Big data oriented dynamic graph analysis method, system and device

Abstract

The application discloses a big data-oriented dynamic graph analysis method, system and device, relates to the related technical field of graph analysis, and comprises the following steps: K entity nodes in a basic layer dynamic graph are mirrored to K mirror nodes in an analysis layer dynamic graph according to a sliding time window; a cascading risk transmission mining is triggered in a directed topological network; after receiving a real-time risk transmission path, the basic layer dynamic graph stores locally, constructs a node risk disposal instruction based on the real-time risk transmission path; and the node risk disposal instruction is returned to a source entity node according to the mirror node composition of the real-time risk transmission path. The application solves the technical problems of poor real-time performance, low calculation efficiency, insufficient dynamic topology adaptation and lagging risk transmission path mining in the prior art, and achieves the technical effects of efficient real-time risk transmission analysis, dynamic topology accurate inheritance, cascading risk active early warning and resource consumption optimization.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of graph analysis, in particular to a dynamic graph analysis method, system and device for big data. BACKGROUND

[0002] With the development of big data technology, complex entity relationships show dynamic, time-series and network characteristics. Traditional static graph analysis cannot meet the needs of real-time risk monitoring and conduction path mining, especially in the fields of financial risk control, supply chain management and network security. The risk conduction between entities often has a cascading effect. Dynamic graph analysis has become a key means to identify and block the spread of risks. However, existing analysis methods often face problems such as low computational efficiency, poor real-time performance, and insufficient dynamic adaptation of topology structure when processing large-scale time-series attribute data streams, resulting in lagging behind in the mining of risk conduction paths in actual business needs, and relying on offline calculation or periodic snapshot updates, which makes it difficult to achieve accurate capture of real-time risk conduction. In addition, data storage and analysis are usually coupled in the same graph layer, resulting in large consumption of computing resources and inability to effectively support rapid adjustment of dynamic topology structure.

[0003] Therefore, in the related art, there are technical problems of poor real-time performance, low computational efficiency, insufficient dynamic topology adaptation, and lagging behind in the mining of risk conduction paths. SUMMARY

[0004] The present application provides a dynamic graph analysis method, system and device for big data, which solves the technical problems of poor real-time performance, low computational efficiency, insufficient dynamic topology adaptation, and lagging behind in the mining of risk conduction paths in the prior art, and achieves the technical effects of efficient real-time risk conduction analysis, dynamic topology accurate inheritance, cascading risk proactive warning, and resource consumption optimization.

[0005] The present application provides a dynamic graph analysis method for big data, which comprises: mirroring K time-series attribute data streams in a basic layer dynamic graph to K mirror nodes in an analysis layer dynamic graph according to a sliding time window, wherein the K mirror nodes inherit the directed topology network of the basic layer dynamic graph; loading the K time-series attribute data streams in the directed topology network to trigger cascading risk conduction mining, outputting real-time risk conduction paths; after receiving the real-time risk conduction paths returned by the analysis layer dynamic graph, locally storing the real-time risk conduction paths, and constructing node risk disposal instructions based on the real-time risk conduction paths; and returning the node risk disposal instructions to the source entity nodes according to the mirror nodes of the real-time risk conduction paths.

[0006] In a possible implementation, the dynamic graph analysis method for big data further performs the following processing: heterogeneous data streams are passed to the base layer dynamic graph using a distributed message queue; the base layer dynamic graph performs attribute decomposition on the heterogeneous data streams to obtain K time-series attribute data streams; and based on the data attribute labels of the K time-series attribute data streams, the K time-series attribute data streams are mapped and loaded onto the K entity nodes in the base layer dynamic graph.

[0007] In a possible implementation, the dynamic graph analysis method for big data further performs the following processing: extracting K time-series risk windows locally from the K entity nodes; and combining and enumerating the K entity nodes to obtain... After grouping entity nodes, according to the above The entity node mapping combines the K time-series risk time windows to obtain Group time series risk time window; by calculating the above The risk event overlap coefficient of the group time series risk window is used to quantify the... Group entity nodes Group risk correlation; based on a preset correlation strength threshold and the aforementioned The correlation deviation of the group risk correlation is used to make a directed weighted connection of the K entity nodes to obtain the directed topology network.

[0008] In a possible implementation, the dynamic graph analysis method for big data also performs the following processing: based on the... Whether the group risk correlation falls within the preset correlation strength threshold, from the above P groups of associated nodes are obtained by filtering the entity nodes; based on the P groups of associated nodes, K entity nodes are connected in an undirected topology to output an initial topology network; the frequency of P risk triggering directions in the P group of time-series risk windows is counted, and P risk propagation direction vectors are constructed based on the frequency of the P risk triggering directions; the initial topology network is weighted in a directed manner using the P risk propagation direction vectors to output the directed topology network.

