Data processing method, device and equipment

Abstract

Embodiments of the present specification provide a data processing method, apparatus, and device, wherein the method includes: in response to a risk group mining request, determining a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object; obtaining a first wandering path corresponding to the first node and a second wandering path corresponding to the second node based on the graph structure data; determining a target score for each second node based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern; obtaining a target node based on the target score of each second node; constructing target graph structure data corresponding to the first detection object based on the target node, and determining a risk group mining result for the first detection object based on the target graph structure data.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, apparatus, and device. Background Art

[0002] Since transaction risks often exist in the form of groups in the risk control scenario of resource transfer, risk detection on groups has better risk mining potential and explainability than risk detection on a single user.

[0003] When performing risk detection on a group consisting of multiple users, the efficiency and accuracy of mining risk groups are low due to the large number of users in the group and the complex relationships between users. Therefore, the embodiments of this specification provide a better technical solution for mining risk groups. Summary of the Invention

[0004] The purpose of the embodiments of this specification is to provide a better technical solution for risk group mining.

[0005] In order to implement the above technical solution, the embodiments of this specification are implemented as follows:

[0006] An embodiment of the present specification provides a data processing method, the method comprising: receiving a risk group mining request for a first detection object triggered by a target user; determining, in response to the risk group mining request, a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object; obtaining, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node corresponding to the first detection object in the graph structure data, and the second node is a node in the graph structure data that has a resource flow relationship with the first node; determining a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a match between the second wandering path and the target resource flow pattern; screening the second nodes based on the target score of each second node to obtain a target node; constructing target graph structure data corresponding to the first detection object based on the target node, and determining a risk group mining result for the first detection object based on the target graph structure data.

[0007] An embodiment of the present specification provides a data processing device, the device comprising: a request receiving module for receiving a risk group mining request for a first detection object triggered by a target user; a data acquisition module for determining, in response to the risk group mining request, a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed based on the resource flow relationship of the first detection object; a path acquisition module for acquiring, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node corresponding to the first detection object in the graph structure data, and the second node is a node in the graph structure data that has a resource flow relationship with the first node; a score determination module for determining a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a match between the second wandering path and the target resource flow pattern; a node determination module for screening the second nodes based on the target score of each second node to obtain a target node; and a result determination module for constructing target graph structure data corresponding to the first detection object based on the target node, and determining a risk group mining result for the first detection object based on the target graph structure data.

[0008] An embodiment of the present specification provides a data processing device, comprising: a processor; and a memory arranged to store computer-executable instructions, wherein when executed, the executable instructions cause the processor to: receive a risk group mining request for a first detection object triggered by a target user; determine, in response to the risk group mining request, a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object; obtain, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node corresponding to the first detection object in the graph structure data, and the second node is a node in the graph structure data that has a resource flow relationship with the first node; determine a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a match between the second wandering path and the target resource flow pattern; screen the second nodes based on the target score of each second node to obtain a target node; construct target graph structure data corresponding to the first detection object based on the target node, and determine a risk group mining result for the first detection object based on the target graph structure data.

[0009] An embodiment of the present specification also provides a storage medium for storing computer-executable instructions, which, when executed by a processor, implement the following process: receiving a risk group mining request for a first detection object triggered by a target user; determining, in response to the risk group mining request, a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object; obtaining, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node corresponding to the first detection object in the graph structure data, and the second node is a node in the graph structure data that has a resource flow relationship with the first node; determining a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a match between the second wandering path and the target resource flow pattern; screening the second nodes based on the target score of each second node to obtain a target node; constructing target graph structure data corresponding to the first detection object based on the target node, and determining a risk group mining result for the first detection object based on the target graph structure data.

[0010] An embodiment of the present specification also provides a computer program product, including a computer program, which, when executed by a processor, implements the following process: receiving a risk group mining request for a first detection object triggered by a target user; determining, in response to the risk group mining request, a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object; obtaining, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node corresponding to the first detection object in the graph structure data, and the second node is a node in the graph structure data that has a resource flow relationship with the first node; determining a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a match between the second wandering path and the target resource flow pattern; screening the second nodes based on the target score of each second node to obtain a target node; constructing target graph structure data corresponding to the first detection object based on the target node, and determining a risk group mining result for the first detection object based on the target graph structure data. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some of the embodiments described in this specification. Those skilled in the art can also derive other drawings based on these drawings without inventive work.

[0012] Figure 1 This is a flowchart of a data processing method in this specification;

[0013] Figure 2 This is a schematic diagram of a resource flow model for this manual;

[0014] Figure 3 This is a schematic diagram of a process for determining a target score for a node in this specification;

[0015] Figure 4 This is a flowchart of a matching degree determination process in this specification;

[0016] Figure 5 This is a schematic diagram of a matching process based on the encoding result in this specification;

[0017] Figure 6 This is a flowchart of a target node determination process in this specification;

[0018] Figure 7 This is a flowchart of a risk group mining process in this manual;

[0019] Figure 8 This is a schematic diagram of a topological structure of this specification;

[0020] Figure 9 This is a flow chart of data processing using a large language model in this specification;

[0021] Figure 10 A schematic diagram of an interaction process between a user and an interactive group mining system in this specification;

[0022] Figure 11 This is a flowchart of a process for determining a walking path in this specification;

[0023] Figure 12 A schematic diagram of a data processing device in this specification;

[0024] Figure 13 This is a structural diagram of a data processing device in this specification. DETAILED DESCRIPTION

[0025] The embodiments of this specification provide a data processing method, apparatus, and device.

