Information identification method and device, electronic equipment and computer storage medium

Abstract

The invention discloses an information identification method and device, electronic equipment and a computer storage medium, and the information identification method comprises the steps: determining association relationship data between transaction objects constructed based on medium data, the transaction objects in the association relationship data being transaction objects in a service system, and the transaction objects in the association relationship data being transaction objects in the service system; the transaction objects with the same media data are transaction objects capable of making associated behaviors for the service system by using the same media data; determining a risk transaction object set according to the association relationship data; determining risk medium data attributes in the risk transaction object set; and identifying a risk media data attribute combination according to the risk media data attributes in the risk transaction object set. According to the information identification method, the identification efficiency of the risk medium data attribute combination is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to information identification methods, devices, electronic devices and computer storage media. Background Art

[0002] With the development of science and technology, more and more trading objects choose online transactions. While online transactions bring convenience to trading platforms, they also bring some security risks, such as the risky trading objects that conduct false transactions on online trading platforms. In order to obtain better risk benefits, the risky trading operation mode has evolved from a single trading object implementing risky behaviors to a risky behavior mode with the nature of a collection of trading objects. The aggregation of risky behaviors of the collection of trading objects is relatively obvious, which is generally reflected in strong media data, such as the same device and the same person's account. With the increase in the intensity of attack and defense, in order to evade platform identification, the collection of risky trading objects will weaken the association on strong media data by purchasing junk accounts, operating multiple devices, and covering up fraud traces. At this time, the strong media data may not be able to associate the risky accounts, so weak media data is needed, such as merchants, LBS, IP, etc.

[0003] In the algorithm scheme for identifying risky transaction object sets, the construction of transaction object sets generally requires the use of strong correlations between transaction objects. If two transaction objects are associated with the same strong media data, it can be considered that there is a certain probability of strong correlation between the two transaction objects. However, if two transaction objects are associated with the same weak media data, it is difficult to determine whether there is a strong correlation between the two. This is due to the strong and weak differences in the common attributes of strong media data and weak media data. In order to effectively utilize weak media data, the strength of media data association is generally enhanced by combining weak media data. At present, enumeration method can be used to screen suitable weak media data combinations. When the total number of weak media data is N, the two-to-two combinations need to be analyzed. If the three-to-three combinations need to be explored, more situations need to be analyzed. When the amount of data is large or the total amount of weak media data is large, the efficiency of the algorithm will be low, and after the number of media data attributes increases or the length of media data combinations increases, the difficulty of traversal is increased.

[0004] Therefore, how to provide a method that can automatically recommend suitable weak media data combinations to improve the recommendation efficiency of weak media data combinations is a problem that needs to be solved urgently. Summary of the invention

[0005] The embodiment of the present application provides an information identification method to improve the identification efficiency of risk medium data attribute combinations.

[0006] An embodiment of the present application provides an information identification method, including: determining association relationship data between transaction objects constructed based on media data, the transaction objects in the association relationship data are transaction objects in a service system, and in the association relationship data, transaction objects with the same media data are transaction objects that can use the same media data to perform associated actions on the service system; determining a set of risk transaction objects based on the association relationship data; determining risk media data attributes in the set of risk transaction objects; and identifying a combination of risk media data attributes based on the risk media data attributes in the set of risk transaction objects.

[0007] Optionally, determining a set of risk transaction objects according to the association relationship data includes:

[0008] Calculate the correlation data of the transaction objects in the association relationship data on different attribute media data by using a first preset algorithm, and obtain a plurality of associated transaction objects whose correlation data is greater than a preset correlation threshold;

[0009] A second preset algorithm is used to identify a transaction object set for the multiple associated transaction objects, and a risky transaction object set is determined from the obtained multiple transaction object sets.

[0010] Optionally, determining a risky transaction object set from the obtained multiple transaction object sets includes:

[0011] Traversing the multiple transaction object sets, obtaining behavior feature data of the transaction objects in each of the multiple transaction object sets with respect to the service system;

[0012] Based on the behavior characteristic data, a risky transaction object set is determined from the obtained multiple transaction object sets.

[0013] Optionally, determining a risky transaction object set from the obtained multiple transaction object sets based on the behavior characteristic data includes:

[0014] Determine whether the behavior characteristic data meets a preset risk characteristic indicator threshold;

[0015] If so, the transaction object set is determined to be a risky transaction object set.

[0016] Optionally, the determining of the risk medium data attributes in the risk transaction object set includes:

[0017] Performing attribute grouping on the media data associated between the transaction objects in the risk transaction object set;

[0018] Determine whether a proportion of each media data attribute associated between transaction objects in the risk transaction object set to all media data attributes associated between transaction objects in the risk transaction object set exceeds a first preset proportion threshold;

[0019] If so, it is determined that the media data attribute is a risk media data attribute in the risk transaction object set.

[0020] Optionally, the identifying a risk medium data attribute combination according to the risk medium data attributes in the risk transaction object set includes:

[0021] According to the risk medium data attributes in the risk transaction object set, a risk medium data attribute combination is identified using a third preset algorithm.

[0022] Optionally, the identifying a risk medium data attribute combination by using a third preset algorithm according to the risk medium data attributes in the risk transaction object set includes:

[0023] Based on the risk medium data attributes in the risk transaction object set, determining a plurality of candidate risk medium data attribute combinations;

[0024] Traversing the multiple candidate risk medium data attribute combinations, and determining whether a proportion of each candidate risk medium data attribute combination in the multiple candidate risk medium data attribute combinations exceeds a second preset proportion threshold;

[0025] If so, the candidate risk medium data attribute combination is determined to be a risk medium data attribute combination in the risk transaction object set.

[0026] An embodiment of the present application also provides an information identification method, including: determining association relationship data between transaction objects constructed based on media data, the transaction objects in the association relationship data are transaction objects in a service system, and in the association relationship data, transaction objects with the same media data are transaction objects that can use the same media data to perform associated behaviors on the service system; determining a set of risky transaction objects based on the association relationship data; determining risk indicator data of the media data in the set of risky transaction objects relative to the set of risky transaction objects; and identifying whether the media data in the set of risky transaction objects is risky media data based on the risk indicator data.

[0027] Optionally, the risk indicator data includes at least one of the following:

[0028] Media data contribution rate data used to indicate the degree to which the media data contributes to the risk behavior of the risk transaction object set;

[0029] Media data concentration data used to indicate the concentration degree of the media data in the risk transaction object set.

[0030] Optionally, under the premise that the media data contribution rate data is greater than a preset media data contribution rate threshold, identifying whether the media data in the risk transaction object set is risky media data according to the risk indicator data includes:

[0031] Determining whether the media data concentration data is greater than a first preset concentration data threshold;

[0032] If so, the medium data in the risk transaction object set is risk medium data;

[0033] Determining whether the media data concentration data is less than a second preset concentration data threshold;

[0034] If so, the media data in the risk transaction object set is exploited risk media data.

[0035] Optionally, determining a set of risk transaction objects according to the association relationship data includes:

[0036] Calculate the correlation data of the transaction objects in the association relationship data on different attribute media data by using a first preset algorithm, and obtain a plurality of associated transaction objects whose correlation data is greater than a preset correlation threshold;

[0037] A second preset algorithm is used to identify a transaction object set for the multiple associated transaction objects, and a risky transaction object set is determined from the obtained multiple transaction object sets.