[0009] In a possible implementation, the dynamic graph analysis method for big data further performs the following processing: slidingly dividing the heterogeneous data stream into multiple heterogeneous data segments; performing structured parsing on the multiple heterogeneous data segments to output multiple standardized attribute vectors; predefining K node attribute vectors for the K entity nodes; calculating the similarity between the multiple standardized attribute vectors and the multiple sets of attribute vectors of the K node attribute vectors, and then reorganizing the multiple sets of attribute vectors into K sets of heterogeneous data segments according to dynamic matching rules; and temporally concatenating the K sets of heterogeneous data segments to output the K temporal attribute data streams.

[0010] In a possible implementation, the big data-oriented dynamic graph analysis method further performs the following processing: locally calling P sets of time sequence risk conduction feature data with the P risk conduction direction vectors as time sequence constraint conditions and with the P sets of associated nodes as node screening constraints; taking the P sets of time sequence risk conduction feature data as training data, training a cascaded risk conduction model in the directed topological network, and outputting a cascaded risk conduction graph neural network, where the cascaded risk conduction graph neural network includes K node conduction identification models of the K mirror nodes; mapping and parallel inputting the K time sequence attribute data streams to the K node conduction identification models of the cascaded risk conduction graph neural network, and cooperatively generating the real-time risk conduction path through topological message passing.

[0011] In a possible implementation, the big data-oriented dynamic graph analysis method further performs the following processing: in the cascaded risk conduction graph neural network, after B mirror nodes receive A risk conduction identifiers and A risk conduction probabilities sent by A mirror nodes, the B node conduction identification models are activated, where the A mirror nodes are out-degree connected with the B mirror nodes; the B time sequence attribute data stream, the A risk conduction identifiers, and the A risk conduction probabilities are loaded to the B node conduction identification models, risk conduction prediction is performed via the B node conduction identification models, and B risk conduction identifiers and B risk conduction probabilities are output; if a D node orientation is parsed from the B risk conduction identifier, the B risk conduction identifiers and the B risk conduction probabilities are sent to D mirror nodes according to the D node orientation, and D node conduction identification models are activated in the cascaded risk conduction graph neural network, where the B mirror nodes are out-degree connected with C mirror nodes and D mirror nodes respectively; in this way, recursive conduction of risk identifiers and risk probabilities is performed in the cascaded risk conduction graph neural network, until a probability threshold is less than a preset scale, and the real-time risk conduction path is generated through reverse tracing of a node chain.

[0012] In a possible implementation, the big data-oriented dynamic graph analysis method further performs the following processing: parsing the real-time risk conduction path, extracting a source mirror node identifier; locating a corresponding source entity node of the source mirror node identifier in a basic layer dynamic graph based on a cross-layer node mapping relationship; and after matching a node risk disposal instruction with a risk identifier of the source entity node, returning the node risk disposal instruction to the source entity node through a security instruction channel.

[0013] This application also provides a dynamic graph analysis system for big data, comprising: a time-series attribute data mirroring unit, used to mirror K time-series attribute data streams from K entity nodes in the base layer dynamic graph to K mirror nodes in the analysis layer dynamic graph according to a sliding time window, wherein the K mirror nodes inherit the directed topology network of the base layer dynamic graph; a real-time risk transmission path output unit, used by the K mirror nodes to load the K time-series attribute data streams and trigger cascaded risk transmission mining in the directed topology network, and output a real-time risk transmission path; a node risk handling instruction construction unit, used by the base layer dynamic graph to receive the real-time risk transmission path returned by the analysis layer dynamic graph, locally store the real-time risk transmission path, and construct node risk handling instructions based on the real-time risk transmission path; and a node risk handling instruction return unit, used to return the node risk handling instruction to the source entity node according to the mirror node composition of the real-time risk transmission path.

[0014] This application also provides an electronic device, including: a memory for storing executable instructions; and a processor for executing the executable instructions stored in the memory to implement a dynamic graph analysis method for big data.

[0015] This application proposes a dynamic graph analysis method, system, and device for big data. In the base-layer dynamic graph, K entity nodes mirror K time-series attribute data streams to K mirror nodes in the analysis-layer dynamic graph based on a sliding time window. This triggers cascading risk propagation mining within a directed topology network. The base-layer dynamic graph receives and stores real-time risk propagation paths locally, constructing node risk handling instructions based on these paths. Based on the mirror node composition of the real-time risk propagation paths, the node risk handling instructions are transmitted back to the source entity nodes. This addresses the technical problems of poor real-time performance, low computational efficiency, insufficient dynamic topology adaptation, and lagging risk propagation path mining in existing technologies, achieving efficient real-time risk propagation analysis, accurate dynamic topology inheritance, proactive cascading risk warning, and optimized resource consumption. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments of this disclosure will be briefly described below. Flowcharts are used in this application to illustrate the operations performed by the system according to the embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed precisely in sequence. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from these processes.