[0026] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0027] An embodiment of the present specification provides a better processing mechanism for risk group mining, which receives a risk group mining request for a first detection object triggered by a target user, and in response to the risk group mining request, determines a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object. Then, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node can be obtained, wherein the first node can be a node corresponding to the first detection object in the graph structure data, and the second node can be a node in the graph structure data that has a resource flow relationship with the first node. Based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern, a target score for each second node is determined, and the second nodes are screened and processed according to the target score of each second node to obtain a target node. Finally, based on the target node, target graph structure data corresponding to the first detection object can be constructed, and based on the target graph structure data, a risk group mining result for the first detection object is determined. In this way, in combination with the target resource flow pattern corresponding to the risk group mining request, the target score of each first node's neighbor node (i.e., the second node) can be determined in a targeted manner based on the similarity between the first and second wandering paths, as well as the matching degree between the second wandering path and the target resource flow pattern. In this way, when the resource flow relationship of the first detection object is relatively complex, node screening can be performed quickly and accurately based on the target score of the second node, and the risk group mining results can be determined based on the screened target nodes, thereby improving the risk group mining efficiency and mining accuracy. For the specific processing, please refer to the specific content of the following embodiment.

[0028] like Figure 1 As shown, an embodiment of this specification provides a data processing method. The execution subject of this method can be a server, wherein the server can be an independent server or a server cluster composed of multiple servers. This embodiment is described in detail using the execution subject as an example. The method can specifically include the following steps:

[0029] In step S102, a risk group mining request for a first detection object is received, which is triggered by a target user.

[0030] The target user may be any user, and the first detection object may include objects such as account objects and user objects.

[0031] In practice, since the accuracy of risk detection on a single object is low, the risk detection process can be performed on the object to be detected by mining the risk groups of the object to be detected to improve the accuracy of risk detection on a single object.

[0032] The risk group may be a group formed by the first detection object and multiple other objects, and the resource flow pattern between the multiple objects in the risk group matches the target resource flow pattern.

[0033] For example, taking the target user as a registered user of a resource transfer application, before triggering the execution of a resource transfer behavior for a certain account (or a certain user), the target user can trigger a risk group mining request for the account (or the user). At this time, the server can determine the account (or user) selected by the target user as the first detection object.

[0034] In addition, there may be multiple first detection objects. For example, the target user may trigger a risk group mining request for multiple first detection objects having a resource transfer relationship, so as to mine a risk group containing these multiple first detection objects.

[0035] In step S104 , in response to the risk group mining request, a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed according to the resource flow relationship of the first detection object are determined.

[0036] The target resource flow mode can be used to characterize the resource flow relationship between an object and other objects. For example, the target resource flow mode can include collection, transfer, refund and other modes. Figure 2 As shown, the collection mode can be used to represent that the amount of resource inflow of an object is greater than the amount of resource outflow, and the refund mode can be used to represent that the amount of resource outflow of an object is greater than the amount of resource inflow.

[0037] In implementation, the server can determine the target resource flow pattern corresponding to the risk group mining request based on the pattern identifier of the resource flow pattern carried in the risk group mining request. Alternatively, the server can also perform pattern extraction processing on the input data of the target user to obtain the target resource flow pattern. Alternatively, the server can also determine the risk type of the first detection object based on the historical resource flow data of the first detection object according to a pre-trained risk detection model, and determine the resource flow pattern corresponding to the risk type of the first detection object according to the preset object relationship between the risk type and the resource flow model, so as to determine the determined resource flow pattern as the target resource flow pattern.

[0038] The method for determining the target resource flow pattern corresponding to the above-mentioned risk group mining request is an optional and feasible determination method. In actual application scenarios, there can also be multiple different determination methods. Different determination methods can be selected according to different actual application scenarios. The embodiments of this specification do not make specific limitations on this.

[0039] The server can obtain historical resource flow data corresponding to the object identifier of the first detection object carried in the risk group mining request within a preset detection period, and construct graph structure data corresponding to the first detection object based on the obtained historical resource flow data.

[0040] Among them, the graph structure data may include nodes corresponding to the first detection object, nodes corresponding to objects that have a resource flow relationship with the first detection object, and node association relationships constructed based on the resource flow relationship between objects (i.e., the first detection object, and objects that have a resource flow relationship with the first detection object).

[0041] In addition, the risk group mining request can also carry the target object type. The server can filter out the second detection object corresponding to the target object type based on the target object type and the historical resource flow data corresponding to the first detection object, and construct the graph structure data corresponding to the first detection object based on the first detection object and the second detection object.

[0042] For example, taking the target object type as an account type, the server can filter out the detection objects of the account type in the historical resource flow data, and determine the filtered detection objects as the second detection objects, and construct graph structure data corresponding to the first detection object based on the historical resource flow data of the first detection object within the preset detection period and the historical resource flow data of the second detection object.

[0043] The method for constructing the graph structure data corresponding to the above-mentioned first detection object is an optional and feasible construction method. In actual application scenarios, there can also be multiple different construction methods. Different construction methods can be selected according to different actual application scenarios. The embodiments of this specification do not make specific limitations on this.

[0044] In step S106 , a first walking path corresponding to the first node and a second walking path corresponding to the second node are acquired according to the graph structure data.