[0038] Optionally, determining a risky transaction object set from the obtained multiple transaction object sets includes:

[0039] Traversing the multiple transaction object sets, obtaining behavior feature data of the transaction objects in each of the multiple transaction object sets with respect to the service system;

[0040] Based on the behavior characteristic data, a risky transaction object set is determined from the obtained multiple transaction object sets.

[0041] Optionally, determining a risky transaction object set from the obtained multiple transaction object sets based on the behavior characteristic data includes:

[0042] Determine whether the behavior characteristic data meets a preset risk characteristic indicator threshold;

[0043] If so, the transaction object set is determined to be a risky transaction object set.

[0044] An embodiment of the present application also provides an information identification device, including: an association relationship data determination unit, used to determine the association relationship data between transaction objects constructed based on media data, the transaction objects in the association relationship data are transaction objects in a service system, and in the association relationship data, transaction objects with the same media data are transaction objects that can use the same media data to perform associated behaviors on the service system; a risk transaction object set determination unit, used to determine a risk transaction object set based on the association relationship data; a risk media data attribute determination unit, used to determine the risk media data attributes in the risk transaction object set; a risk media data attribute combination identification unit, used to identify the risk media data attribute combination based on the risk media data attributes in the risk transaction object set.

[0045] An embodiment of the present application also provides an information identification device, including: an association relationship data determination unit, used to determine the association relationship data between transaction objects constructed based on media data, the transaction objects in the association relationship data are transaction objects in a service system, and in the association relationship data, transaction objects with the same media data are transaction objects that can use the same media data to perform associated actions on the service system; a risk transaction object set determination unit, used to determine a risk transaction object set based on the association relationship data; a risk indicator data determination unit, used to determine the media data in the risk transaction object set relative to the risk indicator data of the risk transaction object set; a risk media data identification unit, used to identify whether the media data in the risk transaction object set is risk media data based on the risk indicator data.

[0046] The present application also provides an electronic device, which includes a processor and a memory; a computer program is stored in the memory, and the processor executes the above method after running the computer program.

[0047] The present application also provides a computer storage medium, wherein the computer storage medium stores a computer program, and after the computer program is run by a processor, the above method is executed.

[0048] Compared with the prior art, the embodiments of the present application have the following advantages:

[0049] An embodiment of the present application provides an information identification method, including: determining association relationship data between transaction objects constructed based on media data, the transaction objects in the association relationship data are transaction objects in a service system, and in the association relationship data, transaction objects with the same media data are transaction objects that can use the same media data to perform associated actions on the service system; determining a set of risk transaction objects based on the association relationship data; determining risk media data attributes in the set of risk transaction objects; and identifying a combination of risk media data attributes based on the risk media data attributes in the set of risk transaction objects.

[0050] The information identification method described in the embodiment of the present application, after determining the association relationship data between transaction objects constructed based on the media data, can further determine the risk transaction object set according to the association relationship data, then determine the risk media data attributes in the risk transaction object set, and finally, identify the risk media data attribute combination in the risk transaction object set according to the risk media data attributes in the risk transaction object set. After determining the risk transaction object set, the method can further obtain the risk media data attribute combination according to the risk media data attributes in the risk transaction object set, thereby improving the recognition efficiency of the risk media data attribute combination, so as to further identify whether the transaction object associated with the risk media data attribute combination is a risk transaction object, thereby improving the recognition efficiency and accuracy of the risk transaction object.

[0051] The embodiment of the present application also provides an information identification method, after determining the association relationship data between transaction objects constructed based on the media data, a risk transaction object set can be determined according to the association relationship data, after determining the risk transaction object set, the media data in the risk transaction object set is further determined relative to the risk indicator data of the risk transaction object set, and finally, according to the risk indicator data, it is identified whether the media data in the risk transaction object set is risk media data. This method can identify whether the media data in the risk transaction object set is risk media data, so as to further identify whether the transaction object associated with the risk media data is a risk transaction object. If the risk media data belongs exclusively to the risk transaction object set, it means that the transaction object associated with the risk media data is more likely to be a transaction object in the risk transaction object set. If the risk media data does not belong exclusively to the risk transaction object set, its public attribute is stronger, which means that the transaction object associated with the risk media data is not necessarily a transaction object in the risk transaction object set, thereby improving the recognition efficiency and accuracy of the risk transaction object set. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a schematic diagram of an application scenario of an information identification method provided in the first embodiment of the present application;

[0053] Figure 2 is a flow chart of an information identification method provided by the first embodiment of the present application;

[0054] Figure 3 is a flow chart of an information identification method provided in the second embodiment of the present application;

[0055] Figure 4 is a schematic diagram of an information identification device provided in the third embodiment of the present application;

[0056] Figure 5 is a schematic diagram of an information identification device provided in the fourth embodiment of the present application;

[0057] Figure 6 This is a schematic diagram of an electronic device provided in the fifth embodiment of the present application. DETAILED DESCRIPTION

[0058] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0059] Before introducing the information identification method provided by the embodiment of the present application, the implementation background of the scheme is first described. With the development of science and technology, more and more transaction objects choose online transactions. While online transactions bring convenience to the transaction platform, they also bring some security risks, such as the risky transaction objects that conduct false transactions in the online transaction platform. In order to obtain better risk-benefit ratio, the risky transaction operation mode has evolved from a single transaction object implementing risky behavior to a common risky behavior mode with the nature of a transaction object collection. The aggregation of risky behaviors of the transaction object collection is relatively obvious, which is generally reflected in strong media data, such as the same device committing a crime, the same person account committing a crime, etc. With the increase in the intensity of attack and defense, in order to evade platform identification, the risky transaction object collection will weaken the association on the strong media data by purchasing junk accounts, operating multiple devices, and covering up traces of fraud. At this time, the strong media data may not necessarily be able to associate the risky accounts, so weak media data such as merchants, LBS, IP, etc. are needed.

[0060] In the algorithm scheme for identifying risky transaction object sets, the construction of transaction object sets generally requires the use of strong correlations between transaction objects. If two transaction objects are associated with the same strong media data, it can be considered that there is a certain probability of strong correlation between the two transaction objects. However, if two transaction objects are associated with the same weak media data, it is difficult to determine whether there is a strong correlation between the two. This is due to the strong and weak differences in the common attributes of strong media data and weak media data. In order to effectively utilize weak media data, the strength of media data association is generally enhanced by combining weak media data. At present, enumeration method can be used to screen suitable weak media data combinations. When the total number of weak media data is N, the two-to-two combinations need to be analyzed. If the three-to-three combinations need to be explored, more situations need to be analyzed. When the amount of data is large or the total amount of weak media data is large, the efficiency of the algorithm will be low, and after the number of media data attributes increases or the length of media data combinations increases, the difficulty of traversal is increased.

[0061] Based on this, the embodiment of the present application provides an information identification method, which, after determining the association relationship data between transaction objects constructed based on media data, can further determine the risk transaction object set according to the association relationship data, then determine the risk media data attributes in the risk transaction object set, and finally, identify the risk media data attribute combination in the risk transaction object set according to the risk media data attributes in the risk transaction object set. After determining the risk transaction object set, the method can further obtain the risk media data attribute combination according to the risk media data attributes in the risk transaction object set, thereby improving the recognition efficiency of the risk media data attribute combination, so as to further identify whether the transaction object associated with the risk media data attribute combination is a risk transaction object, thereby improving the recognition efficiency and accuracy of the risk transaction object.