[0017] Figure 1 This is a schematic diagram of the dynamic graph analysis method for big data provided in an embodiment of this application.

[0018] Figure 2 This is a schematic diagram of the structure of a dynamic graph analysis system for big data provided in an embodiment of this application.

[0019] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0020] Explanation of reference numerals in the attached figures: Time-series attribute data mirroring unit 10, real-time risk transmission path output unit 20, node risk handling instruction construction unit 30, node risk handling instruction feedback unit 40, input device 401, processor 402, memory 403, output device 404. Detailed Implementation

[0021] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below.

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description of this application will be provided in conjunction with the accompanying drawings. The described embodiments should not be considered as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] In the following description, references to "some embodiments" describe a subset of all possible embodiments. However, it is understood that "some embodiments" can be the same or different subsets of all possible embodiments and can be combined with each other without conflict. The terms "first" and "second" are used merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or modules not explicitly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only.

[0024] This application provides a dynamic graph analysis method for big data, such as... Figure 1 As shown, the method includes:

[0025] In step S100, the K entity nodes in the base layer dynamic graph mirror the K time-series attribute data streams to the K mirror nodes in the analysis layer dynamic graph according to the sliding time window, wherein the K mirror nodes inherit the directed topology network of the base layer dynamic graph.

[0026] Step S100 further includes step S101, transmitting the heterogeneous data stream to the base layer dynamic graph using a distributed message queue; step S102, the base layer dynamic graph performing attribute decomposition on the heterogeneous data stream to obtain K time-series attribute data streams; step S103, mapping and loading the K time-series attribute data streams to the K entity nodes in the base layer dynamic graph according to the data attribute tags of the K time-series attribute data streams.

[0027] Preferably, multi-source heterogeneous data is acquired, which may include database logs, sensor data, transaction records, social network information, etc. The heterogeneous data streams are identified, and their formats, frequencies, and structures are different. Distributed message queues such as Kafka and Pulsar are used as the data access layer to bring the heterogeneous data streams into the basic dynamic graph. The distributed message queues can decouple data production and consumption, and cope with sudden peaks in the data stream to avoid system overload. At the same time, through message persistence, partitioning, and replication mechanisms, data is not lost, ensuring the reliability of data storage. Heterogeneous data streams contain multi-dimensional information. For example, a financial transaction might involve transaction amount, time, both parties' accounts, risk tags, etc. A dynamic graph at the base layer decomposes these heterogeneous data streams into independent time-series attribute data streams. Specifically, the heterogeneous data streams undergo structured parsing, extracting fields in data formats such as JSON and XML. Then, time-series processing is performed, where each attribute is sorted by timestamp to form a time-series data stream. The same attribute from different data sources is then standardized to ensure data analysis consistency, ultimately resulting in K time-series attribute data streams, where K is a positive integer. Each time-series attribute data stream contains data attribute labels. When a new entity or attribute is added (such as a newly registered user), the labels are automatically matched without requiring graph reconstruction. Finally, the K time-series attribute data streams are mapped and loaded onto K entity nodes in the dynamic graph at the base layer. This means that the corresponding entity node in the dynamic graph is located based on the data attribute labels, and the time-series data stream is loaded into the attribute set of that node to update its state.

[0028] Preferably, the base layer dynamic graph is the core data storage layer, a dynamic network storing all entities and their relationships. K entity nodes represent key entities that need to be monitored and analyzed, such as high-risk accounts in a financial system or key nodes in a supply chain. The analysis layer dynamic graph predicts short-term risk status (risk transmission). A sliding time window is a dynamic data partitioning strategy that retains only data from the most recent period, such as transaction records from the past 5 minutes, and continuously updates the data within the window over time to ensure timely analysis. Time-series attribute data streams are the sequence of attributes of entity nodes that change over time, such as changes in account balances per minute or user login frequency. Mirroring refers to creating mirror nodes in the analysis layer dynamic graph that correspond one-to-one with the base layer entity nodes, but only copying the data within the current time window, not the entire historical data.

