Business risk processing method and device, electronic equipment and medium

Abstract

The invention provides a business risk processing method, relates to the technical field of artificial intelligence, in particular to the technical field of big data, deep learning and large models, and can be applied to scenes such as financial science and technology. The method comprises the following steps: acquiring a historical IP address and service attribute characteristics used by a target user, and determining a target space-time unit to which the target user belongs based on access time and position information of the historical IP address; determining overlapping information between the target space-time unit and a sample space-time unit of a sample user in a pre-constructed user behavior map, and determining a group association feature of the target user according to the overlapping information; matching the target space-time unit with a sample time code and a sample space code in a preset constructed space-time behavior tensor, and determining space-time behavior characteristics of the target user according to a matching result; and predicting the business risk of the target user according to the business attribute characteristics, the group association characteristics and the spatio-temporal behavior characteristics. According to the invention, the accuracy and comprehensiveness of business risk prediction can be improved.

Description

Technical Field

[0001] It relates to the field of artificial intelligence technology, especially to the fields of big data, deep learning, large models, etc., and can be applied to scenarios such as fintech. Specifically, it relates to a method for processing business risks. Background Art

[0002] With the development of big data technology, IP address data has gradually become an important basis for business risk processing. The utilization of IP address data in related technologies is often limited to single-dimensional analysis (such as location attributes or time attributes), and the spatio-temporal characteristics contained in IP address data cannot be fully explored. In addition, related technologies usually lack sufficient correlation analysis between user group behaviors, resulting in insufficient accuracy and comprehensiveness of business risk prediction. Summary of the Invention

[0003] The present disclosure provides a method, device, electronic device, and medium for processing business risks.

[0004] According to one aspect of the present disclosure, there is provided a method for processing business risks, the method comprising:

[0005] Obtaining historical IP address data and business attribute feature data used by a target user, and determining a target spatio-temporal unit to which the target user belongs based on the access time data and location information data of the historical IP address data;

[0006] Determining overlapping information data between the target spatio-temporal unit and the sample spatio-temporal units of sample users in a pre-constructed user behavior map, and determining group association feature data of the target user according to the overlapping information data;

[0007] Matching the target spatio-temporal unit with sample time encoding and sample space encoding in a pre-constructed spatio-temporal behavior tensor, and determining spatio-temporal behavior feature data of the target user according to the matching result;

[0008] Performing business risk prediction on the target user according to the business attribute feature data, the group association feature data, and the spatio-temporal behavior feature data.

[0009] According to another aspect of the present disclosure, there is provided a device for processing business risks, the device comprising:

[0010] A target spatio-temporal unit determination module, configured to obtain historical IP address data and business attribute feature data used by a target user, and determine a target spatio-temporal unit to which the target user belongs based on the access time data and location information data of the historical IP address data;

[0011] A group association feature determination module, configured to determine the overlap information data between the target spatio-temporal unit and the sample spatio-temporal units of sample users in a pre-constructed user behavior map, and determine the group association feature data of the target user according to the overlap information data;

[0012] A spatio-temporal behavior feature determination module, configured to match the target spatio-temporal unit with sample time encodings and sample space encodings in a preset spatio-temporal behavior tensor, and determine the spatio-temporal behavior feature data of the target user according to the matching result;

[0013] A business risk prediction module, configured to perform business risk prediction on the target user according to the business attribute feature data, the group association feature data, and the spatio-temporal behavior feature data.

[0014] According to another aspect of the present disclosure, there is provided an electronic device, which includes:

[0015] At least one processor; and

[0016] A memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the business risk processing method according to any embodiment of the present disclosure.

[0018] According to another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the business risk processing method according to any embodiment of the present disclosure.

[0019] According to another aspect of the present disclosure, there is provided a computer program product, including a computer program, where the computer program implements the business risk processing method according to any embodiment of the present disclosure when executed by a processor.

[0020] The present disclosure makes full use of and fully exploits the spatio-temporal characteristics of IP address data, explores the associations between user group behaviors, and improves the accuracy and comprehensiveness of business risk prediction.

[0021] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it used to limit the scope of the present disclosure. Other features of the present disclosure will become easily understandable through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings are used to better understand the solution and do not constitute a limitation to the present disclosure. Among them:

[0023] Figure 1 is a flowchart of a business risk handling method provided according to an embodiment of the present disclosure;

[0024] Figure 2 is a flowchart of another business risk handling method provided according to an embodiment of the present disclosure;

[0025] Figure 3 is a flowchart of yet another business risk handling method provided according to an embodiment of the present disclosure;

[0026] Figure 4 is a flowchart of yet another business risk handling method provided according to an embodiment of the present disclosure;

[0027] Figure 5 is a schematic structural diagram of a business risk handling device provided according to an embodiment of the present disclosure;

[0028] Figure 6 is a block diagram of an electronic device for implementing a business risk handling method according to an embodiment of the present disclosure. Detailed implementation manners

[0029] The following makes an explanation of exemplary embodiments of the present disclosure with reference to the accompanying drawings. Various details of the embodiments of the present disclosure are included to facilitate understanding, and they should be considered merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted below.

[0030] Figure 1 is a flowchart of a business risk handling method provided according to an embodiment of the present disclosure. The embodiments of the present disclosure are applicable to situations where business risks of users, such as overdue risks, are predicted. This method can be executed by a business risk handling device, and the device can be implemented in a software and / or hardware manner. As Figure 1 shown, the business risk handling method of this embodiment can include:

[0031] S101, obtaining historical IP address data and business attribute feature data used by a target user, and determining a target spatio-temporal unit to which the target user belongs based on the access time data and location information data of the historical IP address data.

[0032] S102, determining overlapping information data between the target spatio-temporal unit and sample spatio-temporal units of sample users in a pre-constructed user behavior map, and determining group association feature data of the target user according to the overlapping information data.

[0033] S103. Match the target spatio-temporal unit with the sample time encoding and sample space encoding in the pre-constructed spatio-temporal behavior tensor, and determine the spatio-temporal behavior feature data of the target user according to the matching result.

[0034] S104. Perform business risk prediction on the target user according to the business attribute feature data, the group association feature data, and the spatio-temporal behavior feature data.

[0035] Among them, the target user refers to the user who needs to perform business risk prediction. Optionally, the business risk belongs to the fintech scenario, and the specific type of business risk is not limited here and is determined according to the actual business needs. Exemplarily, the business risk can be the risk of credit overdue. IP address data (Internet Protocol Address) refers to the Internet protocol address, also translated as the Internet protocol address. Historical IP address data refers to the IP addresses used by the target user during access activities. The historical IP address data is at least two, and the quantity of the historical IP address data is not limited here and is determined according to the actual situation.

[0036] IP address data has time attributes and space attributes, and can reflect the dynamic changes of user behavior from the time dimension and the space dimension. The access time data is the time attribute of the IP address data, and the location information data is the space attribute of the IP address data. Optionally, based on the access time data and location information data of the historical IP address data, determine the time encoding and space encoding of the historical IP address data respectively, and determine the spatio-temporal unit corresponding to the historical IP address data based on the time encoding and space encoding. Each piece of historical IP address data has a corresponding time encoding and space encoding, that is to say, each piece of historical IP address data has a corresponding spatio-temporal unit. In the case where the historical IP address data is at least two, comprehensively determine the target spatio-temporal unit to which the target user belongs based on the spatio-temporal units corresponding to each piece of historical IP address data.