[0045] Among them, the first node can be a node corresponding to the first detection object in the graph structure data, the second node is a node in the graph structure data that has a resource flow relationship with the first node, the first wandering path can be one or more wandering paths constructed by random wandering processing with the first node as the center node, and the second wandering path can be one or more wandering paths constructed by random wandering processing with the second node as the center node. For example, the server can use the first node as the center node and perform random wandering processing according to a preset number of nodes to obtain a wandering path.

[0046] In implementation, the server may utilize a heuristic algorithm to determine, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node.

[0047] Among them, heuristic algorithms can be problem-solving methods based on experience and heuristic rules, which can approach the ideal answer by guiding the search process without exhausting all possibilities.

[0048] In step S108 , a target score of each second node is determined based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern.

[0049] In implementation, the server may determine the similarity between the first wandering path and the second wandering path according to a preset similarity algorithm, for example, Figure 3 As shown, the server can use the Jacard similarity algorithm to calculate the intersection-and-union ratio between the number of nodes included in the first wandering path and the number of nodes included in the second wandering path, and determine the calculated result as the similarity between the first wandering path and the second wandering path.

[0050] Similarly, the server may also use the Jacard similarity algorithm to determine the matching degree between the second wandering path and the target resource flow pattern.

[0051] The similarity between the first and second wandering paths can be used to measure the aggregation score of the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern can be used to measure the strength of the second wandering path in describing the target resource flow pattern (original path).

[0052] The server may determine a target score for each second node based on preset hyperparameters, the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern.

[0053] That is, the server may determine the target score of the second node according to the following formula.

[0054]

[0055] in, is the similarity between the first and second walking paths, is the matching degree between the second wandering path and the target resource flow pattern, The preset hyperparameters can be used to balance the importance of the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern. The preset hyperparameters can select different values ​​according to different actual application scenarios, and the embodiments of this specification do not make specific limitations on this.

[0056] Starting from the first node, neighboring nodes (i.e., second nodes) can be gradually incorporated into the risk group. A scoring mechanism can be used to determine whether neighboring nodes should be included, thereby screening the target node. Throughout the diffusion process, the neighboring node's travel path is matched against the meta-path group (i.e., the target resource flow pattern) provided as explicit input information, generating a meta-path matching score (i.e., the degree of match between the second travel path and the target resource flow pattern). These pre-defined meta-path groups can be derived from pattern extraction and characterization of real group cases. Therefore, the original path matching score effectively reflects whether the neighboring node meets the characteristics of the real risk group. In addition, the scoring mechanism includes an aggregation score (i.e., the similarity between the first and second travel paths), which, together with the meta-path matching score, constitutes the total score (i.e., the target score) for the neighboring node.

[0057] In step S110 , the second nodes are screened according to the target score of each second node to obtain a target node.

[0058] In implementation, the server may sort the second nodes according to the target score of each second node, and determine the target node based on the sorted second nodes.

[0059] Alternatively, the server may filter the second nodes based on the score threshold corresponding to the first detection object and the target score of each second node to obtain the target node. The target node can be determined in a variety of ways, and different determination methods can be selected based on different actual application scenarios. This embodiment of the present specification does not specifically limit this.

[0060] In step S112 , target graph structure data corresponding to the first detection object is constructed according to the target node, and a risk group mining result for the first detection object is determined according to the target graph structure data.

[0061] In implementation, the server may construct target graph structure data corresponding to the first detection object based on the target node, the first node corresponding to the first detection object, the resource flow relationship between the target nodes, and the resource flow relationship between the target node and the first node.

[0062] The server may determine the target graph structure data as the risk group mining result for the first detection object, or the server may also generate the risk group mining result for the first detection object based on the target graph structure data using a large language model.

[0063] An embodiment of the present specification provides a data processing method, which receives a risk group mining request for a first detection object triggered by a target user, and in response to the risk group mining request, determines a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object. Then, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node can be obtained, wherein the first node can be a node corresponding to the first detection object in the graph structure data, and the second node can be a node in the graph structure data that has a resource flow relationship with the first node. Based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern, a target score for each second node is determined, and the second nodes are screened and processed according to the target score of each second node to obtain a target node. Finally, based on the target node, target graph structure data corresponding to the first detection object can be constructed, and based on the target graph structure data, a risk group mining result for the first detection object is determined. In this way, in combination with the target resource flow pattern corresponding to the risk group mining request, the target score of the neighbor node (i.e., the second node) of each first node can be determined in a targeted manner through the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern. In this way, when the resource flow relationship of the first detection object is relatively complex, the node screening process can be carried out quickly and accurately according to the target score of the second node, so as to determine the risk group mining result according to the screened target node, thereby improving the mining efficiency and accuracy of the risk group.

[0064] In practical applications, before determining the target score of each second node, the matching degree between the second wandering path and the target resource flow pattern can also be determined. There are many ways to determine the matching degree. The following is an optional processing method, such as Figure 4 As shown, the process may specifically include the following steps S402 to S404.

[0065] In step S402, the second wandering path and the target resource flow mode are encoded according to a preset encoding rule to obtain a first encoding result corresponding to the second wandering path and a second encoding result corresponding to the target resource flow mode.

[0066] In practical applications, the preset encoding rules may include prefix tree encoding rules and suffix tree encoding rules. The prefix tree encoding rule may mean that when encoding a character set, the encoding of any character in the character set is not a prefix of the encoding of other characters. The suffix tree encoding rule can be used to represent all suffixes of a string. The suffix tree can be composed of a root node and multiple paths, each path representing a string suffix. The suffix tree stores common prefixes through path compression, which can greatly reduce space occupancy. Each leaf node can represent the suffix of a string and store the position of the suffix in the original string. The suffix tree can quickly complete pattern matching operations.