[0029] Preferably, the K entity nodes in the base layer dynamic graph copy their corresponding K time-series attribute data streams, filtered by a sliding time window, to the K corresponding mirror nodes in the analysis layer dynamic graph in real time, retaining only key data within the window, such as the most recent 10 transactions, to reduce the computational pressure on the analysis layer dynamic graph. The K mirror nodes inherit the directed topology network of the base layer dynamic graph. Specifically, the directed topology network refers to the relationships and directionality between entity nodes. Inheriting the topology means that the mirror nodes in the analysis layer not only copy data but also fully retain the network structure between entities in the base layer, such as who is associated with whom and the strength of the relationship. If there is a transfer relationship between "User X" and "User Y" in the base layer, the mirror nodes "X'" and "Y'" in the analysis layer also retain this directed edge. When the base layer topology changes, such as adding new relationships, the analysis layer topology is adjusted synchronously to ensure the accuracy of the analysis, thereby achieving a balance between the real-time performance and efficiency of the base layer dynamic graph and the analysis layer dynamic graph, ensuring optimal resource allocation.

[0030] Furthermore, step S102 also includes step a, slidingly dividing the heterogeneous data stream into multiple heterogeneous data segments; step b, performing structured parsing on the multiple heterogeneous data segments to output multiple standardized attribute vectors; step c, predefining K node attribute vectors for the K entity nodes; step d, calculating the similarity between the multiple standardized attribute vectors and multiple sets of attribute vectors of the K node attribute vectors, and then reorganizing the multiple sets of attribute vectors into K sets of heterogeneous data segments according to dynamic matching rules; and step e, temporally concatenating the K sets of heterogeneous data segments to output the K temporal attribute data streams.

[0031] Preferably, heterogeneous data from different sources is dynamically divided into data streams according to a fixed time window (e.g., every 5 minutes), forming multiple continuous or overlapping heterogeneous data segments to facilitate parallel processing. These segments are then subjected to structured parsing. Specifically, key fields are extracted from each segment, and unstructured data, such as log text, is processed using NLP to extract entities and events. The parsed fields are then converted into vectors of a unified format, outputting multiple standardized attribute vectors to eliminate differences in the original data format. Next, K node attribute vectors for K entity nodes are predefined, defining the core features of each entity node. Each entity node (e.g., user, device) has a predefined attribute template, such as [account type, region, wind]. [Risk level] serves as the matching benchmark for data segmentation. For each standardized attribute vector and K node attribute vectors, the similarity of multiple sets of attribute vectors is calculated using cosine similarity or Euclidean distance. Then, according to dynamic matching rules, the multiple sets of attribute vectors are reorganized into K sets of heterogeneous data segments. That is, the node attribute vectors with similarity exceeding a predetermined threshold (such as 0.8) are assigned to the corresponding node group. If a segment is similar to multiple nodes, the node with the highest score is selected. Then, all heterogeneous data segments are grouped according to the matching results to form K sets of heterogeneous data segments. Finally, the K sets of heterogeneous data segments are spliced ​​in time series, that is, each set of data segments is sorted by timestamp and merged into a continuous time series data stream. The output is the independent time series attribute data stream of K entity nodes, reflecting their dynamic behavior changes.

[0032] Furthermore, step S100 also includes step S110, extracting K time-series risk time windows locally from the K entity nodes; and step S120, combining and enumerating the K entity nodes to obtain... After grouping entity nodes, according to the above The group entity node mapping combines the K time-series risk time windows to obtain Group time series risk time window; Step S130, by calculating the The risk event overlap coefficient of the group time series risk window is used to quantify the... Group entity nodes Group risk correlation; Step S140, based on the preset correlation strength threshold and the... The correlation deviation of the group risk correlation is used to make a directed weighted connection of the K entity nodes to obtain the directed topology network.

[0033] Preferably, for each entity node, such as a bank account or supply chain node, a risk time window is dynamically calculated based on its historical behavioral data. This window represents a series of risk indicators within a sliding time interval, indicating the change in the entity's risk status over a specific period. Through time series analysis, such as fluctuation detection and anomaly marking, key risk events are extracted. Pairing K entity nodes together (e.g., node A with node B, node A with node C, etc.) generates a total of... Node pairs, such as 3 nodes (A, B, C), are combined into (A, B), (A, C), and (B, C). Each node pair is associated with its respective temporal risk time window, forming... Group risk time window.

[0034] Preferably, the similarity of time series is then calculated by statistically analyzing the percentage of overlapping time points of risk events within the two time windows, or by quantifying the temporal similarity using correlation coefficients (such as the Pearson coefficient). The risk event overlap coefficient for time-series risk windows measures the synchronicity of risk events occurring in two sets of risk time windows, and the final output is... Group entity node corresponding Group risk correlation degree indicates the strength of risk transmission between two groups of nodes.