[0037] Among them, the target spatio-temporal unit is the spatio-temporal unit to which the target user belongs. The target spatio-temporal unit is related to the historical IP address data used by the target user. The target spatio-temporal unit is obtained by dividing the historical IP address data used by the target user from the time dimension and the space dimension. By dividing the spatio-temporal unit and analyzing the potential behavior patterns of users in units of spatio-temporal units, the time attribute and space attribute of the IP address data can be combined, which is conducive to fully mining the spatio-temporal characteristics contained in the IP address data.

[0038] Among them, the sample user refers to the research object of business risk processing, and the business risk of the sample user is known. The sample spatio-temporal unit is the spatio-temporal unit to which the sample user belongs. The sample spatio-temporal unit is related to the historical IP address data used by the sample user. The sample spatio-temporal unit and the target spatio-temporal unit are divided in the same way.

[0039] The user behavior graph is pre-constructed based on the overlapping information data between sample spatio-temporal units. Based on the overlapping information data between spatio-temporal units, the spatio-temporal units to which different users belong together can be determined. The overlapping information data between spatio-temporal units is used to reflect the spatio-temporal correlation strength between different users. Among them, the spatio-temporal correlation strength is used to quantify the similarity of behavior patterns between different users. The user behavior graph is used for user bucketing, and users with similar business risks can be divided into one bucket. Based on the user behavior graph, the business risk conduction path can be identified and the correlation between the behaviors of user groups can be analyzed.

[0040] The spatio-temporal unit has a definite time code and space code. Based on the time code and space code, the overlapping information data between the target spatio-temporal unit and the sample spatio-temporal unit can be determined. Based on the overlapping information data, the spatio-temporal correlation strength between the target user and the sample user in the user behavior graph can be determined, and the correlation between the target user and the sample user can be established. Since the business risk of the sample user is known, by establishing the correlation between the target user and the sample user, analyzing the spatio-temporal correlation strength between the target user and the sample user, and mining the correlation between the behaviors of user groups, the group correlation feature data of the target users can be obtained.

[0041] Among them, the group correlation feature data of the target user is related to the business risk of the user group composed of the sample users. The group correlation feature data of the target user can reflect the potential behavior pattern and business risk of the target user from the group behavior dimension.

[0042] Among them, the spatio-temporal behavior tensor includes three dimensions: user, time, and space, and integrates spatio-temporal information and behavior characteristics. The spatio-temporal behavior tensor is used to reflect the potential behavior pattern of the user from the time dimension and the space dimension. The spatio-temporal behavior tensor is pre-constructed based on the access behavior intensity of the sample user in the sample spatio-temporal unit. By decomposing the spatio-temporal behavior tensor, at least the time factor vector and the space factor vector can be obtained.

[0043] The time dimension of the spatio-temporal behavior tensor is the sample time code, and the space dimension is the sample space code. Among them, the sample time code and the sample space code are the time code and the space code of the sample spatio-temporal unit respectively.

[0044] The target spatio-temporal unit has a determined time encoding and a spatial encoding. The time encoding of the target spatio-temporal unit is matched with the sample time encoding, and the spatial encoding of the target spatio-temporal unit is matched with the sample spatial encoding. The corresponding time factor vector and spatial factor vector are extracted from the spatio-temporal behavior tensor as the matching result.

[0045] Among them, the spatio-temporal behavior feature data of the target user is used to reflect the potential behavior pattern of the target user in the time dimension and the spatial dimension. The spatio-temporal behavior feature data of the target user can be determined based on the matching result.

[0046] Among them, the business attribute feature data is determined based on the basic attribute information related to the business risk. The business attribute feature data is the feature data owned by the target user.

[0047] The group association feature data can reflect the potential behavior pattern and business risk of the target user from the group behavior dimension. The spatio-temporal behavior feature data is used to reflect the potential behavior pattern of the target user in the time dimension and the spatial dimension. Based on the business attribute feature data, the group association feature data and the spatio-temporal behavior feature data, the business risk prediction of the target user is realized in the individual dimension and the group dimension.

[0048] The technical solution of the present disclosure combines the spatial information and the time information of the IP address data to divide spatio-temporal units. A user behavior map that can describe group behavior and a spatio-temporal behavior tensor that can reflect the potential behavior pattern of users from the spatio-temporal dimension are pre-constructed. Taking the spatio-temporal unit as a unit, based on the user behavior map and the spatio-temporal behavior tensor, the association between the user spatio-temporal behavior and the group behavior is analyzed to determine the group association feature data and the spatio-temporal behavior feature data of the target user. The group association feature data and the spatio-temporal behavior feature data of the target user are jointly used with the business attribute feature data for business risk prediction, realizing the business risk prediction of the target user in the individual dimension and the group dimension. The spatio-temporal characteristics of the IP address data are fully utilized, the association between group behaviors is mined, and the accuracy and comprehensiveness of business risk prediction are improved.

[0049] In an optional embodiment, the method further includes: determining the intersection spatio-temporal unit between the sample spatio-temporal units of different sample users based on the overlap information data between the sample spatio-temporal units of different sample users; determining the spatio-temporal association strength between the different sample users based on the proportion of the intersection spatio-temporal unit in the sample spatio-temporal units of the sample users; taking the sample users as nodes, determining the edge weights between the nodes based on the spatio-temporal association strength, and constructing a user behavior map; and associating the business risk data of the sample users as node attributes to the user behavior map.

[0050] Among them, the intersection spatio-temporal unit refers to the spatio-temporal unit that determines the common belonging of different sample users. The spatio-temporal correlation strength is used to quantify the degree of mutual correlation of the access behaviors of different sample users in terms of time and space. The spatio-temporal correlation strength is determined based on the proportion of the intersection spatio-temporal unit in the sample spatio-temporal units of the sample users. Optionally, the spatio-temporal correlation strength can be represented by w ij denoted as determined, where i and j respectively identify different users. N co-occur represents the number of intersection spatio-temporal units, that is, the number of spatio-temporal units to which user i and user j commonly belong. N total is the total number of sample spatio-temporal units of user i.

[0051] Taking the sample users as nodes, the edge weights between the nodes are determined based on the spatio-temporal correlation strength. Optionally, the time-coded intersection or the space-coded intersection is used to weight the spatio-temporal correlation strength. For example, based on the space coding of the sample spatio-temporal units, the space-coded intersection between sample user i and sample user j is determined. Based on the number of elements in the space-coded intersection, a weight factor is constructed, such as log(1 + space-coded intersection), and the spatio-temporal correlation strength is weighted by the weight factor, and the obtained weighted result is determined as the edge weight between the nodes.