[0067] In implementation, Figure 5 As shown, the server can encode the second wandering path and the target resource flow mode according to the prefix tree encoding rule or the suffix tree encoding rule, so as to improve the matching efficiency through the first encoding result and the second encoding result obtained by encoding.

[0068] In step S404, a matching degree between the second walking path and the target resource transfer pattern is determined based on the similarity between the first encoding result and the second encoding result.

[0069] In implementation, the server may determine the similarity between the first encoding result and the second encoding result as the matching degree between the second walking path and the target resource flow pattern.

[0070] In practical applications, in step S110, the second nodes are screened according to the target score of each second node, and the specific processing method for obtaining the target node can be various, such as Figure 6 As shown, the process may specifically include the following steps S1102 to S1106.

[0071] In step S1102, historical resource flow data of a second detection object corresponding to the second node is obtained.

[0072] The historical resource flow data may be data related to resource flow (such as data flow quantity, resource flow time, data flow object, etc.) involved in the resource flow processing performed by the second detection object within a preset detection period.

[0073] In step S1104, risk detection processing is performed on the second detection object according to the pre-trained risk detection model and based on the historical resource flow data of the second detection object to obtain a risk score of the second detection object.

[0074] Among them, the risk detection model can be a model built based on a preset machine learning algorithm.

[0075] During implementation, the server can train the risk detection model according to a supervised training method to obtain a trained risk detection model, and perform risk detection processing on the second detection object based on the historical resource flow data of the second detection object according to the pre-trained risk detection model to obtain the risk score of the second detection object.

[0076] In step S1106, the second nodes are screened according to the target score of each second node and the risk score of the second detection object corresponding to each second node to obtain a target node.

[0077] In implementation, the server can determine the first score corresponding to each second node based on the preset weight, the target score of each second node, and the risk score of the second detection object corresponding to each second node, and screen the second nodes based on the first integral value of each second node to obtain the target node.

[0078] In this way, the server can use the existing data set and annotation information to train a supervised learning model (i.e., risk detection model). The trained risk detection model can be used to evaluate and score newly added data or nodes to identify effective expansion nodes (i.e., target nodes).

[0079] In practical applications, after determining the risk group mining results, the risk group mining results can also be sent to the target user, and the target user's risk group mining request for the risk group mining results can be received to continue the risk group mining process. There are many specific processing methods for continuing the risk group mining process. The following is an optional processing method, such as Figure 7 As shown, the process may specifically include the following steps S702 to S704.

[0080] In step S702 , the risk group mining result is fed back to the target user, and upon receiving a risk group mining request from the target user for the risk group mining result, an object corresponding to a node in the target graph structure data is determined as a first detection object.

[0081] During implementation, the server can feed back the risk group mining results to the target user. If the target user determines that the received risk group mining results do not meet the mining requirements (such as the number of objects included in the risk group mining results does not meet the preset number requirements, etc.), the target user can trigger a risk group mining request for the risk group mining results.

[0082] Upon receiving a risk group mining request from a target user for a risk group mining result, the server may determine an object corresponding to a node in the target graph structure data as a first detection object.

[0083] In step S704 , risk group mining is continued according to the target resource flow pattern and the first detection object to obtain a risk group mining result for the first detection object.

[0084] During implementation, the server can continue to perform risk group mining processing on each first detection object based on the target resource flow pattern and each first detection object, and obtain the risk group mining results for each first detection object. Then, the server can summarize the risk group mining results of each first detection object and feed back the summarized risk group mining results to the target user again.

[0085] In practical applications, the target resource flow mode may include topology structure data for representing multiple resource flow modes, and / or text description data containing multiple resource flow modes.

[0086] For example, the target resource transfer mode can be as follows Figure 8 The topology structure shown in FIG. 1 may include a collection mode and a rebate mode, or the target resource flow mode may be text description data such as “collection->flow->rebate”.

[0087] In this way, through the predefined topology structure data, the server can automatically determine the joining of nodes, so as to make it have good interpretability through the reasonably designed topology structure data.

[0088] In practical applications, the specific processing methods for determining the target resource flow pattern corresponding to the risk group mining request in step S104 and the graph structure data constructed according to the resource flow relationship of the first detection object can be varied. The following is an optional processing method, such as Figure 9 As shown, the process may specifically include the following steps S1042 to S1044.

[0089] In step S1042 , the input data of the target user corresponding to the risk group mining request is obtained.

[0090] In step S1044, the preset large language model is used to determine the first detection object corresponding to the risk group mining request, the target resource flow pattern, and the graph structure data constructed based on the resource flow relationship of the first detection object according to the input data of the target user.

[0091] In implementation, Figure 10As shown, the target user can input a risk group mining request for the first detection object in the interactive group mining system built based on the Large Language Model (LLM). The server can use the preset large language model to determine the first detection object and target resource flow pattern corresponding to the risk group mining request, as well as the graph structure data constructed based on the resource flow relationship of the first detection object according to the input data of the target user.

[0092] In this way, on the one hand, the server can leverage the natural language processing capabilities of a large language model to analyze resource flow patterns between manually specified group members, thereby assisting in identifying and mining group behavior. On the other hand, through the interactive group mining system, users can guide the group mining process by entering specific queries, adjusting parameters, or providing feedback. The interactive group mining system can update and display mining results in real time based on interactions with users.