[0062] The following is a description of the technical terms involved in the embodiments of the present application:

[0063] Media data: refers to the media associated with the transaction object in the transaction platform, such as login device ID, bound account, delivery city name or code, logistics site name or code, ordering IP, mobile phone number, etc. The transaction object can form associated relationship data through different media data associations. When the media data attribute is phone, the media data can be the mobile phone number of 188****7777.

[0064] According to the strength of the personal attributes of media data, it can be divided into strong media data and weak media data. Strong media data generally refers to media that is unique to extremely small-scale transaction objects, such as login device ID, mobile phone number, bound account, payee account, etc. Strong media data generally has an identity identification identifier with higher credibility and stability; weak media data refers to media with strong public attributes, such as the name or code of the receiving city, the name or code of the logistics site, etc.

[0065] In order to enable those skilled in the art to better understand the solution of the present application, the specific application scenarios of its embodiments are described in detail below based on an information identification method provided in the present application.

[0066] See also Figure 1 , which is a schematic diagram of an application scenario of an information identification method provided in the first embodiment of the present application. First, execute step S101: construct a strong and weak media data heterogeneous graph, that is, determine the association relationship data between transaction objects constructed based on media data, the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, the transaction objects with the same media data are transaction objects that can use the same media data to perform associated behaviors against the service system. The association relationship data can specifically be a heterogeneous graph constructed by transaction objects and media data. For example, Figure 1 In the example, transaction objects 1 to 7 exist in the same service system. Transaction objects 1, 2, 3, and 4 are associated with each other through the media data umid. Transaction objects 1, 2, and 3 are also associated with each other through the media data facility. Transaction objects 1, 2, 3, and 4 are also associated with each other through the media data LBS. It should be noted that media data can also be called media ID. Media ID refers to a specific media entity ID in a certain media attribute and is unique. For example, if the media data attribute is phone, the media data can be the mobile phone number 188****7777. Transaction objects are associated with each other through media, which is actually also associated with each other through media data.

[0067] After determining the association relationship data, step S102 is executed: Swing calculates the relevance of the transaction objects, that is, the Swing algorithm is used to calculate the relevance data of the transaction objects in the association relationship data on different attribute media data, for example, Figure 1After calculation, the correlation data between transaction object 1 and transaction object 2 is 0.9, the correlation data between transaction object 1 and transaction object 3 is 0.9, the correlation data between transaction object 1 and transaction object 4 is 0.6, the correlation data between transaction object 1 and transaction object 5 is 0.2, and the correlation data between transaction object 4 and transaction object 7 is 0.3. After calculating the correlation data of the transaction objects in the association relationship data on different attribute media data, multiple associated transaction objects with correlation data greater than a preset correlation threshold are retained, for example, associated transaction objects with correlation data greater than 0.5 are retained, that is, transaction objects 1, transaction object 2, transaction object 3, and transaction object 4 with high correlation are finally retained.

[0068] After obtaining multiple related transaction objects whose correlation data is greater than the preset correlation threshold, execute step S103: Louvain transaction object set mining, that is, after using the Louvain algorithm to identify the transaction object sets of the multiple related transaction objects, multiple transaction object sets can be obtained, and the risk characteristics of each transaction object set in the multiple transaction object sets are calculated, and a list of risky transaction object sets is output according to the risk characteristics of the transaction object sets. It should be noted that the list of risky transaction object sets refers to the list of transaction object sets with high risk of fraud. The risk characteristics are specifically related to the application scenario. Taking the scenario of freight fraud as an example, the risk characteristics may include the freight compensation amount, compensation ratio, etc. of the transaction object.

[0069] After the risk transaction object set is determined, the process of risk media data attribute combination recommendation in step S104 is executed, that is, the edge attributes of the risk transaction object set are decompiled, and the media data with high correlation between the risk transaction object sets are displayed. For example, after the edge attributes of the risk transaction object set are decompiled, transaction object 1 and transaction object 2, transaction object 3, and transaction object 4 are associated together through the media data umid, transaction object 1 and transaction object 2, transaction object 3 are also associated together through the media data facility, transaction object 1 and transaction object 2, transaction object 3, and transaction object 4 are also associated together through the media data LBS, transaction object 1 and transaction object 4 are also associated together through the media data SLR, and transaction object 1 and transaction object 5 are associated together through the media data item. Then, the edges of the risk transaction object set are attribute grouped, and the risk media data attributes in each transaction object set are retained, wherein the risk media data attributes refer to the media data attributes that play a leading role in the risk transaction object set. For example, a certain risk transaction object set has a total of 10 edges, of which 9 edges belong to the umid attribute, accounting for 90%, 7 edges belong to the phone attribute, accounting for 70%, and 3 edges belong to the ip attribute, accounting for 30%. If the proportion of a certain media data attribute in all media data attributes exceeds 50%, then the media data attribute is the risk media data attribute, that is, the media data attribute that plays a dominant role in the risk transaction object set. Then, the media data attributes that play a dominant role in the risk transaction object set are umid and phone.

[0070] After determining the risk media data attributes in the risk transaction object set, the risk media data attribute combination in the risk transaction object set is obtained by using the frequent item mining algorithm. Specifically, based on the risk media data attributes in the risk transaction object set, multiple candidate risk media data attribute combinations are determined. For example, after combining the risk media data attributes, candidate risk media data attribute combination 1 is obtained: rfd_accept_facility_code, umid; candidate risk media data attribute combination 2: ip2, rfd_accept_facility_code; candidate risk media data attribute combination 3: mord_mobile_phone, umid; candidate risk media data attribute combination 4: mord_mobile_phone, rfd_accept_facility_code, etc. Among them, the proportion of each candidate risk medium data attribute combination in all candidate risk medium data attribute combinations is as follows: rfd_accept_facility_code,umid accounts for 50%, ip2,rfd_accept_facility_code accounts for 30%, mord_mobile_phone,umid accounts for 25%, mord_mobile_phone,rfd_accept_facility_code accounts for 24%, ip2,umid accounts for 20%, etc. If the preset ratio threshold is 50%, if a candidate risk medium data attribute combination accounts for more than 50% (including 50%) of all candidate risk medium data attribute combinations, then the candidate risk medium data attribute combination is a risk medium data attribute combination, and the risk medium data attribute combination is a media data attribute combination that plays a leading role in the risk transaction object set. For example, in the above example, the media data attribute combination that plays a leading role in the risk transaction object set is candidate risk medium data attribute combination 1: rfd_accept_facility_code,umid.

[0071] The above is the entire process of the information identification method provided in the embodiment of the present application. After determining the association relationship data between transaction objects constructed based on the media data, the risk transaction object set can be further determined according to the association relationship data, and then the risk media data attributes in the risk transaction object set are determined. Finally, according to the risk media data attributes in the risk transaction object set, the risk media data attribute combination in the risk transaction object set is identified. After determining the risk transaction object set, the method can further obtain the risk media data attribute combination according to the risk media data attributes in the risk transaction object set, thereby improving the recognition efficiency of the risk media data attribute combination, so that it can further identify whether the transaction object associated with the risk media data attribute combination is a risk transaction object, thereby improving the recognition efficiency and accuracy of the risk transaction object.