[0052] Taking the business risk data of the sample users as node attributes, a user behavior graph is constructed. Among them, the business risk data is used to determine the business risk of the sample users. The business risk data is related to the specific type of risk prediction and is not limited here. Exemplarily, if the risk prediction is credit overdue prediction, then the business risk data is the historical overdue rate.

[0053] The above technical solution provides a feasible solution for constructing a user behavior graph, provides data support and technical support for analyzing the correlation between group behaviors, identifying the group risk conduction path, and realizing the business risk prediction of target users from the group dimension, and is beneficial to improving the comprehensiveness and accuracy of risk prediction.

[0054] In an optional embodiment, the method further includes: determining the access behavior intensity of the sample user in the sample spatio-temporal unit based on the number of accesses of the sample user in the sample spatio-temporal unit and the number of IP addresses used in the sample spatio-temporal unit; using the access behavior intensity as matrix elements to construct the spatio-temporal behavior tensor; wherein, the user dimension, time dimension, and space dimension of the spatio-temporal behavior tensor are respectively determined according to the number of sample users, the number of sample time codings, and the number of sample space codings; the spatio-temporal behavior tensor is used to decompose into a time factor vector and a space factor vector.

[0055] The spatio-temporal behavior tensor includes three dimensions: user, time, and space. Among them, the user dimension is determined according to the number of sample users, the time dimension is determined according to the number of sample time encodings, and the space dimension is determined according to the number of sample space encodings. The sample time encoding and the sample space encoding respectively refer to the time encoding and the space encoding of the sample spatio-temporal unit. The matrix elements in the spatio-temporal behavior tensor are the access behavior intensities of the sample users in the sample spatio-temporal units. The matrix elements can be denoted by S uts . S uts represents the access behavior intensity of sample user u in sample spatio-temporal unit ts. S uts =(the number of access times of sample user u in sample spatio-temporal unit ts)×log(1 + the number of IP addresses used by sample user u in sample spatio-temporal unit ts).

[0056] By decomposing the spatio-temporal behavior tensor, a time factor vector and a space factor vector can be obtained. Optionally, first, set the rank parameters of the spatio-temporal behavior tensor. For example, set the rank parameter of the user dimension to 64, the rank parameter of the time dimension to 32, and the rank parameter of the space dimension to 128. Then, decompose the spatio-temporal behavior tensor based on the rank parameters to obtain a user factor vector, a time factor vector, and a space factor vector.

[0057] The above technical solution provides a practical spatio-temporal behavior tensor construction solution, providing data support and technical support for subsequent identification of the potential behavior patterns of target users from the time dimension and the space dimension based on the spatio-temporal behavior tensor, and obtaining the spatio-temporal behavior characteristic data of the target users, which is beneficial to improving the comprehensiveness and accuracy of risk prediction.

[0058] In an optional embodiment, the method further includes: determining a time decay factor based on the access time data of the historical IP address data; using the time decay factor to correct the access behavior intensity to obtain an intensity correction result; and updating the access behavior intensity based on the intensity correction result.

[0059] Among them, the time decay factor is a factor used to reduce the weight of past data. It takes into account the time factor, making the spatio-temporal units closer to the current time contribute more to the access behavior intensity, while the spatio-temporal units farther from the current time contribute less to the access behavior intensity. Optionally, use the time decay factor to weight the access behavior intensity to correct the access behavior intensity, and determine the weighted result as the intensity correction result. Update the access behavior intensity using the intensity correction result. Optionally, take as the time decay factor. Use to correct the access behavior intensity.

[0060] Based on the time interval between the spatio-temporal unit and the current time, the time decay factor is determined to correct the access behavior intensity. Considering the time factor, it can better reflect the change trend of the access behavior intensity and improve the accuracy of the access behavior intensity.

[0061] In an optional embodiment, according to the service attribute feature data, the group association feature data, and the spatio-temporal behavior feature data, business risk prediction for the target user is performed, including: using a risk prediction model to perform business risk prediction for the target user according to the service attribute feature data, the group association feature data, and the spatio-temporal behavior feature data; wherein, the risk prediction model includes a main task branch and an auxiliary task branch; the main task branch is used for overdue risk prediction; the auxiliary task branch is used for spatio-temporal anomaly risk prediction.

[0062] Among them, the risk prediction model is used for business risk prediction. The risk prediction model adopts a multi-task learning framework including a main task branch and an auxiliary task branch. The main task branch is used for overdue risk prediction, and the auxiliary task branch is used for spatio-temporal anomaly risk prediction.

[0063] Optionally, the loss function of the risk prediction model is set to L total = λL main +(1 - λ)L aux .

[0064] Among them, L main is the loss function of the main task branch, and L aux is the loss function of the auxiliary task branch. λ is a weight coefficient, and its value ranges from 0 to 1.

[0065] Input the service attribute feature data, group association feature data, and spatio-temporal behavior feature data of the target user into the risk prediction model, and output the predicted overdue rate and spatio-temporal anomaly detection result of the target user through the risk prediction model.

[0066] The above technical solution supports simultaneous overdue risk prediction and spatio-temporal anomaly risk prediction for the target user, expands the applicable scenarios of business risk handling, and is conducive to improving the comprehensiveness of risk prediction.

[0067] Figure 2 is a flowchart of another business risk handling method provided according to an embodiment of the present disclosure; this embodiment is an optional solution proposed on the basis of the above embodiment.

[0068] See Figure 2 , the business risk handling method provided in this embodiment includes:

[0069] S201. Obtain the historical IP address data and business attribute feature data used by the target user, and determine the target spatio-temporal unit to which the target user belongs based on the access time data and location information data of the historical IP address data.

[0070] S202. Determine the overlapping information data between the target spatio-temporal unit and the sample spatio-temporal units of the sample users in the pre-constructed user behavior graph.

[0071] The spatio-temporal unit has a determined time code and space code. Based on the time code and space code, the overlapping information data between the target spatio-temporal unit and the sample spatio-temporal units can be determined.

[0072] S203. Based on the overlapping information data, determine the intersection spatio-temporal unit between the sample spatio-temporal unit of the sample user and the target spatio-temporal unit.

[0073] Optionally, the spatio-temporal unit with the same time code and the same space code in the target spatio-temporal unit and the sample spatio-temporal unit is determined as the intersection spatio-temporal unit between the sample spatio-temporal unit and the target spatio-temporal unit. The intersection spatio-temporal unit is the spatio-temporal unit to which both the sample user and the target user belong.

[0074] S204. Based on the proportion of the intersection spatio-temporal unit in the target spatio-temporal unit, determine the spatio-temporal association strength between the target user and the sample user.

[0075] Since different users accessing using the same IP address at the same time often have some same or similar characteristics, such as business risks, etc. Among them, the spatio-temporal association strength is used to quantify the similarity of behavior characteristics between different users. The spatio-temporal association strength is based on the proportion of the set spatio-temporal unit in the target spatio-temporal unit. Based on the spatio-temporal association strength, an association between the target user and the sample user can be established.

[0076] S205. Based on the spatio-temporal association strength, add the target user as a node to the user behavior graph to obtain a new behavior graph.