[0093] In general, an interactive group mining system can be built based on a large language model (LLM), helping users quickly identify and mine groups associated with specific customers. Users can enter natural language requests, for example, to query group information for a specific customer and the group's financial transaction patterns. After receiving the user's request, the system uses built-in mining algorithms to analyze data based on established resource flow patterns (e.g., collection -> circulation -> refund), thereby identifying groups associated with the user-entered customer (e.g., user identified as 2088××8912).

[0094] In addition, if Figure 10 As shown, when the target user re-enters the first risk group mining request in the interactive group mining system, the server can perform a 2-hop expansion to present the basic structure and members of the mined risk groups.

[0095] After obtaining preliminary results, the target user can request further expansion to seek broader group information. At this stage, LLM, based on the target user's instructions, can increase the scope of expansion to four hops to further explore potential group members and their interactions. This process not only improves the comprehensiveness of the information but also enhances the user's understanding of group behavior patterns. The entire system, through a highly adaptive interactive approach, simplifies operation for non-expert users, making complex data mining tasks more intuitive and efficient.

[0096] By leveraging advanced natural language processing technology and an interactive user interface, we provide users with an intuitive, flexible, and efficient risk group identification tool. This tool can adapt to the ever-changing flow of risk resources, providing regulators with a powerful risk management and prevention tool.

[0097] In practical applications, the specific processing methods for obtaining the first wandering path corresponding to the first node and the second wandering path corresponding to the second node according to the graph structure data in step S106 can be varied. The instruction variation can include instruction-level variation. Accordingly, an optional processing method is provided below, such as Figure 11 As shown, the process may specifically include the following steps S1062 to S1064.

[0098] In step S1062 , a preset large language model is used to determine the search level requirement corresponding to the risk group mining request based on the input data of the target user.

[0099] Among them, the search level can include high level, medium level, etc.

[0100] During implementation, the server can utilize the text understanding capability of the large language model to parse the input data of the target user to determine the retrieval level requirement corresponding to the risk group mining request.

[0101] In this way, the server can leverage the powerful capabilities of LLM to transform qualitative natural language descriptions into quantitative pattern recognition tasks, thereby accurately identifying potential risk groups within massive amounts of data. This not only improves identification accuracy but also enhances responsiveness and adaptability to emerging risk data flow patterns.

[0102] In step S1064 , the walk order is determined according to the search level requirement, and based on the walk order and the graph structure data, a first walk path and a second walk path are obtained.

[0103] The walk order refers to the average number of steps from a node to another node after n steps during a random walk. For example, taking the walk order as 2, the server can use the first node as the central node, obtain node 1 adjacent to the first node after 1 step, and obtain node 2 adjacent to node 1 after another step. Finally, the first walk path can be constructed based on the first node, node 1, and node 2.

[0104] In implementation, the server can determine the wandering order based on the preset correspondence between the retrieval level and the wandering order. Then, based on the wandering order and according to the graph structure data, the server can perform node wandering processing with the first node as the center node to obtain a first wandering path, and perform node wandering processing with the second node as the center node to obtain a second wandering path.

[0105] An embodiment of the present specification provides a data processing method, which receives a risk group mining request for a first detection object triggered by a target user, and in response to the risk group mining request, determines a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object. Then, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node can be obtained, wherein the first node can be a node corresponding to the first detection object in the graph structure data, and the second node can be a node in the graph structure data that has a resource flow relationship with the first node. Based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern, a target score for each second node is determined, and the second nodes are screened and processed according to the target score of each second node to obtain a target node. Finally, based on the target node, target graph structure data corresponding to the first detection object can be constructed, and based on the target graph structure data, a risk group mining result for the first detection object is determined. In this way, in combination with the target resource flow pattern corresponding to the risk group mining request, the target score of the neighbor node (i.e., the second node) of each first node can be determined in a targeted manner through the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern. In this way, when the resource flow relationship of the first detection object is relatively complex, the node screening process can be carried out quickly and accurately according to the target score of the second node, so as to determine the risk group mining result according to the screened target node, thereby improving the mining efficiency and accuracy of the risk group.

[0106] The above is a data processing method provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a data processing device, such as Figure 12 shown.

[0107] The data processing device includes: a request receiving module 1201, a data acquiring module 1202, a path acquiring module 1203, a score determining module 1204, a node determining module 1205 and a result determining module 1206, wherein:

[0108] The request receiving module 1201 is configured to receive a risk group mining request for a first detection object triggered by a target user;

[0109] A data acquisition module 1202 is configured to determine, in response to the risk group mining request, a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed based on the resource flow relationship of the first detection object;

[0110] A path acquisition module 1203 is configured to acquire, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node in the graph structure data corresponding to the first detection object, and the second node is a node in the graph structure data that has a resource flow relationship with the first node;

[0111] a score determination module 1204 configured to determine a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a match between the second wandering path and the target resource transfer pattern;

[0112] A node determination module 1205 is configured to screen the second nodes according to the target score of each second node to obtain a target node;

[0113] The result determination module 1206 is configured to construct target graph structure data corresponding to the first detection object according to the target node, and determine a risk group mining result for the first detection object according to the target graph structure data.

[0114] In the embodiment of this specification, the device further includes:

[0115] a data encoding module, configured to encode the second wandering path and the target resource transfer mode according to a preset encoding rule, respectively, to obtain a first encoding result corresponding to the second wandering path and a second encoding result corresponding to the target resource transfer mode;

[0116] A result matching module is used to determine a matching degree between the second walking path and the target resource flow pattern according to a similarity between the first encoding result and the second encoding result.