[0072] The present application also provides an information identification method. In the risk media data identification scenario, after determining the risk transaction object set, the process of outputting the risk media data list in step S104 is executed, that is, the media data in the risk transaction object set is further processed to obtain risk indicator data. The risk indicator data can specifically be media data contribution rate data, media data concentration data, etc., wherein the media data contribution rate data refers to the proportion of edges to which a certain media data belongs in the transaction object set. For example, a certain risk transaction object set has a total of 10 edges, of which 9 edges belong to the umid attribute, accounting for 90%, that is, the media data contribution rate data is 90%. A high contribution rate indicates that the media data may play an important role in the risk transaction object set. Media data concentration data refers to the number of transaction objects (or orders) associated with a certain media data in the risk transaction object set divided by the number of transaction objects (or orders) associated with the media data in the full amount of data. High concentration data indicates that the media data is more likely to be a media data attribute directly controlled by the risk transaction object set, the media data is unique to the risk transaction object set, and the transaction object associated with the media data is more likely to be a transaction object in the risk transaction object set. Low concentration data indicates that the media data has stronger public attributes, the media data is not unique to the risk transaction object set, and is more likely to be risk media data "used" by the risk transaction object set. Of course, the risk indicator data can also be reflected by the per capita order volume. For example, in the freight fraud scenario, the media data used to implement risky behavior is manifested as the per capita order of the risk transaction object set is much higher than the per capita order of normal transaction objects on the media data.

[0073] After determining the risk indicator data, it is possible to further identify whether the media data in the risk transaction object set is risk media data based on the risk indicator data. When identifying whether the media data in the risk transaction object set is risk media data based on the risk indicator data, it is a prerequisite that the contribution rate data is greater than the preset media data contribution rate threshold. For example, the preset media data contribution rate threshold is 0.8, and the contribution rate data is greater than 0.8. Under the premise that the contribution rate data is greater than 0.8, the media data concentration data is further judged. A high concentration data indicates that the media data is more likely to be directly controlled by the risk transaction object set, that is, "participating in fraudulent media data". A low concentration data indicates that the media data has stronger public attributes and is more likely to be risk media data "used" by the risk transaction object set, that is, "used fraudulent media data". "Media data involved in fraud" means that the media data is unique to the risk transaction object set, such as a certain umid, and the transaction object associated with the media data is more likely to be a transaction object in the risk transaction object set; "used fraud media data" means that the fraud media data is not unique to the risk transaction object set, and its public attributes are stronger, but multiple transactions have occurred in the risk transaction object set, indicating that the media data is more likely to be used to commit fraud and is a tool used by the risk transaction object set to commit fraud, such as a certain store, and the transaction object associated with the media data is not necessarily a transaction object in the risk transaction object set. By processing the indicators of the media data in the risk transaction object set, the list of "media data involved in fraud" and the list of "used fraud media data" are divided into the list of "media data involved in fraud" and the list of "used fraud media data" based on the indicator performance and output separately, so that specific risky media data can be found and classified, the media data that actually participates in fraud and unique to the risk transaction object set is directly handled, and the media data with public attributes that is used to commit fraud is monitored and warned.

[0074] The above is the entire process of the information identification method. This method can identify whether the media data in the risk transaction object set is risk media data, so as to further identify whether the transaction object associated with the risk media data is a risk transaction object. If the risk media data belongs exclusively to the risk transaction object set, it means that the transaction object associated with the risk media data is more likely to be a transaction object in the risk transaction object set. If the risk media data does not belong exclusively to the risk transaction object set, its public attributes are stronger, which means that the transaction object associated with the risk media data is not necessarily a transaction object in the risk transaction object set, thereby improving the recognition efficiency and accuracy of the risk transaction object set.

[0075] The present application is described in detail below through multiple embodiments and drawings.

[0076] First embodiment

[0077] The first embodiment of the present application provides an information identification method as follows: Figure 2 The information identification method is described in detail.

[0078] Step S201: Determine association relationship data between transaction objects constructed based on media data, where the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, transaction objects with the same media data are transaction objects that can use the same media data to perform associated actions on the service system.

[0079] This step is used to determine the association relationship data between transaction objects constructed based on the media data.

[0080] In the embodiment of the present application, the association relationship data can specifically be a heterogeneous graph constructed by transaction objects and media data. The heterogeneous graph is composed of nodes and edges. If the attribute of a node is more than one or the attribute of an edge is more than one, it is called a heterogeneous graph. The nodes of the heterogeneous graph include transaction objects and associated media data. If the transaction object has a transaction behavior on the associated media data, there will be an edge between the transaction object and the corresponding associated media data. The heterogeneous graph can be constructed by parsing the transaction data.

[0081] Media data refers to the value corresponding to the media associated with the transaction object in the transaction platform. According to the strength of the personal attributes of the media data, it can be divided into strong media data and weak media data. Strong media data generally refers to the media that is unique to very small-scale transaction objects, such as login device ID, mobile phone number, bound account, payee account, etc. Strong media data generally has a high degree of credibility and stability of identity identification; weak media data refers to media with strong public attributes, such as the name or code of the receiving city, the name or code of the logistics site, etc. Common media data attributes include umid: Unique Material Identifier, phone: mobile phone number, address: address, facility: (logistics) site name or code, ip: ip (Internet Protocol) address, item: product ID, SLR: merchant ID, seller, LBS: location-based services, utdid: device identification code (Universal Time with Device ID), etc. Among them, common strong media data attributes include: umid, phone, etc., and common weak media data attributes include: item, facility, LBS, SLR, etc. Among them, umid is a unique identifier used to track the data of a single device for a long time. Generally speaking, umid is usually calculated based on the device's IMEI code, MAC address, Android ID, etc.

[0082] In the embodiment of the present application, the transaction objects in the association relationship data are transaction objects in the service system, and the transaction objects with the same media data in the association relationship data are transaction objects that can use the same media data to perform association actions on the service system. Figure 1 , transaction object 1-transaction object 7 exist in the same service system, transaction object 1 and transaction object 2, transaction object 3, transaction object 4 are associated with each other through the media data umid, transaction object 1 and transaction object 2, transaction object 3 are also associated with each other through the media data facility, and transaction object 1 and transaction object 2, transaction object 3, transaction object 4 are also associated with each other through the media data LBS. It should be noted that media data can also be called media ID. Media ID refers to a specific media entity ID in a certain media attribute and is unique. For example, if the media data attribute is phone, the media data can be the mobile phone number 188****7777. Transaction objects are associated with each other through media, which is actually also associated with each other through media data.

[0083] Step S202: Determine a set of risky transaction objects according to the association relationship data.

[0084] This step is used to determine the set of risky transaction objects based on the association relationship data.

[0085] In specific implementation, determining a set of risky transaction objects based on the association relationship data includes: using a first preset algorithm to calculate correlation data of transaction objects in the association relationship data on different attribute media data, and obtaining multiple associated transaction objects whose correlation data is greater than a preset correlation threshold; using a second preset algorithm to perform transaction object set identification on the multiple associated transaction objects, and determining a set of risky transaction objects from the obtained multiple transaction object sets.

[0086] In an embodiment of the present application, the first preset algorithm may specifically be a Swing algorithm, which is a recall algorithm. For example, if user u and user v have both purchased the same item i, a swing-like relationship diagram will be formed between the three. If user u and user v have purchased item j in addition to item i, then the two items are considered to be similar to a certain extent. In other words, the similarity between items is transmitted through user relationships. In order to measure the similarity between item i and item j, user u and user v who have both purchased items i and j are examined. The fewer items the two users purchase together, the higher the similarity between items i and j.