[0077] Since the edge weights between the nodes in the user behavior graph are determined based on the spatio-temporal association strength, when the spatio-temporal association strength between the target user and the sample users in the user behavior graph is determined, if the target user is added as a node to the user behavior graph, the edge weights between the node corresponding to the target user and the nodes in the user behavior graph are also determined, and thus a new behavior graph can be obtained.

[0078] S206. Based on the new behavior graph, determine the target community to which the target user belongs and determine the risk propagation coefficient of the target community.

[0079] The new behavior graph includes nodes corresponding to the target user, and the association between the target user and the sample user has been established. Based on the new behavior graph, user bucketing is performed, and users with similar business risks can be divided into one bucket, and the target community to which the target user belongs can be determined and the risk propagation coefficient of the target community can be determined. Among them, the risk propagation coefficient is a quantification of the community risk level and can be used to identify the business risk conduction path.

[0080] S207, based on the risk propagation coefficient, determine the group association feature data of the target user.

[0081] Optionally, use the risk propagation coefficient as the group association feature data of the target user.

[0082] S208, match the target spatio-temporal unit with the sample time encoding and sample space encoding in the preset constructed spatio-temporal behavior tensor, and determine the spatio-temporal behavior feature data of the target user according to the matching result.

[0083] S209, perform business risk prediction on the target user according to the business attribute feature data, the group association feature data, and the spatio-temporal behavior feature data.

[0084] The technical solution of the present disclosure determines the intersection spatio-temporal unit between the sample spatio-temporal unit and the target spatio-temporal unit based on the overlapping information data, determines the spatio-temporal association strength between the target user and the sample user based on the proportion of the intersection spatio-temporal unit in the target spatio-temporal unit, and based on the spatio-temporal association strength, establishes the association between the target user and the sample user, and adds the target user as a node to the user behavior graph to obtain a new behavior graph. Based on the new behavior graph, user bucketing is performed, and users with similar business risks can be divided into one bucket, and the target community to which the target user belongs can be determined. Since the business risk of the sample user is known, the risk propagation coefficient of the target community can be determined. The technical solution of the present disclosure obtains the group association feature data between the target users by mining the association between the group behaviors of the users, provides data support and technical support for realizing the business risk prediction of the target user from the group dimension, and is beneficial to improving the comprehensiveness and accuracy of the risk prediction.

[0085] In an optional embodiment, based on the new behavior graph, determining the target community to which the target user belongs and determining the risk propagation coefficient of the target community includes: inputting the new behavior graph into a graph neural network, and outputting, by the graph neural network, the feature embedding vectors corresponding to the respective nodes in the new behavior graph; calculating a similarity matrix based on the feature embedding vectors, and converting the similarity matrix into a feature similarity graph; and using a community detection algorithm to perform community partitioning on the feature similarity graph to determine the target community to which the target user belongs and determine the risk propagation coefficient of the target community.

[0086] Among them, the graph neural network is used to extract features from the association relationship between the IP address data and the service risk in the new behavior graph, and the graph neural network can generate feature embedding vectors. The feature embedding vectors correspond to the nodes in the new behavior graph. A similarity matrix is calculated based on the feature embedding vectors, and the similarity matrix is converted into a feature similarity graph. Converting the similarity matrix into a feature similarity graph can retain strongly associated relationships. Optionally, a community detection algorithm such as the Louvain algorithm is used to perform community partitioning on the feature similarity graph to determine the target community to which the target user belongs and obtain the risk propagation coefficient of the target community.

[0087] The above technical solution provides a practical solution for user bucketing based on a new behavior graph, which can divide users with similar service risks into one bucket, providing technical support for mining the association between the behaviors of user groups and obtaining the group association feature data of the target user.

[0088] Figure 3 It is a flowchart of another service risk processing method provided according to an embodiment of the present disclosure; this embodiment is an optional solution proposed on the basis of the above embodiment.

[0089] See Figure 3 , the service risk processing method provided in this embodiment includes:

[0090] S301, obtaining the historical IP address data and service attribute feature data used by the target user, and determining the target spatio-temporal unit to which the target user belongs based on the access time data and location information data of the historical IP address data.

[0091] S302, determining the overlapping information data between the target spatio-temporal unit and the sample spatio-temporal units of the sample users in the pre-constructed user behavior graph, and determining the group association feature data of the target user according to the overlapping information data.

[0092] S303, matching the target spatio-temporal unit with the sample time encoding and sample space encoding in the preset constructed spatio-temporal behavior tensor.

[0093] At least a time factor vector and a space factor vector can be obtained by decomposing the spatio-temporal behavior tensor. By matching the time encoding of the target spatio-temporal unit with the sample time encoding in the spatio-temporal behavior tensor, a time factor vector matching the target spatio-temporal unit can be obtained; by matching the space encoding of the target spatio-temporal unit with the sample space encoding in the spatio-temporal behavior tensor, a space factor vector matching the target spatio-temporal unit can be obtained.

[0094] S304. Based on the time factor vector and the space factor vector in the matching result, determine the user factor vector of the target user.

[0095] The time factor vector and the space factor vector in the matching result are obtained by decomposing the spatio-temporal behavior vector. The time factor vector is used to reflect the potential behavior pattern of the user from the time dimension, and the space factor vector is used to reflect the potential behavior pattern of the user from the space dimension.

[0096] Optionally, perform a Hadamard product on the time factor vector and the space factor vector in the matching result and then perform a weighted average to generate the user factor vector of the target user.

[0097] S305. Based on the time factor vector, the space factor vector, and the user factor vector, determine the spatio-temporal consistency score corresponding to the target user.

[0098] When the time factor vector, the space factor vector, and the user factor vector of the target user are all determined, based on Determine the spatio-temporal consistency score corresponding to the target user. Among them, U u represents the user factor vector, and T and S represent the time factor vector and the space factor vector respectively.

[0099] S306. Based on the time factor vector, the space factor vector, the user factor vector, and the spatio-temporal consistency score, determine the spatio-temporal behavior feature data of the target user.

[0100] Optionally, splice the time factor vector, the space factor vector, the user factor vector, and the spatio-temporal consistency score, and determine the spliced result as the spatio-temporal behavior feature data of the target user.

[0101] S307. According to the service attribute feature data, the group association feature data, and the spatio-temporal behavior feature data, perform a business risk prediction on the target user.

[0102] In the technical solution of the present disclosure, by matching the target spatio-temporal unit with the sample time encoding and sample space encoding in the spatio-temporal behavior tensor, based on the time factor vector and space factor vector in the matching result, the user factor vector of the target user is determined. Based on the time factor vector, space factor vector and user factor vector, the spatio-temporal consistency score corresponding to the target user is determined. Based on the time factor vector, space factor vector, user factor vector and spatio-temporal consistency score, the spatio-temporal behavior feature data of the target user is determined, providing a practical spatio-temporal behavior feature data determination scheme, and providing technical support for identifying the potential behavior patterns of the target user in the time dimension and space dimension.