[0117] In the embodiment of this specification, the preset encoding rules include prefix tree encoding rules and suffix tree encoding rules.

[0118] In the embodiment of this specification, the node determination module 1205 is used to:

[0119] Obtaining historical resource flow data of a second detection object corresponding to the second node;

[0120] According to the pre-trained risk detection model, based on the historical resource flow data of the second detection object, risk detection processing is performed on the second detection object to obtain a risk score of the second detection object;

[0121] According to the target score of each second node and the risk score of the second detection object corresponding to each second node, the second nodes are screened to obtain the target node.

[0122] In the embodiment of this specification, the device further includes:

[0123] a result feedback module, configured to feed back the risk group mining result to the target user, and upon receiving a risk group mining request from the target user regarding the risk group mining result, determine an object corresponding to a node in the target graph structure data as the first detection object;

[0124] The group mining module is used to continue risk group mining processing according to the target resource flow pattern and the first detection object to obtain a risk group mining result for the first detection object.

[0125] In the embodiment of this specification, the target resource flow mode includes topology structure data for representing multiple resource flow modes, and / or text description data containing multiple resource flow modes.

[0126] In the embodiment of this specification, the data acquisition module 1202 is used to:

[0127] Acquire input data of the target user corresponding to the risk group mining request;

[0128] Using a preset large language model, based on the input data of the target user, a first detection object corresponding to the risk group mining request, the target resource flow pattern, and graph structure data constructed based on the resource flow relationship of the first detection object are determined.

[0129] In the embodiment of this specification, the path acquisition module 1203 is used to:

[0130] Determining, using the preset large language model and based on the input data of the target user, a search level requirement corresponding to the risk group mining request;

[0131] According to the search level requirement, a walking order is determined, and based on the walking order and the graph structure data, the first walking path and the second walking path are acquired.

[0132] An embodiment of the present specification provides a data processing device, which receives a risk group mining request for a first detection object triggered by a target user, and in response to the risk group mining request, determines a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object. Then, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node can be obtained, wherein the first node can be a node corresponding to the first detection object in the graph structure data, and the second node can be a node in the graph structure data that has a resource flow relationship with the first node. Based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern, a target score for each second node is determined, and the second nodes are screened and processed according to the target score of each second node to obtain a target node. Finally, based on the target node, target graph structure data corresponding to the first detection object can be constructed, and based on the target graph structure data, a risk group mining result for the first detection object is determined. In this way, in combination with the target resource flow pattern corresponding to the risk group mining request, the target score of the neighbor node (i.e., the second node) of each first node can be determined in a targeted manner through the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern. In this way, when the resource flow relationship of the first detection object is relatively complex, the node screening process can be carried out quickly and accurately according to the target score of the second node, so as to determine the risk group mining result according to the screened target node, thereby improving the mining efficiency and accuracy of the risk group.

[0133] The above is a data processing device provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides a data processing device, such as Figure 13 shown.

[0134] The data processing device may provide a terminal device or a server, etc. for the above embodiments.

[0135] Data processing devices can vary significantly depending on their configuration or performance. They may include one or more processors 1301 and memory 1302. Memory 1302 may store one or more applications or data. Memory 1302 may be either ephemeral or persistent. Applications stored in memory 1302 may include one or more modules (not shown), each of which may include a series of computer-executable instructions for the data processing device. Furthermore, processor 1301 may be configured to communicate with memory 1302 to execute the series of computer-executable instructions in memory 1302 on the data processing device. The data processing device may also include one or more power supplies 1303, one or more wired or wireless network interfaces 1304, one or more input / output interfaces 1305, and one or more keyboards 1306.

[0136] Specifically, in this embodiment, the data processing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the data processing device, and the one or more programs are configured to be executed by one or more processors, including computer-executable instructions for performing the following:

[0137] receiving a risk group mining request for a first detection object triggered by a target user;

[0138] In response to the risk group mining request, determining a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed according to the resource flow relationship of the first detection object;

[0139] Obtaining, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node in the graph structure data corresponding to the first detection object, and the second node is a node in the graph structure data that has a resource flow relationship with the first node;

[0140] Determining a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a matching degree between the second wandering path and the target resource transfer pattern;

[0141] screening the second nodes according to the target score of each second node to obtain a target node;

[0142] According to the target node, target graph structure data corresponding to the first detection object is constructed, and according to the target graph structure data, a risk group mining result for the first detection object is determined.

[0143] The various embodiments in this specification are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences between the other embodiments. In particular, the data processing device embodiment is generally similar to the method embodiment, so its description is relatively simple. For relevant portions, refer to the description of the method embodiment.

[0144] An embodiment of the present specification provides a data processing device, which receives a risk group mining request for a first detection object triggered by a target user, and in response to the risk group mining request, determines a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed based on the resource flow relationship of the first detection object. Then, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node can be obtained, wherein the first node can be a node corresponding to the first detection object in the graph structure data, and the second node can be a node in the graph structure data that has a resource flow relationship with the first node. Based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern, a target score for each second node is determined, so that the second nodes are screened and processed according to the target score of each second node to obtain a target node. Finally, based on the target node, target graph structure data corresponding to the first detection object can be constructed, and based on the target graph structure data, a risk group mining result for the first detection object is determined. In this way, in combination with the target resource flow pattern corresponding to the risk group mining request, the target score of the neighbor node (i.e., the second node) of each first node can be determined in a targeted manner through the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern. In this way, when the resource flow relationship of the first detection object is relatively complex, the node screening process can be carried out quickly and accurately according to the target score of the second node, so as to determine the risk group mining result according to the screened target node, thereby improving the mining efficiency and accuracy of the risk group.