[0087] The formula for calculating the correlation data is as follows:

[0088]

[0089] Among them, α1 and β are parameters used to smooth the number of items clicked by users. When α1 = 0 and β = 0, the smoothing does not work. Usually, α1 is an integer greater than 1 and β is a real number less than 0. Parameter α2 is used to smooth the number of items clicked by two users at the same time. Usually, α2 is an integer greater than 1. Variable N j It represents the number of users who have clicked on product j. This variable is used to impose a certain degree of penalty on popular products. The purpose is to reduce the frequency of popular products in the recommendation list, thereby increasing the exposure opportunities of long-tail products.

[0090] Using the Swing algorithm, the correlation data of the transaction objects in the association relationship data on different attribute media data is calculated, for example, Figure 1 After calculation, the correlation data between transaction object 1 and transaction object 2 is 0.9, the correlation data between transaction object 1 and transaction object 3 is 0.9, the correlation data between transaction object 1 and transaction object 4 is 0.6, the correlation data between transaction object 1 and transaction object 5 is 0.2, and the correlation data between transaction object 4 and transaction object 7 is 0.3. After calculating the correlation data of the transaction objects in the association relationship data on different attribute media data, multiple associated transaction objects with correlation data greater than a preset correlation threshold are retained, for example, associated transaction objects with correlation data greater than 0.5 are retained, that is, transaction objects 1, transaction object 2, transaction object 3, and transaction object 4 with high correlation are finally retained.

[0091] After obtaining multiple related transaction objects whose correlation data is greater than a preset correlation threshold, a second preset algorithm is used to identify the transaction object set of the multiple related transaction objects, so that multiple transaction object sets can be obtained, and then a risky transaction object set is determined from the obtained multiple transaction object sets. Among them, the second preset algorithm can be specifically the Louvain algorithm, which is a community discovery algorithm and an iterative process for clustering vertices with the goal of maximizing modularity. After the calculation of the algorithm, the input graph can be segmented, and the segmented subgraphs are groups with strong correlation. After the Louvain algorithm is used to identify the transaction object set of the multiple related transaction objects, multiple transaction object sets can be obtained.

[0092] After obtaining multiple transaction object sets, a risky transaction object set is determined from the multiple transaction object sets. In specific implementation, the Louvain algorithm can be used to identify the transaction object set, and then the risk characteristics of the multiple transaction object sets are calculated, and a list of risky transaction object sets is output according to the risk characteristics of the transaction object sets. The step of determining the risky transaction object set from the multiple transaction object sets obtained includes: traversing the multiple transaction object sets to obtain the behavior characteristic data of the transaction objects in each of the multiple transaction object sets for the service system; based on the behavior characteristic data of the transaction objects in each of the multiple transaction object sets for the service system, determining the risky transaction object set from the multiple transaction object sets obtained. The step of determining the risky transaction object set from the multiple transaction object sets obtained based on the behavior characteristic data of the transaction objects in each of the multiple transaction object sets for the service system includes: judging whether the behavior characteristic data of the transaction objects in each of the multiple transaction object sets for the service system meets the preset risk characteristic indicator threshold; if so, determining the transaction object set as a risky transaction object set.

[0093] It should be noted that the transaction object set is essentially a graph consisting of transaction objects and edges. The transaction objects have data deposited on the platform. Based on these data, the behavioral feature data of the transaction objects can be processed, that is, the risk features of the transaction objects. For example, the transaction object set includes transaction objects 1, 2, 3 and 4. If the risk index of the transaction object set meets the definition of the risk transaction object set, then the transaction object set is a risk transaction object set. All transaction object sets output by the Louvain algorithm are traversed in turn, and all risk transaction object sets are found to obtain a list of risk transaction object sets. The risk feature is specifically related to the application scenario. Taking the freight fraud scenario as an example, the risk feature can include the freight compensation amount and compensation ratio of the transaction object. When determining a risky transaction object set from the multiple transaction object sets obtained, it is specifically to determine whether the behavior characteristic data of the transaction objects in each of the multiple transaction object sets for the service system meets the preset risk characteristic index threshold. Taking the freight compensation amount as an example, for example, the risk characteristic index threshold is set to the freight compensation amount of 500. If the freight compensation amount is greater than 500, it proves that the behavior characteristic data of the transaction object meets the preset risk characteristic index threshold. Finally, the risk characteristics of the transaction object set can be calculated by summarizing the risk characteristics of the transaction objects. If the behavior characteristic data of all transaction objects in a certain transaction object set meet the preset risk characteristic index threshold, it proves that the transaction object set is a risky transaction object set. Therefore, based on the risk characteristics of the transaction object set, after judging the risk of the transaction object set, a list of risky transaction object sets can be obtained.

[0094] Step S203: Determine the risk medium data attributes in the risk transaction object set.

[0095] This step is used to determine the risk medium data attributes in the risk transaction object set.

[0096] In the embodiment of the present application, the risk media data attribute is the type of media data that plays a leading role in the transaction object in the risk transaction object set to perform risky behavior against the service system. That is, the risk media data attribute is the type of media data that plays a leading role in the process of the transaction object performing risky behavior. The transaction object is a transaction object in the risk transaction object set, and the risky behavior is the behavior performed by the transaction object against the service system. Among them, the media data that plays a leading role means that the probability of the transaction object performing risky behavior through the media data is relatively high, or in other words, the media data that plays a leading role refers to the type of media data that plays an important role in the process of the transaction object performing risky behavior.

[0097] In specific implementation, the determination of the risk media data attribute in the risk transaction object set includes: grouping the attributes of the media data associated between the transaction objects in the risk transaction object set; judging whether the proportion of each media data attribute associated between the transaction objects in the risk transaction object set in all the media data attributes associated between the transaction objects in the risk transaction object set exceeds a first preset proportion threshold; if so, determining that the media data attribute is a risk media data attribute in the risk transaction object set.

[0098] It should be noted that after obtaining the risk transaction object set, the edge attributes of the risk transaction object set are decompiled. The edge attribute decompilation is to display the media data with high correlation between the risk transaction object set by decompilation. The edge of the risk transaction object set connects two transaction objects, which means that the two transaction objects have the same associated media data, and the associated media data is distinguished by attributes (such as umid, phone, etc.). If an edge is formed because the two media data umid and phone are associated, then this edge belongs to both umid and phone. The edges of the risk transaction object set are grouped by attributes, and the media data attributes that play a leading role in each risk transaction object set are retained as risk media data attributes. Specifically, it is determined whether the proportion of each media data attribute associated between transaction objects in the risk transaction object set in all media data attributes associated between transaction objects in the risk transaction object set exceeds the first preset proportion threshold; if so, the media data attribute is determined to be a risk media data attribute in the risk transaction object set. After attribute grouping, the media data attribute composition of the edges of each transaction object set can be counted. For example, a certain risk transaction object set has a total of 10 edges, of which 9 edges belong to the umid attribute, accounting for 90%, 7 edges belong to the phone attribute, accounting for 70%, and 3 edges belong to the ip attribute, accounting for 30%. Taking the first preset ratio threshold of 50% as an example, if the proportion of a certain media data attribute in all media data attributes exceeds 50%, then the media data attribute is a risk media data attribute, that is, the media data attribute that plays a dominant role in the risk transaction object set. Then, the media data attributes that play a dominant role in the risk transaction object set are umid and phone.

[0099] Step S204: identifying a risk medium data attribute combination according to the risk medium data attributes in the risk transaction object set.

