph constructed according to the present disclosure, there may be some subgraphs consisting of closely related accounts, vehicle frame numbers, ID numbers and telephone numbers, and these subgraphs may constitute maximal connected components. Accordingly, each maximal connected component may be divided into a group, thereby obtaining multiple groups G1, G2... Then, the process of method 200 proceeds to step 206. At step 206, the Louvain algorithm is used to split the groups. Specifically, the groups may be iteratively split by the Louvain algorithm according to the modularity of the groups formed in step 204 to obtain multiple groups that have been secondary grouped. Then, the process of method 200 proceeds to step 208. At step 208, relationship mapping of the groups and collapse of the groups are performed. In one embodiment according to the present disclosure, multiple corresponding groups may be merged into a supernode, which may represent the overall characteristics of the group, and the attributes of each node in the group may be extracted as the attributes of the supernode, for example, for vehicle-related attributes, the average mileage of the vehicle, the average number of accidents, etc. may be counted. Then, the relationship mapping (i.e., edge relationship) between the nodes in the original group and the nodes outside the group can be updated to connect them to the newly generated super node. Then, the process of method 200 proceeds to step 210. At step 201, a new graph G'(Gi, E') is created. In an embodiment according to the present disclosure, there may be a variety of adversarial relationships, as described above. Accordingly, the edge E' can be established based on the interaction behavior between the adversarial subjects, and then a new graph can be created based on the groups Gi (G1, G2...) and the edge E' to reflect these adversarial relationships.

[0039] Then, the process of method 200 proceeds to steps 212, 214 and 216. At steps 212, 214 and 216, internal collision accidents, groups Gx, Gy with multiple collisions, ... and groups containing loops (i.e., ring structures formed by collisions) are searched from the created new graph, respectively. For example, as described above, according to one embodiment of the present disclosure, internal collisions mean that there are edge connections between nodes in the same group; groups with multiple collisions mean that there are multiple edge connections between nodes of two different groups; and groups containing loops mean that the nodes of the ring structure in the network graph come from more than two groups. Then, the process of method 200 proceeds to step 218. At step 218, according to the abnormal situation (e.g., the abnormal topological structure mentioned above), necessary information is output, such as information related to the identified fraudulent behavior (such as the identity information of the suspected fraudster involved, etc.). Figure 2 In the method 200 shown, step 220 may be additionally or alternatively included. At step 220, weights are assigned based on the reliability of the relationships. In the network graph constructed according to the present disclosure, the reliability of the relationships can be evaluated, for example, from one or more of the following dimensions: the history of auto insurance claims, for example, if the car owner as an entity has multiple claims disputes or fraudulent behaviors, then the reliability of the relationship between the car owner and the insurance company is low; data consistency, for example, if the information provided by the car owner as an entity is inconsistent with the information identified by the insurance company, then the reliability of the relationship between the related nodes involved is low; and regulatory records, for example, if the repair shop as an entity has been punished by the regulatory authorities for many times, then the reliability of the relationship between the related nodes involved is low. Then, weights can be assigned based on the reliability of the relationships, for example, a value between 0 and 1 is set, where 1 indicates the highest reliability of the relationships and 0 indicates the lowest reliability of the relationships. The obtained relationship reliability weights are applied to each edge of the network graph for use by the Louvain algorithm in the split group at step 206.

[0040] Figure 3 FIG. 4 is a diagram showing a data flow and a database for identifying insurance fraud according to another embodiment of the present disclosure. Figure 3As shown, the source end system library may include system libraries such as the property insurance core, the property insurance one-account system, the high-risk platform, and the property insurance anti-fraud system library. The required data can be extracted from the above-mentioned source end system library to the data warehouse through data synchronization. Then, the data in the data warehouse is cleaned and processed, for example, to perform the data entity process. In addition, the data in the data warehouse can also be knowledge modeled to create entities and build relationship models of entities, such as the network map described above. Then, the various algorithms described above are executed to find abnormal topological structures from the network map, so as to identify the fraud paradigm / fraud pattern. The identified fraud paradigm is applied to various application databases, for example, to analyze possible fraudulent behaviors in real time and perform business background restoration analysis. For example, in the embodiment of the auto insurance claim according to the present disclosure, the information of the owner and the third party can be transmitted through the real-time interface during the reporting and investigation links, and the judgment of whether there is a suspicion of gang fraud can be quickly returned through the identified fraud paradigm. Then, the analysis results can be graphically displayed. For example, as described above, the entities in the collapsed group can be expanded to output the abnormal structure composed of the first-layer network graph and the second-layer network graph on the canvas; calculations can be performed within the canvas range, and the betweenness centrality algorithm can be used to find the organizational nodes of the fraud gang; and calculations can be performed between any two nodes within the canvas range, and the shortest path algorithm can be used to find the direct connection between nodes in the complex graph.