[0035] Preferably, based on a preset correlation strength threshold and The correlation deviation of the risk correlation degree of the group is used to form a directed weighted connection of K entity nodes. The correlation strength threshold is a preset threshold value. Only node pairs with correlation degree higher than this value are retained. If the correlation degree of group (A, B) is 0.8 (exceeding the threshold), an edge A→B is added to the graph with a weight of 0.8. The direction is determined by the time order of the risk events. For example, if the risk events of A are always earlier than those of B, the edge direction is A→B. Finally, a directed topology network is obtained.

[0036] Furthermore, step S140 also includes step S141, based on the aforementioned Whether the group risk correlation falls within the preset correlation strength threshold, from the above Step S142: Based on the P groups of associated nodes, perform undirected topological connections on the K entity nodes to output an initial topological network; Step S143: Count the frequency of P risk triggering directions in the P group of time-series risk windows, and construct P risk propagation direction vectors based on the frequency of the P risk triggering directions; Step S144: Use the P risk propagation direction vectors to perform directed weighting on the initial topological network to output the directed topological network.

[0037] Preferably, the preset association strength threshold is set to 0.7, and the comparison is performed. Whether the group risk correlation falls within the preset correlation strength threshold, from From the pairs of entity nodes, select the valid association pairs whose risk correlation reaches a preset correlation strength threshold, and denot them as P groups of associated nodes. Then, temporarily store K entity nodes in the P groups of associated nodes with undirected edges (i.e., bidirectional connections) to form an initial topology network. For example, if the P groups are (A, B), (A, C), and (B, D), then the initial network contains edges AB, AC, and BD (undirected). Next, count the frequency of P risk triggering directions in the time window of the P groups of time-series risks, that is, for each group of associated nodes, count the number of times the risk events occur in sequence. For example, if A→B (the risk event of A occurs earlier than that of B) occurs 5 times and B→A occurs 2 times, then the frequency of the A→B direction is 5 and the frequency of the B→A direction is 2. Then, P risk transmission direction vectors are constructed based on the frequency of P risk triggering directions. Finally, the initial topology network is weighted using the P risk transmission direction vectors. When the frequency of the A→B direction is significantly higher than that of the B→A direction, the edge A→B is retained; otherwise, it is considered bidirectional or undirected. The proportion of the direction frequency is used as the corresponding weight, and finally P directed edges are constructed and combined to generate a directed topology network.

[0038] In step S200, the K mirror nodes load the K time-series attribute data streams to trigger cascaded risk transmission mining in the directed topology network and output the real-time risk transmission path.

[0039] Step S200 further includes step S210, using the P risk transmission direction vectors as temporal constraints and the P groups of associated nodes as node selection constraints, locally calling the P groups of temporal risk transmission feature data; step S220, using the P groups of temporal risk transmission feature data as training data, training the cascaded risk transmission model in the directed topology network, and outputting the cascaded risk transmission graph neural network, wherein the cascaded risk transmission graph neural network includes the K node transmission recognition models of the K mirror nodes; step S230, mapping and parallel inputting the K temporal attribute data streams into the K node transmission recognition models of the cascaded risk transmission graph neural network, and collaboratively generating the real-time risk transmission path through topology message passing.

[0040] Preferably, P risk propagation direction vectors are used as time-series constraints, and P groups of associated nodes are used as node selection constraints. That is, based on the propagation direction vector preferences of the P groups of node pairs, P groups of significantly associated node pairs are selected. Then, the time-series risk characteristic data of these node pairs within the sliding time window are extracted from storage, such as the transaction amount, risk score, and event trigger time of node A and node B in the past hour. This focuses on the dynamic behavior data of highly associated node pairs, reducing noise interference, while ensuring that the training data is consistent with the propagation direction of the topology network. A graph neural network (GNN) architecture is constructed based on the directed topology network to support message passing, i.e., information interaction between nodes. Specifically, the P groups of time-series... Risk transmission feature data is used as training data to construct a cascaded risk transmission model, which learns to predict the probability of risk transmission paths and obtains a K-node transmission identification model with K mirror nodes. The output is a cascaded risk transmission graph neural network, which retains the directionality and weights of the network topology. Then, K time-series attribute data streams are mapped and input in parallel into the K-node transmission identification model of the cascaded risk transmission graph neural network. Each node model judges the current risk status based on the input data and then transmits risk signals through directed edges. Finally, the outputs of all nodes are combined to generate a complete transmission path, realizing real-time dynamic risk tracking, responding to changes at the second level, and supporting low-latency analysis through parallel computing and message passing mechanisms.