[0103] In an alternative embodiment, the method further includes: determining the IP address type to which the historical IP address data belongs based on the location information data and access time data of the historical IP address data; determining a correction coefficient for the spatio-temporal consistency score based on the IP address type to which the historical IP address data belongs; correcting the spatio-temporal consistency score using the correction coefficient to obtain a score correction result; and updating the spatio-temporal consistency score using the score correction result.

[0104] Among them, the IP address type is divided based on the stability of the historical IP address data. Optionally, the IP address type includes a proxy IP address and a normal IP address. The stability of the IP address is determined based on the location information data and access time data of the historical IP address data.

[0105] Optionally, the IP address type is represented by a tag, and the correction coefficient is designed as e tag / 2 . Among them, the value of the tag representation is 0 or 1. The spatio-temporal consistency score is weighted using the correction coefficient to correct the spatio-temporal consistency score, and the obtained weighted result is determined as the score correction result, and the score correction result is used as the new spatio-temporal consistency score.

[0106] In the above technical solution, the IP address type is considered in the process of determining the spatio-temporal consistency score, ensuring the accuracy of the spatio-temporal consistency score.

[0107] In an optional embodiment, based on the location information data and access time data of the historical IP address data, determining the IP address type to which the historical IP address data belongs includes: determining the occurrence frequency of the historical IP address data in each time period based on the access time data of the historical IP address data; determining the residence time entropy value of the historical IP address data based on the occurrence frequency of the historical IP address data in each time period; determining the number of autonomous systems associated with the historical IP address data based on the location information data of the historical IP address data; if the residence time entropy value is greater than a preset threshold and the number of autonomous systems is greater than or equal to a preset quantity, determining that the IP address type of the historical IP address data is a proxy IP address; otherwise, determining that the IP address type of the historical IP address data is a normal IP address.

[0108] Among them, the residence time entropy value is used to reflect the stability of the historical IP address data from the time dimension. The residence time entropy value is determined according to the occurrence frequency of the historical IP address data in each time period. The occurrence frequency of the historical IP address data in each time period is determined based on the access time data of the historical IP address data.

[0109] Among them, the number of autonomous systems associated with the IP address is used to reflect the stability of the historical IP address data from the space dimension. The number of autonomous systems associated with the IP address can be extracted from the location information data of the historical IP address data.

[0110] The preset threshold is used to measure whether the historical IP address data is stable from the time dimension, and the preset quantity is used to measure whether the historical IP address data is stable from the space dimension. The specific values of the preset threshold and the preset quantity are determined according to the actual business requirements and are not limited here. Exemplarily, the preset threshold can be 2.5. The preset quantity can be 3.

[0111] The residence time entropy value is greater than the preset threshold and the number of autonomous systems is greater than or equal to the preset quantity, indicating that the historical IP address data is unstable. Then, the IP address type of the historical IP address data is determined as a proxy IP address. The residence time entropy value is less than the preset threshold and the number of autonomous systems is less than the preset quantity, indicating that the historical IP address data is stable. Then, the IP address type of the historical IP address data is determined as a normal IP address.

[0112] The above technical solution provides a practical IP address type determination solution, evaluates the stability of the historical IP address data from the time dimension and the space dimension, ensures the accuracy of the IP type determination, and provides data support for using the IP address type to which the historical IP address data belongs to correct the spatio-temporal consistency.

[0113] Figure 4It is a flowchart of another business risk handling method provided according to an embodiment of the present disclosure; this embodiment is an alternative solution proposed based on the above embodiment.

[0114] See Figure 4 , the business risk handling method provided in this embodiment includes:

[0115] S401, Obtain the historical IP address data and business attribute feature data used by the target user.

[0116] S402, Based on the access time data of the historical IP address data, determine the access frequency of the target user in each time period.

[0117] Based on the access time data of the historical IP address data, count the number of accesses of the target user in each time period, and determine the access frequency of the target user in each time period.

[0118] S403, Based on the access frequency of the target user in each time period and the access time data, determine the time encoding of the historical IP address data.

[0119] Based on the access frequency of the target user in each time period, the behavior density corresponding to each time period can be determined. Furthermore, according to the behavior density corresponding to each time period, the time division granularity corresponding to each time period can be determined. Based on the access time data of the historical IP address data and the time division granularity corresponding to each time period, the time encoding of the historical IP address data is determined.

[0120] S404, Extract at least two level location identifiers from the location information data of the historical IP address data.

[0121] Optionally, extract at least two levels from the location information data of the historical IP address data, such as administrative region identifiers such as GeoHash, autonomous system identifiers such as ASN (autonomous system) numbers, and network routing identifiers such as BGP (Border Gateway Protocol) routing prefixes. Among them, the accuracy of the location identifier is specifically determined according to actual business requirements and is not limited here. Exemplarily, GeoHash selects an accuracy of ±20 km, and the BGP routing prefix selects the first 6 bits. Among them, GeoHash is an address encoding, which represents two coordinates of longitude and latitude with a string.

[0122] S405, Based on the at least two level location identifiers, determine the spatial encoding of the historical IP address data.

[0123] Optionally, at least two level position identifiers are concatenated in descending order of level, and the concatenation result of the position identifiers is determined as the space encoding of the historical IP address data. Exemplarily, the space encoding may be G3U_AS12345_BGP89A2.

[0124] S406. Determine the target spatio-temporal unit to which the target user belongs based on the time encoding and the space encoding of the historical IP address data.

[0125] The time encoding and the space encoding uniquely identify a spatio-temporal unit. Each historical IP address data has a corresponding time encoding and space encoding. That is to say, each historical IP address data has a corresponding spatio-temporal unit. When there are at least two historical IP address data, the target spatio-temporal unit to which the target user belongs is determined by comprehensively considering the spatio-temporal units corresponding to each historical IP address data.

[0126] S407. Determine the overlapping information data between the target spatio-temporal unit and the sample spatio-temporal units of the sample users in the pre-constructed user behavior map, and determine the group association feature data of the target user according to the overlapping information data.

[0127] S408. Match the target spatio-temporal unit with the sample time encoding and sample space encoding in the pre-constructed spatio-temporal behavior tensor, and determine the spatio-temporal behavior feature data of the target user according to the matching result.

[0128] S409. Perform business risk prediction on the target user according to the service attribute feature data, the group association feature data, and the spatio-temporal behavior feature data.

[0129] The technical solution of the present disclosure provides a practical spatio-temporal unit division solution, which combines the space information and time information of IP address data. Based on the access frequency and access time data of the target user in each time period, the time encoding of the historical IP address data is determined; based on at least two level position identifiers extracted from the position information data of the historical IP address data, the space encoding of the historical IP address data is determined, realizing the division of spatio-temporal units and improving the division accuracy of spatio-temporal units. It provides technical support for analyzing the association between user spatio-temporal behavior and group behavior in units of spatio-temporal units and fully utilizing the spatio-temporal characteristics of IP address data in business risk processing.

[0130] In an optional embodiment, determining the time encoding of the historical IP address data based on the access frequency of the target user in each time period and the access time data includes: determining the behavior density of the target user in each time period based on the access frequency of the target user in each time period, and determining the time division granularity based on the behavior density of the target user in each time period; performing time division based on the time division granularity to obtain at least two time intervals; determining the target time interval in which the historical IP address data is located in the time interval based on the access time data; and determining the time encoding of the historical IP address data based on the start timestamp of the target time interval.