[0100] This step is used to identify a risk medium data attribute combination according to the risk medium data attributes in the risk transaction object set.

[0101] In an embodiment of the present application, the risk media data attribute combination includes a plurality of risk media data attributes, and the risk media data attribute combination is a media data attribute combination that plays a leading role in the risk behavior performed by the transaction object of the risk transaction object set against the service system. That is, the risk media data attribute combination is a media data attribute combination that plays a leading role in the process of the transaction object performing risk behavior, the transaction object is a transaction object in the risk transaction object set, and the risk behavior is the behavior performed by the transaction object against the service system. The identification of the risk media data attribute combination based on the risk media data attributes in the risk transaction object set includes: based on the risk media data attributes in the risk transaction object set, using a third preset algorithm to identify the risk media data attribute combination. Among them, the third preset algorithm can specifically be a frequent item mining algorithm, and based on the risk media data attributes in the risk transaction object set, a frequent item mining algorithm is used to find the media data attribute combination that plays a leading role.

[0102] In specific implementation, the risk media data attribute combination is identified based on the risk media data attributes in the risk transaction object set using a third preset algorithm, including: determining multiple candidate risk media data attribute combinations based on the risk media data attributes in the risk transaction object set; traversing the multiple candidate risk media data attribute combinations to determine whether the proportion of each candidate risk media data attribute combination in the multiple candidate risk media data attribute combinations exceeds a second preset proportion threshold; if so, determining that the candidate risk media data attribute combination is the risk media data attribute combination in the risk transaction object set, that is, the risk media data attribute combination that plays a dominant role in the risk transaction object set.

[0103] It should be noted that after determining the risk medium data attributes in the risk transaction object set, the risk medium data attributes can be combined to obtain multiple candidate risk medium data attribute combinations, and then it is determined whether the proportion of each candidate risk medium data attribute combination in all candidate risk medium data attribute combinations exceeds the preset proportion threshold. For example, after combining the risk medium data attributes, candidate risk medium data attribute combination 1: rfd_accept_facility_code, umid; candidate risk medium data attribute combination 2: ip2, rfd_accept_facility_code; candidate risk medium data attribute combination 3: mord_mobile_phone, umid; candidate risk medium data attribute combination 4: mord_mobile_phone, rfd_accept_facility_code, etc. are obtained. Among them, the proportion of each candidate risk medium data attribute combination in all candidate risk medium data attribute combinations is as follows: rfd_accept_facility_code,umid accounts for 50%, ip2,rfd_accept_facility_code accounts for 30%, mord_mobile_phone,umid accounts for 25%, mord_mobile_phone,rfd_accept_facility_code accounts for 24%, ip2,umid accounts for 20%, etc. If the preset ratio threshold is 50%, if a candidate risk medium data attribute combination accounts for more than 50% (including 50%) of all candidate risk medium data attribute combinations, then the candidate risk medium data attribute combination is a risk medium data attribute combination, and the risk medium data attribute combination is a risk medium data attribute combination that plays a leading role in the risk transaction object set. For example, in the above example, the media data attribute combination that plays a leading role in the risk transaction object set is candidate risk medium data attribute combination 1: rfd_accept_facility_code,umid.

[0104] An embodiment of the present application provides an information identification method, including: determining association relationship data between transaction objects constructed based on media data, the transaction objects in the association relationship data are transaction objects in a service system, and in the association relationship data, transaction objects with the same media data are transaction objects that can use the same media data to perform associated actions on the service system; determining a set of risk transaction objects based on the association relationship data; determining risk media data attributes in the set of risk transaction objects; and identifying a combination of risk media data attributes based on the risk media data attributes in the set of risk transaction objects.

[0105] The information identification method described in the embodiment of the present application, after determining the association relationship data between transaction objects constructed based on the media data, can further determine the risk transaction object set according to the association relationship data, then determine the risk media data attributes in the risk transaction object set, and finally, identify the risk media data attribute combination in the risk transaction object set according to the risk media data attributes in the risk transaction object set. After determining the risk transaction object set, the method can further obtain the risk media data attribute combination according to the risk media data attributes in the risk transaction object set, thereby improving the recognition efficiency of the risk media data attribute combination, so as to further identify whether the transaction object associated with the risk media data attribute combination is a risk transaction object, thereby improving the recognition efficiency and accuracy of the risk transaction object.

[0106] Second embodiment

[0107] In the above-mentioned first embodiment, an information identification method is provided. Correspondingly, the second embodiment of the present application provides an information identification method. The parts of this embodiment that are the same as those of the first embodiment will not be repeated here. Please refer to the corresponding parts in the first embodiment.

[0108] Please refer to Figure 3 , which is a flowchart of an information identification method provided in the second embodiment of the present application.

[0109] Step S301: Determine association relationship data between transaction objects constructed based on media data, where the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, transaction objects with the same media data are transaction objects that can use the same media data to perform associated actions on the service system.

[0110] This step is used to determine the association relationship data between the transaction objects constructed based on the media data. The determination process of the association relationship data is similar to that of the first embodiment. For details, please refer to the relevant part of the first embodiment, which will not be described in detail here.

[0111] Step S302: Determine a set of risky transaction objects according to the association relationship data.

[0112] This step is used to determine the risk transaction object set according to the association data. The specific process of determining the risk transaction object set according to the association data is similar to the process of determining the risk transaction object set according to the association data in the first embodiment. For details, please refer to the relevant part in the first embodiment and will not be described in detail here.

[0113] Optionally, determining a set of risk transaction objects according to the association relationship data includes:

[0114] Calculate the correlation data of the transaction objects in the association relationship data on different attribute media data by using a first preset algorithm, and obtain a plurality of associated transaction objects whose correlation data is greater than a preset correlation threshold;

[0115] A second preset algorithm is used to identify a transaction object set for the multiple associated transaction objects, and a risky transaction object set is determined from the obtained multiple transaction object sets.

[0116] Optionally, determining a risky transaction object set from the obtained multiple transaction object sets includes:

[0117] Traversing the multiple transaction object sets, obtaining behavior feature data of the transaction objects in each of the multiple transaction object sets with respect to the service system;

[0118] Based on the behavior characteristic data, risky transaction objects are determined from the obtained multiple transaction object sets.

[0119] Optionally, determining a risky transaction object set from the obtained multiple transaction object sets based on the behavior characteristic data includes:

[0120] Determine whether the behavior characteristic data meets a preset risk characteristic indicator threshold;

[0121] If so, the transaction object set is determined to be a risky transaction object set.

[0122] Step S303: Determine the risk indicator data of the media data in the risk transaction object set relative to the risk transaction object set.

[0123] This step is used to determine the risk indicator data of the media data in the risk transaction object set relative to the risk transaction object set.

[0124] In the embodiment of the present application, after determining the risk transaction object set, the media data in the risk transaction object set is further processed to obtain risk indicator data. It should be noted that the processing of the media data in the risk transaction object set here refers to statistics based on the distribution of media data attributes in the risk transaction object set. The object of processing is specific media data, that is, media ID, rather than media data attributes. For example, the media data attribute in the risk transaction object set is phone, and the corresponding media data is the mobile phone number 188****7777. The media data attribute belongs to the phone type, and the indicator processed is the indicator of 188****7777.