[0041] Further, step S230 also includes step S231, in the cascaded risk transmission graph neural network, after the B mirror node receives the A risk transmission identifier and A risk transmission probability sent by the A mirror node, it activates the B node transmission identification model, wherein the A mirror node and the B mirror node are out-degree connected; step S232, the B time-series attribute data stream, the A risk transmission identifier and the A risk transmission probability are loaded into the B node transmission identification model, and risk transmission prediction is performed through the B node transmission identification model to output the B risk transmission identifier and the B risk transmission probability; step S233, if the D node guidance is parsed from the B risk transmission identifier, then according to the D node guidance, the B risk transmission identifier and the B risk transmission probability are sent to the D mirror node, and the D node transmission identification model is activated in the cascaded risk transmission graph neural network, wherein the B mirror node is out-degree connected to the C mirror node and the D node respectively; step S234, and so on, the risk identifier and risk probability are recursively transmitted in the cascaded risk transmission graph neural network until the probability threshold is less than a preset scale, and then the real-time risk transmission path is generated by backtracking the node chain.

[0042] Preferably, dynamic propagation and path generation of risk signals in a cascaded risk transmission graph neural network are achieved through recursive interactions between nodes. Mirror node A and mirror node B have a pre-defined out-degree connection, meaning that A and B have an actual business relationship in the basic dynamic graph, such as a transfer link. Specifically, when mirror node A detects a risk, such as an abnormal transaction, its local model generates a risk transmission identifier, marking the risk type (e.g., "fund lending") and transmission probability (e.g., 0.9), and sends it to mirror node B through the out-degree connection. After receiving the signal from mirror node A, mirror node B activates its own transmission identification model, loading the risk transmission identifier of A, the risk transmission probability of A, and the time-series attribute data stream of B into the transmission identification model of node B for risk transmission prediction. If it is determined that the risk may continue to propagate, the risk transmission identifier of B and the updated probability, i.e., the risk transmission probability of B, are output.

[0043] Preferably, if mirror node B is connected to both mirror nodes C and D, but only the direction of mirror node D satisfies the transmission condition (e.g., probability threshold > 0.5), then the signal is only transmitted to mirror node D, and the mirror node is not activated. Based on the guidance of node D, the risk transmission identifier and risk transmission probability of B are sent to mirror node D, and the transmission identification model of node D is activated in the cascaded risk transmission graph neural network to perform risk transmission prediction. This process is repeated, and risk identification and risk probability are recursively transmitted in the cascaded risk transmission graph neural network. When the transmission probability decays layer by layer to a preset scale (e.g., < 0.3), the recursion stops to avoid invalid calculations. Then, by backtracking the node chain, that is, tracing back the signal source from the termination node to splice the node chain, a real-time risk transmission path is generated and the probability value of each segment is labeled to ensure the accuracy and efficiency of path generation.

[0044] Preferably, the effectiveness of risk transmission is determined by a probability threshold, and the risk source is traced backward to generate a complete path. Specifically, when the probability of risk transmission received by node B is lower than a preset threshold, it is determined that the risk has significantly attenuated after reaching B and will no longer transmit signals to subsequent nodes. At this time, node B is the termination point of the transmission path. Then, starting from the termination node B, the path is traced back layer by layer along the incoming edges of the directed topology network (i.e., the direction of the risk source), including locating the direct upstream node A of B, determining the risk transmission path from A to B, and if node A itself also receives signals from other nodes (such as X), the path is traced back to X until the risk source node is found, i.e., the node with no upstream input. Finally, the traced node chain is spliced ​​together in sequence to generate a complete risk transmission path, the risk transmission relationship between node A and node B is associated, and the probability values ​​of each segment are labeled to form an interpretable transmission evidence chain.

[0045] In step S300, after receiving the real-time risk transmission path from the analysis layer dynamic graph, the base layer dynamic graph locally stores the real-time risk transmission path and constructs node risk handling instructions based on the real-time risk transmission path.

[0046] Preferably, the base layer dynamic graph persistently stores the real-time risk transmission paths received from the analysis layer dynamic graph, forming two types of data assets: a historical path library, archived by time series for long-term pattern analysis, such as high-frequency transmission path mining; and topology enhancement data, which dynamically updates the edge weights of the base layer dynamic graph with path information. Based on the real-time risk transmission paths, node risk handling instructions are then constructed. For example, blocking instructions are generated for source nodes, monitoring and strengthening instructions for key transit nodes, and source tracing and verification instructions for transmission edges. Instruction priorities are set according to path probability values, and instructions are pushed to business systems, such as the bank's core system and risk control platform, via API or message queue to trigger automated handling. Simultaneously, the metadata of the path nodes, such as account type and risk level, is matched with a preset handling rule library to analyze the effects of executing node risk handling instructions, optimize subsequent transmission predictions, and achieve cascading risk proactive early warning and resource consumption optimization.