[0131] Determine the behavior density of the target user in each time period based on the access frequency of the target user in each time period. Determine the time division granularity based on the behavior density of the target user in each time period.

[0132] Optionally, set a density threshold, and distinguish high-density time periods, medium-density time periods, and low-density time periods according to the density threshold and the behavior density of the target user in each time period. For example, if the access frequency per hour is greater than 50 times, between 10 times and 50 times, and less than 10 times, they are determined as high-density time periods, medium-density time periods, and low-density time periods respectively.

[0133] Different density time periods correspond to different time division granularities. Exemplarily, the minute granularity is used for high-density time periods, while the hour granularity and the day granularity are used for medium-density time periods and low-density time periods respectively. When the time division granularity is determined, perform time division using the time division granularity to obtain at least two time intervals. When the access time data is determined, the target time interval in which the historical IP address data is located can be determined.

[0134] The target time interval includes an interval start point and an interval end point, and the start timestamp is the timestamp corresponding to the interval start point. The time encoding of the historical IP address data can be determined based on the interval start timestamp.

[0135] Optionally, use a periodic function to set an encoding rule to perform time encoding on the interval start timestamp.

[0136]

[0137] Exemplarily, the access frequency of user A from 10 to 11 am on Monday is 100 times. The time period from 10 to 11 am on Monday belongs to a high-density time period, and the minute granularity is used for division. For example, it is divided by 15 minutes. For the access using the historical IP address data 1 at 10:58 am on Monday, the target time interval is determined to be [10:45, 11:00], and 10:45 is taken as the interval start point. If the start timestamp is 1741574700, then substitute the start timestamp into The time encoding of the historical IP address data 1 can be obtained.

[0138] The above technical solution provides a practical time encoding determination solution. Based on the access frequency and access time data of the target user in each time period, the time encoding of the historical IP address data is determined. It realizes the adaptive selection of the time division granularity and provides technical support for the division of spatio-temporal units.

[0139] Figure 5 FIG. is a schematic structural diagram of a service risk processing device provided by an embodiment of the present disclosure. The embodiment of the present disclosure is applicable to the situation of predicting service risks of users, such as overdue risks. The device can be implemented by software and / or hardware, and the device can implement the service risk processing method described in any embodiment of the present disclosure.

[0140] As Figure 5 shown, the service risk processing device 500 includes:

[0141] A target spatio-temporal unit determination module 501, configured to obtain historical IP address data and service attribute feature data used by a target user, and determine a target spatio-temporal unit to which the target user belongs based on the access time data and location information data of the historical IP address data;

[0142] A group association feature determination module 502, configured to determine overlapping information data between the target spatio-temporal unit and sample spatio-temporal units of sample users in a pre-constructed user behavior map, and determine group association feature data of the target user according to the overlapping information data;

[0143] A spatio-temporal behavior feature determination module 503, configured to match the target spatio-temporal unit with sample time encodings and sample space encodings in a preset spatio-temporal behavior tensor, and determine spatio-temporal behavior feature data of the target user according to the matching result;

[0144] A service risk prediction module 504, configured to perform service risk prediction on the target user according to the service attribute feature data, the group association feature data, and the spatio-temporal behavior feature data.

[0145] The technical solution of the present disclosure combines the spatial information and temporal information of IP address data to divide spatio-temporal units. A user behavior graph that can describe group behavior and a spatio-temporal behavior tensor that can reflect the potential behavior patterns of users from spatio-temporal dimensions are pre-constructed. Taking spatio-temporal units as units, based on the user behavior graph and the spatio-temporal behavior tensor, the associations between user spatio-temporal behaviors and group behaviors are analyzed to determine the group association feature data and spatio-temporal behavior feature data of the target user. The group association feature data and spatio-temporal behavior feature data of the target user are jointly used with business attribute feature data for business risk prediction, realizing business risk prediction for the target user at the individual dimension and the group dimension. The spatio-temporal characteristics of IP address data are fully utilized, the associations between group behaviors are mined, and the accuracy and comprehensiveness of business risk prediction are improved.

[0146] Optionally, the group association feature determination module 502 includes: an intersection spatio-temporal unit determination sub-module, configured to determine an intersection spatio-temporal unit between the sample spatio-temporal unit of the sample user and the target spatio-temporal unit based on the overlapping information data; a spatio-temporal association strength determination sub-module, configured to determine the spatio-temporal association strength between the target user and the sample user based on the proportion of the intersection spatio-temporal unit in the target spatio-temporal unit; a new behavior graph determination sub-module, configured to add the target user as a node to the user behavior graph based on the spatio-temporal association strength to obtain a new behavior graph; a risk propagation coefficient determination sub-module, configured to determine the target community to which the target user belongs and determine the risk propagation coefficient of the target community based on the new behavior graph; a group association feature determination sub-module, configured to determine the group association feature data of the target user based on the risk propagation coefficient.

[0147] Optionally, the risk propagation coefficient determination sub-module includes: a feature embedding vector determination unit, configured to input the new behavior graph into a graph neural network, and output the feature embedding vectors corresponding to each node in the new behavior graph through the graph neural network; a feature similarity graph determination unit, configured to calculate a similarity matrix based on the feature embedding vectors and convert the similarity matrix into a feature similarity graph; a risk propagation coefficient determination unit, configured to perform community division on the feature similarity graph by using a community detection algorithm, determine the target community to which the target user belongs, and determine the risk propagation coefficient of the target community.

[0148] Optionally, the apparatus further includes: a time decay factor determination module, configured to determine a time decay factor based on the access time data of the historical IP address data; an access behavior intensity correction module, configured to correct the access behavior intensity by using the time decay factor to obtain an intensity correction result; an access behavior intensity update module, configured to update the access behavior intensity based on the intensity correction result.

[0149] Optionally, the spatio-temporal behavior feature determination module 503 includes: a user factor vector determination sub-module, configured to determine a user factor vector of the target user based on the time factor vector and the space factor vector in the matching result; a spatio-temporal consistency score determination sub-module, configured to determine a spatio-temporal consistency score corresponding to the target user based on the time factor vector, the space factor vector, and the user factor vector; a spatio-temporal behavior feature determination sub-module, configured to determine spatio-temporal behavior feature data of the target user based on the time factor vector, the space factor vector, the user factor vector, and the spatio-temporal consistency score.

[0150] Optionally, the apparatus further includes: an IP address type determination module, configured to determine an IP address type to which the historical IP address data belongs based on location information data and access time data of the historical IP address data; a correction coefficient determination module, configured to determine a correction coefficient of the spatio-temporal consistency score based on the IP address type to which the historical IP address data belongs; a spatio-temporal consistency score correction module, configured to correct the spatio-temporal consistency score by using the correction coefficient to obtain a score correction result; a spatio-temporal consistency score update module, configured to update the spatio-temporal consistency score by using the score correction result.