[0041] Figure 4 FIG. 4 is a block diagram showing an apparatus 400 for identifying insurance fraud according to another embodiment of the present disclosure. Figure 4As shown, the device 400 may include an entity creation module 402, a first network map construction module 404, a grouping module 406, a second network map construction module 408, and an identification module 410. The entity creation module 402 may be used to obtain insurance data from a data warehouse and create entities based on the obtained insurance data. For example, the created entity may represent each insurance participant involved in the insurance data. The first network map construction module 404 may be used to construct a first-layer network map through the self-correlation of the entity. In one embodiment according to the present disclosure, the first-layer network map may be constructed using only accounts, vehicle frame numbers, ID numbers, and telephone numbers as entities, excluding the redundant effects caused by non-resource information such as insurance policies, reports, and claims, thereby constructing the first-layer network map using self-connections. The grouping module 406 may be used to group the constructed first-layer network map to obtain multiple groups. In one example, the constructed first-layer network map may be grouped once using the maximum connected component. Further, algorithms such as Louvain can be used for secondary grouping to form a first-layer network graph of secondary grouping, which includes multiple groups after secondary grouping. The second network graph construction module 408 can be used to collapse multiple groups of the first-layer network graph and use adversarial relationships to increase dimensions to construct a second-layer network graph. In an embodiment of the auto insurance claim settlement according to the present disclosure, for a node group corresponding to multiple accounts, vehicle frame numbers, ID numbers, and phone numbers, they can be merged into a supernode. This supernode can represent the overall characteristics of the group. Then, the edge relationship between the nodes in the original group and the nodes outside the group can be updated to connect them to the newly generated supernode. The identification module 410 can be used to capture abnormal topological structures from the second-layer network graph to identify insurance fraud. According to an embodiment of the present disclosure, one or more of the following abnormal topological structures can be captured: internal collisions between entities from the same group; multiple collisions between two groups; and a ring structure formed by collisions between more than two groups. Alternatively or additionally, the apparatus 400 may further include a curing module for curing the intermediate results of the first layer network map and the second layer network map, and constructing an in-process interface to provide an early risk alert based on the intermediate results. In various embodiments, the corresponding modules in the apparatus 400 may be used to perform the steps of any method described herein.

[0042] Additionally or alternatively, the above methods, universal docking modules, service platforms or third-party platforms of the present disclosure may be implemented on one or more computers or servers or similar devices using computer processors, memory units, storage devices, computer software and other components. A high-level block diagram of such a computer or server is shown in Figure 5502. Computers, servers, or other devices including processors are collectively referred to herein as computing devices. Computing device 502 includes processor 504, which controls the operation of computer 502 by executing computer program instructions that define the overall operation. The computer program instructions may be stored in storage device 512 (e.g., a disk) and loaded into memory 510 when the computer program instructions need to be executed. Therefore, reference is made to Figure 1 , Figure 2 and Figure 3 The steps of the method may be defined by computer program instructions stored in the memory 510 and / or the storage device 512 and controlled by the processor 504 executing the computer program instructions. The computing device 502 also includes one or more network interfaces 506 for communicating with other devices via a network. The computing device 502 also includes other input / output devices 508 (e.g., a display, keyboard, mouse, speakers, buttons, etc.) that enable a user to interact with the computer 502. Those skilled in the art will recognize that the actual computer implementation may also include other components, and Figure 5 is a high-level representation of some of the components of such a computer for illustration purposes.

[0043] The storage device 512 and the memory 510 each include a tangible, non-transitory computer-readable storage medium. The storage device 512 and the memory 510 may each include a high-speed random access memory, such as a dynamic random access memory (DRAM), a static random access memory (SRAM), a double data rate synchronous dynamic random access memory (DDR RAM), or other random access solid-state memory devices, and may include non-volatile memory, such as one or more magnetic disk storage devices (such as internal hard disks and removable disks), magneto-optical disk storage devices, optical disk storage devices, flash memory devices, semiconductor memory devices (such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)), compact disk read-only memory (CD-ROM), digital versatile disk read-only memory (DVD-ROM) disks, or other non-volatile solid-state storage devices.