[0047] Step S400: Based on the mirror node configuration of the real-time risk transmission path, the node risk handling instruction is transmitted back to the source entity node.

[0048] Step S400 further includes step S410, parsing the real-time risk transmission path and extracting the source mirror node identifier; step S420, locating the source entity node corresponding to the source mirror node identifier in the basic layer dynamic graph based on the cross-layer node mapping relationship; step S430, matching the node risk handling instruction according to the risk identifier of the source entity node, and then sending the node risk handling instruction back to the source entity node through the security instruction channel.

[0049] Preferably, based on the mirror node composition of the real-time risk transmission path, risk handling instructions are transmitted back to the source entity node. This means accurately mapping the risk transmission path generated by the analysis layer dynamic graph back to the entity nodes of the base layer dynamic graph, triggering handling measures targeting the risk source. Specifically, the first node identifier, i.e., the source mirror node identifier, is extracted from the real-time risk transmission path transmitted back from the analysis layer dynamic graph. Using a pre-established cross-layer node mapping relationship, i.e., a cross-layer node mapping table, the corresponding source entity node in the base layer dynamic graph is located. Then, the risk identifier of the source entity node is read, and node risk handling instructions are matched based on the risk identifier of the source entity node. Specifically, predefined handling rules are matched according to the risk type. The system generates targeted risk management instructions for nodes, including high-risk identifiers for immediate blocking, medium-risk identifiers for enhanced verification, and low-risk identifiers for monitoring. Finally, the node risk management instructions are transmitted back to the corresponding source entity node in the dynamic graph of the base layer via secure instruction channels such as encrypted APIs or dedicated message queues. This ensures that the instructions are tamper-proof and leak-proof during transmission and execution. Furthermore, through cross-layer node association, a closed-loop control of risk discovery, source location, and instruction execution is achieved. Through bidirectional mapping between mirror nodes and entity nodes, the system ensures that virtual analysis results can be accurately applied to real business objects, enabling differentiated risk response strategies and improving the accuracy, timeliness, and resource consumption of cascading risk warnings.

[0050] In the above text, refer to Figure 1 A dynamic graph analysis method for big data according to embodiments of the present invention is described in detail. Next, reference will be made to... Figure 2 A dynamic graph analysis system for big data according to an embodiment of the present invention is described.

[0051] The dynamic graph analysis system for big data according to embodiments of the present invention addresses the technical problems of poor real-time performance, low computational efficiency, insufficient dynamic topology adaptation, and lagging risk transmission path mining in existing technologies. It achieves the technical effects of efficient real-time risk transmission analysis, accurate dynamic topology inheritance, proactive cascading risk warning, and optimized resource consumption. Figure 2 As shown, the dynamic graph analysis system for big data includes: a time-series attribute data mirroring unit 10, a real-time risk transmission path output unit 20, a node risk handling instruction construction unit 30, and a node risk handling instruction feedback unit 40.

[0052] The time-series attribute data mirroring unit 10 is used to mirror K time-series attribute data streams from K entity nodes in the base layer dynamic graph to K mirror nodes in the analysis layer dynamic graph according to a sliding time window, wherein the K mirror nodes inherit the directed topology network of the base layer dynamic graph; the real-time risk transmission path output unit 20 is used for the K mirror nodes to load the K time-series attribute data streams and trigger cascaded risk transmission mining in the directed topology network, and output a real-time risk transmission path; the node risk handling instruction construction unit 30 is used for the base layer dynamic graph to receive the real-time risk transmission path returned by the analysis layer dynamic graph, store the real-time risk transmission path locally, and construct node risk handling instructions based on the real-time risk transmission path; the node risk handling instruction return unit 40 is used to return the node risk handling instruction to the source entity node according to the mirror node composition of the real-time risk transmission path.

[0053] The specific configuration of the time-series attribute data mirroring unit 10 will be described in detail below. The time-series attribute data mirroring unit 10 further includes: transmitting heterogeneous data streams to the base layer dynamic graph using a distributed message queue; the base layer dynamic graph performing attribute decomposition on the heterogeneous data streams to obtain K time-series attribute data streams; and mapping and loading the K time-series attribute data streams to the K entity nodes in the base layer dynamic graph according to the data attribute tags of the K time-series attribute data streams.