[0145] Furthermore, based on the above Figures 1 to 11 One or more embodiments of this specification further provide a storage medium for storing computer-executable instruction information. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, the following process can be implemented:

[0146] receiving a risk group mining request for a first detection object triggered by a target user;

[0147] In response to the risk group mining request, determining a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed according to the resource flow relationship of the first detection object;

[0148] Obtaining, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node in the graph structure data corresponding to the first detection object, and the second node is a node in the graph structure data that has a resource flow relationship with the first node;

[0149] Determining a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a matching degree between the second wandering path and the target resource transfer pattern;

[0150] screening the second nodes according to the target score of each second node to obtain a target node;

[0151] According to the target node, target graph structure data corresponding to the first detection object is constructed, and according to the target graph structure data, a risk group mining result for the first detection object is determined.

[0152] The various embodiments in this specification are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences from the other embodiments. In particular, the aforementioned storage medium embodiment is generally similar to the method embodiment, so its description is relatively simple. For relevant portions, refer to the description of the method embodiment.

[0153] An embodiment of the present specification provides a storage medium, which receives a risk group mining request for a first detection object triggered by a target user, and in response to the risk group mining request, determines a target resource flow pattern corresponding to the risk group mining request, and graph structure data constructed according to the resource flow relationship of the first detection object. Then, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node can be obtained, wherein the first node can be a node corresponding to the first detection object in the graph structure data, and the second node can be a node in the graph structure data that has a resource flow relationship with the first node. Based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern, a target score for each second node is determined, so that the second nodes are screened and processed according to the target score of each second node to obtain a target node. Finally, based on the target node, target graph structure data corresponding to the first detection object can be constructed, and based on the target graph structure data, a risk group mining result for the first detection object is determined. In this way, in combination with the target resource flow pattern corresponding to the risk group mining request, the target score of the neighbor node (i.e., the second node) of each first node can be determined in a targeted manner through the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern. In this way, when the resource flow relationship of the first detection object is relatively complex, the node screening process can be carried out quickly and accurately according to the target score of the second node, so as to determine the risk group mining result according to the screened target node, thereby improving the mining efficiency and accuracy of the risk group.

[0154] Furthermore, based on the above Figures 1 to 11 One or more embodiments of this specification further provide a computer program product, including a computer program. When the computer program in the computer program product is executed by a processor, it can implement the following process:

[0155] receiving a risk group mining request for a first detection object triggered by a target user;

[0156] In response to the risk group mining request, determining a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed according to the resource flow relationship of the first detection object;

[0157] Obtaining, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node in the graph structure data corresponding to the first detection object, and the second node is a node in the graph structure data that has a resource flow relationship with the first node;

[0158] Determining a target score for each second node based on a similarity between the first wandering path and the second wandering path, and a matching degree between the second wandering path and the target resource transfer pattern;

[0159] screening the second nodes according to the target score of each second node to obtain a target node;

[0160] According to the target node, target graph structure data corresponding to the first detection object is constructed, and according to the target graph structure data, a risk group mining result for the first detection object is determined.

[0161] The various embodiments in this specification are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences between the other embodiments. In particular, the aforementioned computer program product embodiment is generally similar to the method embodiment, so its description is relatively simple. For relevant portions, reference can be made to the description of the method embodiment.

[0162] An embodiment of the present specification provides a computer program product that receives a risk group mining request for a first detection object triggered by a target user, and in response to the risk group mining request, determines a target resource flow pattern corresponding to the risk group mining request, as well as graph structure data constructed based on the resource flow relationship of the first detection object. Then, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node can be obtained, wherein the first node can be a node corresponding to the first detection object in the graph structure data, and the second node can be a node in the graph structure data that has a resource flow relationship with the first node. Based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern, a target score for each second node is determined, and the second nodes are screened and processed based on the target score of each second node to obtain a target node. Finally, target graph structure data corresponding to the first detection object can be constructed based on the target node, and a risk group mining result for the first detection object can be determined based on the target graph structure data. In this way, in combination with the target resource flow pattern corresponding to the risk group mining request, the target score of the neighbor node (i.e., the second node) of each first node can be determined in a targeted manner through the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern. In this way, when the resource flow relationship of the first detection object is relatively complex, the node screening process can be carried out quickly and accurately according to the target score of the second node, so as to determine the risk group mining result according to the screened target node, thereby improving the mining efficiency and accuracy of the risk group.

[0163] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0164] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using physical hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly performed using software called a "logic compiler." This is similar to the software compilers used during program development. Before compilation, the original code must be written in a specific programming language, called a Hardware Description Language (HDL). There are many types of HDL, including ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that simply by programming a method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0165] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the memory control logic. Those skilled in the art will also appreciate that, in addition to implementing the controller purely in computer-readable program code, the controller can also be implemented in the form of logic gates, switches, an application-specific integrated circuit, a programmable logic controller, an embedded microcontroller, etc. by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the means for implementing the various functions included therein can also be considered as structures within the hardware component. Alternatively, the means for implementing the various functions can be considered both a software module implementing the method and a structure within the hardware component.