[0125] In specific implementation, the risk indicator data includes at least one of the following: media data contribution rate data used to indicate the degree to which the media data plays a role in the risk behavior of the risk transaction object set; media data concentration data used to indicate the degree to which the media data is concentrated in the risk transaction object set. Among them, the media data contribution rate data refers to the proportion of the edges to which a certain media data belongs in the transaction object set. For example, a certain risk transaction object set has a total of 10 edges, of which 9 edges belong to the umid attribute, and their proportion is 90%, that is, the media data contribution rate data is 90%. A high contribution rate indicates that the media data may play an important role in the risk transaction object set. Media data concentration data refers to the number of transaction objects (or orders) associated with a certain media data in the risk transaction object set divided by the number of transaction objects (or orders) associated with the media data in the full amount of data. High concentration data indicates that the media data is more likely to be a media data attribute directly controlled by the risk transaction object set, the media data is unique to the risk transaction object set, and the transaction objects associated with the media data are more likely to be transaction objects in the risk transaction object set. Low concentration data indicates that the media data has stronger public attributes. The media data does not belong exclusively to the risky transaction object set, but is more likely to be risky media data "used" by the risky transaction object set. Of course, the risk indicator data can also be reflected by the per capita order volume. For example, in the freight fraud scenario, the media data used to implement risky behavior is manifested as the per capita order of the risky transaction object set is much higher than the per capita order of normal transaction objects on the media data.

[0126] Step S304: Identify whether the media data in the risk transaction object set is risky media data based on the risk indicator data.

[0127] This step is used to identify whether the media data in the risk transaction object set is risky media data based on the risk indicator data, wherein the risky media data refers to fraudulent media data.

[0128] In an embodiment of the present application, under the premise that the media data contribution rate data is greater than a preset media data contribution rate threshold, identifying whether the media data in the risk transaction object set is risky media data based on the risk indicator data includes: judging whether the media data concentration data is greater than a first preset concentration data threshold; if so, the media data in the risk transaction object set is risky media data; judging whether the media data concentration data is less than a second preset concentration data threshold; if so, the media data in the risk transaction object set is exploited risky media data.

[0129] It should be noted that when identifying whether the media data in the risk transaction object set is risk media data according to the risk indicator data, it is a prerequisite that the contribution rate data is greater than the preset media data contribution rate threshold. For example, the preset media data contribution rate threshold is 0.8, and the contribution rate data is greater than 0.8. A high contribution rate indicates that the media data may play an important role in the risk transaction object set. Under the premise that the contribution rate data is greater than 0.8, the media data concentration data is further judged. If the media data concentration data is greater than the first preset concentration data threshold, the media data in the risk transaction object set is risk media data; if the media data concentration data is less than the second preset concentration data threshold, the media data in the risk transaction object set is exploited risk media data. In specific implementation, the first preset concentration data threshold and the second preset concentration data threshold can be set. For example, the first preset concentration data threshold is 0.8, and the second preset concentration data threshold is 0.01. If the concentration data is greater than 0.8, it is considered that the concentration is high, and if the concentration is less than 0.01, it is considered that the concentration is low. A high concentration indicates that the media data is more likely to be directly controlled by the risk transaction object set, that is, "participating in fraud media data". A low concentration indicates that the media data has stronger public attributes and is more likely to be risk media data "used" by the risk transaction object set, that is, "used fraud media data". "Participating in fraud media data" means that the media data is unique to the risk transaction object set, such as a certain umid, and the transaction object associated with the media data is more likely to be a transaction object in the risk transaction object set; "used fraud media data" means that the fraud media data is not unique to the risk transaction object set, and its public attributes are stronger, but multiple transactions have occurred in the risk transaction object set, indicating that the media data is more likely to be used to commit fraud and is a tool used by the risk transaction object set to commit fraud, such as a certain store, and the transaction object associated with the media data is not necessarily a transaction object in the risk transaction object set. By processing the indicators of media data within the set of risky transaction objects, the data are divided into a list of "media data involved in fraud" and a list of "media data used in fraud" based on the indicator performance and output separately. In this way, the specific risky media data can be found and classified, the media data that actually participates in fraud and belongs exclusively to the set of risky transaction objects can be directly dealt with, and the media data with public attributes that are used to commit fraud can be monitored and warned.

[0130] The non-compliant media data identification method described in the embodiment of the present application can determine the risky transaction object set according to the association relationship data after determining the association relationship data between the transaction objects constructed based on the media data. After determining the risky transaction object set, the media data in the risky transaction object set is further determined relative to the risk indicator data of the risky transaction object set. Finally, according to the risk indicator data, it is identified whether the media data in the risky transaction object set is risky media data. This method can identify whether the media data in the risky transaction object set is risky media data, thereby further identifying whether the transaction object associated with the risky media data is a risky transaction object. If the risky media data belongs exclusively to the risky transaction object set, it means that the transaction object associated with the risky media data is more likely to be a transaction object in the risky transaction object set. If the risky media data does not belong exclusively to the risky transaction object set, its public attribute is stronger, indicating that the transaction object associated with the risky media data is not necessarily a transaction object in the risky transaction object set, thereby improving the recognition efficiency and accuracy of the risky transaction object set.

[0131] Third embodiment

[0132] In the above-mentioned first embodiment, an information identification method is provided. Correspondingly, the third embodiment of the present application provides an information identification device. Since the device embodiment is basically similar to the first method embodiment, the description is relatively simple. For relevant parts, please refer to the partial description of the method embodiment. The device embodiment described below is only illustrative.

[0133] Please refer to Figure 4 , is a schematic diagram of an information identification device provided in the third embodiment of the present application.

[0134] The information identification device 400 includes:

[0135] The association relationship data determining unit 401 determines association relationship data between transaction objects constructed based on the media data, wherein the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, the transaction objects having the same media data are transaction objects that can use the same media data to perform association actions on the service system;

[0136] A risk transaction object set determining unit 402, configured to determine a risk transaction object set according to the association relationship data;

[0137] The risk medium data attribute determination unit 403 is used to determine the risk medium data attribute in the risk transaction object set;

[0138] The risk medium data attribute combination identification unit 404 is used to identify the risk medium data attribute combination according to the risk medium data attributes in the risk transaction object set.

[0139] Fourth embodiment

[0140] In the above second embodiment, an information identification method is provided. Correspondingly, the fourth embodiment of the present application provides an information identification device. Since the device embodiment is basically similar to the second method embodiment, the description is relatively simple. For relevant parts, please refer to the partial description of the method embodiment. The device embodiment described below is only illustrative.

[0141] Please refer to Figure 5 , is a schematic diagram of an information identification device provided in the fourth embodiment of the present application.

[0142] The information identification 500 device includes:

[0143] The association relationship data determining unit 501 determines association relationship data between transaction objects constructed based on the media data, wherein the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, the transaction objects having the same media data are transaction objects that can use the same media data to perform association actions on the service system;

[0144] A risk transaction object set determination unit 502, configured to determine a risk transaction object set according to the association relationship data;

[0145] A risk indicator data determination unit 503, configured to determine the risk indicator data of the medium data in the risk transaction object set relative to the risk transaction object set;

[0146] The risk medium data identification unit 504 is used to identify whether the medium data in the risk transaction object set is risk medium data according to the risk indicator data.

[0147] Fifth embodiment

[0148] Corresponding to the above method embodiment of the present application, the fifth embodiment of the present application further provides an electronic device. Figure 6 As shown, Figure 6This is a schematic diagram of an electronic device provided in the fifth embodiment of the present application. The electronic device includes: at least one processor 601, at least one communication interface 602, at least one memory 603 and at least one communication bus 604; optionally, the communication interface 602 can be an interface of a communication module, such as an interface of a GSM module; the processor 601 may be a processor CPU, or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement an embodiment of the present invention. The memory 603 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Among them, the memory 603 stores a program, and the processor 601 calls the program stored in the memory 603 to execute the method provided in the above embodiment of the present application.