[0151] Optionally, the IP address type determination module includes: an occurrence frequency determination sub-module, configured to determine an occurrence frequency of the historical IP address data in each time period based on the access time data of the historical IP address data; a residence time entropy value determination sub-module, configured to determine a residence time entropy value of the historical IP address data based on the occurrence frequency of the historical IP address data in each time period; an autonomous system number determination sub-module, configured to determine an autonomous system number associated with the historical IP address data based on the location information data of the historical IP address data; a proxy IP address determination sub-module, configured to determine that the IP address type of the historical IP address data is a proxy IP address if the residence time entropy value is greater than a preset threshold and the autonomous system number is greater than or equal to a preset quantity; a normal IP address determination sub-module, configured to otherwise determine that the IP address type of the historical IP address data is a normal IP address.

[0152] Optionally, the target spatio-temporal unit determination module 501 includes: an access frequency determination sub-module, configured to determine the access frequency of the target user in each time period based on the access time data of the historical IP address data; a time coding determination sub-module, configured to determine the time coding of the historical IP address data based on the access frequency of the target user in each time period and the access time data; a location identifier extraction sub-module, configured to extract at least two hierarchical location identifiers from the location information data of the historical IP address data; a space coding determination sub-module, configured to determine the space coding of the historical IP address data based on the at least two hierarchical location identifiers; and a target spatio-temporal unit determination sub-module, configured to determine the target spatio-temporal unit to which the target user belongs based on the time coding and the space coding of the historical IP address data.

[0153] Optionally, the time coding determination sub-module includes: a time division granularity determination unit, configured to determine the behavior density of the target user in each time period based on the access frequency of the target user in each time period, and determine the time division granularity based on the behavior density of the target user in each time period; a time interval division unit, configured to perform time division based on the time division granularity to obtain at least two time intervals; a target time interval determination unit, configured to determine the target time interval in which the historical IP address data is located in the time intervals based on the access time data; and a time coding determination unit, configured to determine the time coding of the historical IP address data based on the start timestamp of the target time interval.

[0154] Optionally, the apparatus further includes: an intersection spatio-temporal unit determination module, configured to determine the intersection spatio-temporal unit between the sample spatio-temporal units of different sample users based on the overlap information data between the sample spatio-temporal units of different sample users; a spatio-temporal association strength determination module, configured to determine the spatio-temporal association strength between the different sample users based on the proportion of the intersection spatio-temporal unit in the sample spatio-temporal units of the sample users; a user behavior graph construction module, configured to use the sample users as nodes, determine the edge weights between the nodes based on the spatio-temporal association strength, and construct a user behavior graph; and a node attribute determination module, configured to associate the business risk data of the sample users as node attributes to the user behavior graph.

[0155] Optionally, the device further includes: an access behavior intensity determination module, configured to determine the access behavior intensity of the sample user in the sample spatio-temporal unit based on the number of accesses of the sample user in the sample spatio-temporal unit and the number of IP addresses used in the sample spatio-temporal unit; a spatio-temporal behavior tensor construction module, configured to use the access behavior intensity as matrix elements to construct the spatio-temporal behavior tensor; wherein, the user dimension, time dimension, and space dimension of the spatio-temporal behavior tensor are determined according to the number of sample users, the number of sample time encodings, and the number of sample space encodings respectively; the spatio-temporal behavior tensor is used to decompose into a time factor vector and a space factor vector.

[0156] Optionally, the business risk prediction module 504 is specifically configured to use a risk prediction model to perform business risk prediction on the target user according to the business attribute feature data, the group association feature data, and the spatio-temporal behavior feature data; wherein, the risk prediction model includes a main task branch and an auxiliary task branch; the main task branch is used to perform overdue risk prediction; the auxiliary task branch is used to perform spatio-temporal anomaly risk prediction.

[0157] The business risk processing device provided by the embodiments of the present disclosure can execute the business risk processing method provided by any embodiment of the present disclosure, and has corresponding functional modules and beneficial effects for executing the business risk processing method.

[0158] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision, and disclosure of user data such as historical IP address data, business attribute feature data, and business risk data all comply with the provisions of relevant laws and regulations and do not violate public order and good customs.

[0159] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0160] Figure 6 FIG. shows a schematic block diagram of an exemplary electronic device 600 that can be used to implement the embodiments of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as, a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, a personal digital processor, a cellular phone, a smart phone, a wearable device, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0161] As Figure 6As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to computer programs stored in a read-only memory (ROM) 602 or computer programs loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0162] A plurality of components in the electronic device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a magnetic disk, an optical disc, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the electronic device 600 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0163] The computing unit 601 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include but are not limited to a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 601 executes the various methods and processes described above, such as the business risk processing method. For example, in some embodiments, the business risk processing method can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the business risk processing method described above can be executed. Alternatively, in other embodiments, the computing unit 601 can be configured to execute the business risk processing method in any other appropriate way (e.g., by means of firmware).

[0164] The various embodiments of the systems and techniques described above in this specification can be implemented in digital electronic circuitry, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems-on-chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be a special-purpose or general-purpose programmable processor that receives data and instructions from, and transmits data and instructions to, a storage system, at least one input device, and at least one output device.

[0165] The program code for implementing the methods of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable business risk handling device, such that the program codes, when executed by the processor or controller, cause the functions / operations specified in the flowchart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0166] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0167] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and a pointing device (e.g., a mouse or a trackball), by which the user can provide input to the computer. Other kinds of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and the input received from the user can be in any form (including acoustic input, speech input, or tactile input).

[0168] The systems and techniques described herein can be implemented in a computing system including backend components (e.g., as a data server), or a computing system including middleware components (e.g., an application server), or a computing system including frontend components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system including any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected to each other by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local area network (LAN), wide area network (WAN), and the Internet.

[0169] A computer system can include a client and a server. The client and the server are generally far from each other and usually interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, or a server of a distributed system, or a server combined with a blockchain.

[0170] Artificial intelligence is a discipline that studies how to make a computer simulate certain thinking processes and intelligent behaviors of humans (such as learning, reasoning, thinking, planning, etc.), and it has both hardware-level technologies and software-level technologies. Artificial intelligence hardware technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, and big data processing; artificial intelligence software technologies mainly include several major directions such as computer vision technology, speech recognition technology, natural language processing technology, machine learning / deep learning technology, big data processing technology, and knowledge graph technology.

[0171] Cloud computing refers to a technology system that accesses an elastic and scalable shared physical or virtual resource pool through a network. The resources can include servers, operating systems, networks, software, applications, storage devices, etc., and the resources can be deployed and managed in a demand-based and self-service manner. Through cloud computing technology, it is possible to provide efficient and powerful data processing capabilities for the application and model training of technologies such as artificial intelligence and blockchain.

[0172] It should be understood that various forms of processes shown above can be used, and steps can be reordered, added, or deleted. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and no limitations are imposed herein.

[0173] The above specific embodiments do not constitute a limitation on the protection scope of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the protection scope of this disclosure.