[0044] In another embodiment, the above method, universal docking module, service platform or third-party platform can be implemented in a network-based cloud computing system. In such a network-based cloud computing system, the server communicates with one or more client computers via a network. The client computer can communicate with the server, for example, via a web browser application resident on and running on the client computer. The client computer can store data on the server and access the data via the network. The client computer can transmit data requests or online service requests to the server via the network. The server can implement the requested service and provide the data to (one or more) client computers. The server can also transmit data adapted to enable the client computer to implement a specified function (e.g., implement calculations, display specified data on the screen, etc.). Some steps of the above method can be implemented by a server or by other computers / processors in a network-based cloud computing system. Some steps of the above method can be implemented locally by a client computer in a network-based cloud computing system. The steps of the above method can be implemented in any combination by one or more devices in a network-based cloud computing system or by a local client computer.

[0045] It should be appreciated that certain features of the disclosure described in the context of separate embodiments for clarity may also be provided in combination in a single embodiment. Conversely, various features of the disclosure described in the context of a single embodiment for simplicity may also be provided individually or in any suitable sub-combination or as appropriate in any other described embodiment of the disclosure. Certain features described in the context of various embodiments should not be considered essential features of those embodiments unless the embodiment is ineffective without those elements.

[0046] Although the present disclosure has been described in conjunction with the specific embodiments of the present disclosure, it is obvious that many substitutions, modifications and changes will be obvious to those skilled in the art. Therefore, it is intended to cover all such substitutions, modifications and changes that fall within the spirit and broad scope of the appended claims.

[0047] All publications, patents, and patent applications mentioned in this specification are incorporated herein by reference in their entirety to the same extent as if each individual publication, patent, or patent application was specifically and particularly indicated to be incorporated herein by reference. In addition, citation or identification of any reference in this disclosure should not be construed as an admission that such reference is available as prior art to the present disclosure. Where section headings are used, they should not be construed as necessarily limiting.

Claims

1. A method for identifying insurance fraud, comprising: Obtain insurance data from the data warehouse and create entities based on the obtained insurance data; Constructing a first-layer network graph through the self-correlations of the entities; The constructed first-layer network graph is grouped to obtain multiple groups; Collapse multiple groups of the first-layer network graph and use adversarial relationships to perform dimension increase to construct a second-layer network graph; and Capturing abnormal topology from the second layer network graph to identify insurance fraud.

2. The method according to claim 1, wherein grouping the constructed first-layer network graph to obtain a plurality of groups further comprises: Extract characteristic information of the plurality of groups, and perform secondary grouping on the plurality of groups according to the characteristic information to obtain a plurality of secondary grouped groups.

3. The method according to claim 1 also includes solidifying the intermediate results of the first layer network map and the second layer network map, and building an in-process interface to provide early risk alerts based on the intermediate results.

4. The method according to claim 1, wherein capturing abnormal topological structures from the second-layer network graph to identify insurance fraud also includes capturing one or more of the following abnormal topological structures: internal collisions between entities from the same group; multiple collisions between two groups; and a ring structure formed by collisions between more than two groups.

5. A device for identifying insurance fraud, comprising: An entity creation module, used to obtain insurance data from the data warehouse and create entities based on the obtained insurance data; A first network graph construction module, used to construct a first layer network graph through the self-relevance of the entities; A grouping module is used to group the constructed first-layer network graph to obtain multiple groups; A second network graph construction module, used to collapse multiple groups of the first layer network graph and use adversarial relationships to perform dimension increase to construct a second layer network graph; as well as The identification module is used to capture abnormal topology from the second layer network map to identify insurance fraud.

6. The device according to claim 5, wherein the grouping module is further used to: extract feature information of the multiple groups, and perform secondary grouping on the multiple groups according to the feature information to obtain multiple groups after secondary grouping.

7. The device according to claim 5 further includes a solidification module for solidifying the intermediate results of the first layer network map and the second layer network map, and constructing an in-process interface to provide an early risk alert based on the intermediate results.

8. The device according to claim 5, wherein the identification module is further used to capture one or more of the following abnormal topological structures: internal collisions between entities from the same group; multiple collisions between two groups; and a ring structure formed by collisions between more than two groups.

9. A computer readable medium having stored thereon instructions which, when executed, cause a computing device to perform the method of any one of claims 1-4.

10. A computer program product comprising instructions which, when executed, cause a computing device to perform the method according to any one of claims 1 to 4.

Images