[0149] Sixth embodiment

[0150] Corresponding to the above method of the present application, the sixth embodiment of the present application further provides a computer storage medium. The computer storage medium stores a computer program, which is executed by a processor to execute the method provided in the above embodiment of the present application.

[0151] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

[0152] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0153] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0154] 1. Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0155] 2. Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0156] It should be noted that the embodiments of the present application may involve the use of user data. In actual applications, user-specific personal data can be used in the scheme described herein within the scope permitted by applicable laws and regulations, subject to the requirements of applicable laws and regulations of the country where the user is located (for example, with the user's explicit consent, effective notification to the user, etc.).

[0157] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

Claims

1. An information identification method, characterized in that: include: Determine association relationship data between transaction objects constructed based on the media data, wherein the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, the transaction objects having the same media data are transaction objects that can use the same media data to perform association actions on the service system; Determining a set of risky transaction objects according to the association relationship data; Determining the risk medium data attributes in the risk transaction object set; According to the risk medium data attributes in the risk transaction object set, a risk medium data attribute combination is identified.

2. The information identification method according to claim 1, characterized in that: The step of determining a set of risky transaction objects according to the association relationship data includes: Calculate the correlation data of the transaction objects in the association relationship data on different attribute media data by using a first preset algorithm, and obtain a plurality of associated transaction objects whose correlation data is greater than a preset correlation threshold; A second preset algorithm is used to identify a transaction object set for the multiple associated transaction objects, and a risky transaction object set is determined from the obtained multiple transaction object sets.

3. The information identification method according to claim 2, characterized in that: The step of determining a risky transaction object set from the obtained multiple transaction object sets includes: Traversing the multiple transaction object sets, obtaining behavior feature data of the transaction objects in each of the multiple transaction object sets with respect to the service system; Based on the behavior characteristic data, a risky transaction object set is determined from the obtained multiple transaction object sets.

4. The information identification method according to claim 3, characterized in that: The step of determining a risky transaction object set from the obtained multiple transaction object sets based on the behavior characteristic data includes: Determine whether the behavior characteristic data meets a preset risk characteristic indicator threshold; If so, the transaction object set is determined to be a risky transaction object set.

5. The information identification method according to claim 1, characterized in that: The step of determining the risk medium data attributes in the risk transaction object set includes: Performing attribute grouping on the media data associated between the transaction objects in the risk transaction object set; Determine whether a proportion of each media data attribute associated between transaction objects in the risk transaction object set to all media data attributes associated between transaction objects in the risk transaction object set exceeds a first preset proportion threshold; If so, it is determined that the media data attribute is a risk media data attribute in the risk transaction object set.

6. The information identification method according to claim 1, characterized in that: The step of identifying a risk medium data attribute combination according to the risk medium data attributes in the risk transaction object set includes: According to the risk medium data attributes in the risk transaction object set, a risk medium data attribute combination is identified using a third preset algorithm.

7. The information identification method according to claim 6, characterized in that: The step of identifying a risk medium data attribute combination according to the risk medium data attributes in the risk transaction object set by using a third preset algorithm includes: Based on the risk medium data attributes in the risk transaction object set, determining a plurality of candidate risk medium data attribute combinations; Traversing the multiple candidate risk medium data attribute combinations, and determining whether a proportion of each candidate risk medium data attribute combination in the multiple candidate risk medium data attribute combinations exceeds a second preset proportion threshold; If so, the candidate risk medium data attribute combination is determined to be a risk medium data attribute combination in the risk transaction object set.

8. An information identification method, characterized in that: include: Determine association relationship data between transaction objects constructed based on the media data, wherein the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, the transaction objects having the same media data are transaction objects that can use the same media data to perform association actions on the service system; Determining a set of risky transaction objects according to the association relationship data; Determine the risk indicator data of the media data in the risk transaction object set relative to the risk transaction object set; According to the risk indicator data, it is identified whether the medium data in the risk transaction object set is risk medium data.

9. The information identification method according to claim 8, characterized in that: The risk indicator data includes at least one of the following: Media data contribution rate data used to indicate the degree to which the media data contributes to the risk behavior of the risk transaction object set; Media data concentration data used to indicate the concentration degree of the media data in the risk transaction object set.

10. The information identification method according to claim 9, characterized in that: On the premise that the media data contribution rate data is greater than a preset media data contribution rate threshold, identifying whether the media data in the risk transaction object set is risky media data according to the risk indicator data includes: Determining whether the media data concentration data is greater than a first preset concentration data threshold; If so, the medium data in the risk transaction object set is risk medium data; Determining whether the media data concentration data is less than a second preset concentration data threshold; If so, the media data in the risk transaction object set is exploited risk media data.

11. The information identification method according to claim 8, characterized in that: The step of determining a set of risky transaction objects according to the association relationship data includes: Calculate the correlation data of the transaction objects in the association relationship data on different attribute media data by using a first preset algorithm, and obtain a plurality of associated transaction objects whose correlation data is greater than a preset correlation threshold; A second preset algorithm is used to identify a transaction object set for the multiple associated transaction objects, and a risky transaction object set is determined from the obtained multiple transaction object sets.

12. The information identification method according to claim 11, characterized in that: The step of determining a risky transaction object set from the obtained multiple transaction object sets includes: Traversing the multiple transaction object sets, obtaining behavior feature data of the transaction objects in each of the multiple transaction object sets with respect to the service system; Based on the behavior characteristic data, a risky transaction object set is determined from the obtained multiple transaction object sets.

13. The information identification method according to claim 12, characterized in that: The step of determining a risky transaction object set from the obtained multiple transaction object sets based on the behavior characteristic data includes: Determine whether the behavior characteristic data meets a preset risk characteristic indicator threshold; If so, the transaction object set is determined to be a risky transaction object set.

14. An information recognition device, characterized in that: include: An association relationship data determination unit, used to determine association relationship data between transaction objects constructed based on media data, wherein the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, transaction objects having the same media data are transaction objects that can use the same media data to perform association actions on the service system; A risk transaction object set determination unit, used to determine a risk transaction object set according to the association relationship data; A risk medium data attribute determination unit, used to determine the risk medium data attributes in the risk transaction object set; The risk medium data attribute combination identification unit is used to identify the risk medium data attribute combination according to the risk medium data attributes in the risk transaction object set.

15. An information recognition device, characterized in that: include: An association relationship data determination unit, used to determine association relationship data between transaction objects constructed based on media data, wherein the transaction objects in the association relationship data are transaction objects in the service system, and in the association relationship data, transaction objects having the same media data are transaction objects that can use the same media data to perform association actions on the service system; A risk transaction object set determination unit, used to determine a risk transaction object set according to the association relationship data; A risk indicator data determination unit, used to determine the risk indicator data of the medium data in the risk transaction object set relative to the risk transaction object set; The risk medium data identification unit is used to identify whether the medium data in the risk transaction object set is risk medium data based on the risk indicator data.

16. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The memory stores a computer program, and after the processor runs the computer program, the method according to any one of claims 1 to 13 is executed.

17. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and after the computer program is run by the processor, the method according to any one of claims 1 to 13 is executed.

Images