Claims

1. A method for handling business risks, the method comprising: Acquire historical IP address data and service attribute feature data used by the target user, and determine the target space-time unit to which the target user belongs based on the access time data and location information data of the historical IP address data; Determine overlapping information data between the target spatiotemporal unit and a sample spatiotemporal unit of a sample user in a pre-constructed user behavior graph, and determine group association feature data of the target user based on the overlapping information data; Matching the target spatiotemporal unit with the sample time code and sample space code in the preset spatiotemporal behavior tensor, and determining the spatiotemporal behavior feature data of the target user according to the matching result; Business risk prediction is performed on the target user according to the business attribute feature data, the group association feature data and the spatiotemporal behavior feature data.

2. The method according to claim 1, wherein: The determining the group-related characteristic data of the target user according to the overlapping information data includes: Based on the overlapping information data, determining the intersection space-time unit between the sample space-time unit of the sample user and the target space-time unit; Determining the spatiotemporal correlation strength between the target user and the sample user based on the proportion of the intersection spatiotemporal unit in the target spatiotemporal unit; Based on the spatiotemporal correlation strength, adding the target user as a node to the user behavior graph to obtain a new behavior graph; Based on the new behavior graph, determining a target community to which the target user belongs and determining a risk propagation coefficient of the target community; Based on the risk propagation coefficient, group-related characteristic data of the target user is determined.

3. The method according to claim 2, wherein: The step of determining the target community to which the target user belongs and determining the risk propagation coefficient of the target community based on the new behavior graph includes: Inputting the new behavior graph into a graph neural network, and outputting a feature embedding vector corresponding to each node in the new behavior graph through the graph neural network; Calculating a similarity matrix based on the feature embedding vectors, and converting the similarity matrix into a feature similarity graph; A community detection algorithm is used to divide the feature similarity graph into communities, determine the target community to which the target user belongs, and determine the risk propagation coefficient of the target community.

4. The method according to claim 1, wherein: The step of determining the spatiotemporal behavior characteristic data of the target user according to the matching result includes: Determining a user factor vector of the target user based on the time factor vector and the space factor vector in the matching result; Determining a spatiotemporal consistency score corresponding to the target user based on the time factor vector, the space factor vector and the user factor vector; Based on the time factor vector, the space factor vector, the user factor vector and the spatiotemporal consistency score, the spatiotemporal behavior feature data of the target user is determined.

5. The method according to claim 4, further comprising: Determine the IP address type to which the historical IP address data belongs based on the location information data and the access time data of the historical IP address data; Determining a correction coefficient of the spatiotemporal consistency score based on the IP address type to which the historical IP address data belongs; Using the correction coefficient to correct the spatiotemporal consistency score to obtain a score correction result; The score correction result is used to update the spatiotemporal consistency score.

6. The method according to claim 5, wherein: The determining the IP address type to which the historical IP address data belongs based on the location information data and the access time data of the historical IP address data includes: Determine the occurrence frequency of the historical IP address data in each time period based on the access time data of the historical IP address data; Determine the residence time entropy value of the historical IP address data based on the occurrence frequency of the historical IP address data in each time period; Determining the number of autonomous systems associated with the historical IP address data based on the location information data of the historical IP address data; If the residence time entropy value is greater than a preset threshold, and the number of autonomous systems is greater than or equal to a preset number, determining that the IP address type of the historical IP address data is a proxy IP address; Otherwise, it is determined that the IP address type of the historical IP address data is a normal IP address.

7. The method according to claim 1, wherein: The step of determining the target spatiotemporal unit to which the target user belongs based on the access time data and the location information data of the historical IP address data includes: Determine the access frequency of the target user in each time period based on the access time data of the historical IP address data; Determine the time code of the historical IP address data based on the access frequency of the target user in each time period and the access time data; Extracting at least two level location identifiers from the location information data of the historical IP address data; Determining the spatial encoding of the historical IP address data based on the at least two level position identifiers; The target space-time unit to which the target user belongs is determined based on the time code and the space code of the historical IP address data.

8. The method according to claim 7, wherein: The determining the time code of the historical IP address data based on the access frequency of the target user in each time period and the access time data includes: Determine the behavior density of the target user in each time period based on the access frequency of the target user in each time period, and determine the time division granularity based on the behavior density of the target user in each time period; Performing time division based on the time division granularity to obtain at least two time intervals; Determine a target time interval in which the historical IP address data is located within the time interval based on the access time data; Based on the starting time stamp of the target time interval, the time code of the historical IP address data is determined.

9. The method according to claim 1, further comprising: Based on the overlapping information data between the sample space-time units of different sample users, determining the intersection space-time units between the sample space-time units of different sample users; Determining the spatiotemporal correlation strength between the different sample users based on the proportion of the intersection spatiotemporal unit in the sample spatiotemporal units of the sample users; Taking the sample users as nodes, determining edge weights between nodes based on the spatiotemporal association strength, and constructing a user behavior graph; The business risk data of the sample user is used as a node attribute and associated with the user behavior graph.

10. The method according to claim 1, further comprising: Determine the access behavior intensity of the sample user in the sample time-space unit based on the number of visits of the sample user in the sample time-space unit and the number of IP addresses used in the sample time-space unit; Using the access behavior intensity as a matrix element, constructing the spatiotemporal behavior tensor; Among them, the user dimension, time dimension and space dimension of the spatiotemporal behavior tensor are determined according to the number of sample users, the number of sample time codes and the number of sample space codes respectively; the spatiotemporal behavior tensor is used to decompose the time factor vector and the space factor vector.

11. The method according to claim 10, further comprising: Determining a time decay factor based on the access time data of the historical IP address data; Using the time decay factor, modifying the intensity of the access behavior to obtain an intensity modification result; Based on the strength correction result, the access behavior strength is updated.

12. The method according to claim 1, wherein: The performing business risk prediction on the target user according to the business attribute feature data, the group association feature data and the spatiotemporal behavior feature data includes: Using a risk prediction model, predicting the business risk of the target user according to the business attribute feature data, the group association feature data and the spatiotemporal behavior feature data; Among them, the risk prediction model includes a main task branch and an auxiliary task branch; the main task branch is used to perform overdue risk prediction; the auxiliary task branch is used to perform spatiotemporal anomaly risk prediction.

13. A business risk processing device, the device comprising: A target space-time unit determination module is used to obtain historical IP address data and service attribute characteristic data used by a target user, and determine a target space-time unit to which the target user belongs based on access time data and location information data of the historical IP address data; A group association feature determination module, used to determine the overlapping information data between the target spatiotemporal unit and the sample spatiotemporal unit of the sample user in the pre-constructed user behavior graph, and determine the group association feature data of the target user according to the overlapping information data; A spatiotemporal behavior feature determination module, used to match the target spatiotemporal unit with the sample time code and sample space code in the preset spatiotemporal behavior tensor, and determine the spatiotemporal behavior feature data of the target user according to the matching result; The business risk prediction module is used to predict the business risk of the target user according to the business attribute feature data, the group association feature data and the spatiotemporal behavior feature data.

14. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the business risk processing method according to any one of claims 1 to 12.

15. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to enable a computer to execute the business risk processing method according to any one of claims 1-12.

16. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the business risk processing method according to any one of claims 1 to 12.

Images