[0166] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0167] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0168] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] The embodiments of this specification are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable fraud case serial and parallel device to produce a machine, so that the instructions executed by the processor of the computer or other programmable fraud case serial and parallel device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable fraud case serial and parallel device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, the instruction device being implemented in the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0171] These computer program instructions may also be loaded onto a computer or other programmable device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0172] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0173] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0174] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can be implemented using any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media such as modulated data signals and carrier waves.

[0175] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0176] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0177] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communications network. In distributed computing environments, program modules may be located in local and remote computer storage media, including storage devices.

[0178] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0179] The foregoing description is merely an example of the present invention and is not intended to limit this document. Various modifications and variations are possible within the scope of this specification. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification are intended to be within the scope of the claims of this specification.

Claims

1. A data processing method, comprising: receiving a risk group mining request for a first detection object triggered by a target user; In response to the risk group mining request, determining a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed according to the resource flow relationship of the first detection object; Obtaining, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node in the graph structure data corresponding to the first detection object, and the second node is a node in the graph structure data that has a resource flow relationship with the first node; Determining a target score for each second node based on the similarity between the first and second wandering paths, and the degree of match between the second wandering path and the target resource transfer pattern; wherein the target resource transfer pattern includes collection, transfer, and rebate; screening the second nodes according to the target score of each second node to obtain a target node; According to the target node, target graph structure data corresponding to the first detection object is constructed, and according to the target graph structure data, a risk group mining result for the first detection object is determined.

2. The method according to claim 1, before determining the target score of each second node based on the similarity between the first wandering path and the second wandering path, and the matching degree between the second wandering path and the target resource flow pattern, further comprising: According to a preset encoding rule, encoding the second wandering path and the target resource flow mode is performed respectively to obtain a first encoding result corresponding to the second wandering path and a second encoding result corresponding to the target resource flow mode; A degree of matching between the second roaming path and the target resource transfer pattern is determined based on a similarity between the first encoding result and the second encoding result.

3. According to the method of claim 2, the preset encoding rules include prefix tree encoding rules and suffix tree encoding rules.

4. The method according to claim 1, wherein the step of screening the second nodes according to the target score of each second node to obtain the target node comprises: Obtaining historical resource flow data of a second detection object corresponding to the second node; According to the pre-trained risk detection model, based on the historical resource flow data of the second detection object, risk detection processing is performed on the second detection object to obtain a risk score of the second detection object; According to the target score of each second node and the risk score of the second detection object corresponding to each second node, the second nodes are screened to obtain the target node.

5. The method according to claim 1, further comprising: Feedback the risk group mining result to the target user, and upon receiving a risk group mining request from the target user for the risk group mining result, determine the object corresponding to the node in the target graph structure data as the first detection object; Based on the target resource flow pattern and the first detection object, risk group mining processing is continued to obtain a risk group mining result for the first detection object.

6. The method according to claim 1, wherein the target resource flow mode comprises topology structure data for representing multiple resource flow modes, and / or text description data containing multiple resource flow modes.

7. The method according to claim 6, wherein determining the target resource flow pattern corresponding to the risk group mining request and constructing graph structure data based on the resource flow relationship of the first detection object comprises: Acquire input data of the target user corresponding to the risk group mining request; Using a preset large language model, based on the input data of the target user, a first detection object corresponding to the risk group mining request, the target resource flow pattern, and graph structure data constructed based on the resource flow relationship of the first detection object are determined.

8. The method according to claim 7, wherein obtaining, based on the graph structure data, a first wandering path corresponding to the first node and a second wandering path corresponding to the second node comprises: Determining, using the preset large language model and based on the input data of the target user, a search level requirement corresponding to the risk group mining request; According to the search level requirement, a walking order is determined, and based on the walking order and the graph structure data, the first walking path and the second walking path are acquired.

9. A data processing device comprising: A request receiving module, configured to receive a risk group mining request for a first detection object triggered by a target user; a data acquisition module, configured to determine, in response to the risk group mining request, a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed according to the resource flow relationship of the first detection object; a path acquisition module, configured to acquire, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node in the graph structure data corresponding to the first detection object, and the second node is a node in the graph structure data that has a resource flow relationship with the first node; a score determination module, configured to determine a target score for each second node based on a similarity between the first and second wandering paths, and a match between the second wandering path and the target resource transfer pattern; wherein the target resource transfer pattern includes pooling, transfer, and rebate; a node determination module, configured to screen the second nodes according to the target score of each second node to obtain a target node; The result determination module is used to construct target graph structure data corresponding to the first detection object according to the target node, and determine the risk group mining result for the first detection object according to the target graph structure data.

10. A data processing device, comprising: processor; as well as a memory arranged to store computer-executable instructions which, when executed, cause the processor to: receiving a risk group mining request for a first detection object triggered by a target user; In response to the risk group mining request, determining a target resource flow pattern corresponding to the risk group mining request and graph structure data constructed according to the resource flow relationship of the first detection object; Obtaining, based on the graph structure data, a first wandering path corresponding to a first node and a second wandering path corresponding to a second node, wherein the first node is a node in the graph structure data corresponding to the first detection object, and the second node is a node in the graph structure data that has a resource flow relationship with the first node; Determining a target score for each second node based on the similarity between the first and second wandering paths, and the degree of match between the second wandering path and the target resource transfer pattern; wherein the target resource transfer pattern includes collection, transfer, and rebate; screening the second nodes according to the target score of each second node to obtain a target node; According to the target node, target graph structure data corresponding to the first detection object is constructed, and according to the target graph structure data, a risk group mining result for the first detection object is determined.

Images