[0054] The specific configuration of the time-series attribute data mirroring unit 10 will be described in detail below. The time-series attribute data mirroring unit 10 further includes: extracting K time-series risk time windows locally from the K entity nodes; and combining and enumerating the K entity nodes to obtain... After grouping entity nodes, according to the above The group entity node mapping combines the K time-series risk time windows to obtain Group time series risk time window; by calculating the above The risk event overlap coefficient of the group time series risk window is used to quantify the... Group entity nodes Group risk correlation; based on a preset correlation strength threshold and the aforementioned The correlation deviation of the group risk correlation is used to make a directed weighted connection of the K entity nodes to obtain the directed topology network.

[0055] The specific configuration of the time-series attribute data mirroring unit 10 will be described in detail below. The time-series attribute data mirroring unit 10 further includes: according to the... Whether the group risk correlation falls within the preset correlation strength threshold, from the above P groups of associated nodes are obtained by filtering the entity nodes; based on the P groups of associated nodes, K entity nodes are connected in an undirected topology to output an initial topology network; the frequency of P risk triggering directions in the P group of time-series risk windows is counted, and P risk propagation direction vectors are constructed based on the frequency of the P risk triggering directions; the initial topology network is weighted in a directed manner using the P risk propagation direction vectors to output the directed topology network.

[0056] The specific configuration of the time-series attribute data mirroring unit 10 will be described in detail below. The time-series attribute data mirroring unit 10 further includes: slidingly dividing the heterogeneous data stream into multiple heterogeneous data segments; performing structured parsing on the multiple heterogeneous data segments to output multiple standardized attribute vectors; predefining K node attribute vectors for the K entity nodes; calculating the similarity between the multiple standardized attribute vectors and the multiple sets of attribute vectors of the K node attribute vectors, and then recombining the multiple sets of attribute vectors into K sets of heterogeneous data segments according to dynamic matching rules; and temporally concatenating the K sets of heterogeneous data segments to output the K time-series attribute data streams.

[0057] The specific configuration of the real-time risk transmission path output unit 20 will be described in detail below. The real-time risk transmission path output unit 20 further includes: using the P risk transmission direction vectors as temporal constraints and the P groups of associated nodes as node selection constraints, locally calling the P groups of temporal risk transmission feature data; using the P groups of temporal risk transmission feature data as training data to train a cascaded risk transmission model in the directed topology network, outputting a cascaded risk transmission graph neural network, wherein the cascaded risk transmission graph neural network includes the K node transmission recognition models of the K mirror nodes; mapping and parallel inputting the K temporal attribute data streams into the K node transmission recognition models of the cascaded risk transmission graph neural network, and collaboratively generating the real-time risk transmission path through topology message passing.

[0058] The specific configuration of the real-time risk transmission path output unit 20 will be described in detail below. The real-time risk transmission path output unit 20 further includes: in the cascaded risk transmission graph neural network, after the B mirror node receives the A risk transmission identifier and A risk transmission probability sent by the A mirror node, it activates the B node transmission identification model, wherein the A mirror node and the B mirror node are out-degree connected; the B time-series attribute data stream, the A risk transmission identifier, and the A risk transmission probability are loaded into the B node transmission identification model, and risk transmission prediction is performed through the B node transmission identification model to output the B risk transmission identifier and B risk transmission probability; if the D node guidance is parsed from the B risk transmission identifier, then according to the D node guidance, the B risk transmission identifier and B risk transmission probability are sent to the D mirror node, and the D node transmission identification model is activated in the cascaded risk transmission graph neural network, wherein the B mirror node is out-degree connected to the C mirror node and the D node respectively; and so on, recursively transmitting risk identifiers and risk probabilities in the cascaded risk transmission graph neural network until the probability threshold is less than a preset scale, and then generating the real-time risk transmission path by backtracking the node chain.

[0059] The specific configuration of the node risk handling instruction feedback unit 40 will be described in detail below. The node risk handling instruction feedback unit 40 further includes: parsing the real-time risk transmission path and extracting the source mirror node identifier; locating the source entity node corresponding to the source mirror node identifier in the basic layer dynamic graph based on the cross-layer node mapping relationship; matching the node risk handling instruction according to the risk identifier of the source entity node, and then feeding back the node risk handling instruction to the source entity node through the security instruction channel.

[0060] The dynamic graph analysis system for big data provided in this embodiment of the invention can execute the dynamic graph analysis method for big data provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0061] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention, showing a block diagram of an exemplary electronic device suitable for implementing the embodiments of the present invention. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention. This electronic device is in the form of a general-purpose computing device, and its components may include, but are not limited to, an input device 401, a processor 402, a memory 403, and an output device 404. The processor 402 may be one or more; the memory 403 may include a computer-readable medium and at least one program product having a set (at least one) of program modules configured to perform the functions of the embodiments of this application.

[0062] The memory 403 shown in this embodiment of the invention can be any combination of one or more computer-readable media. The computer-readable storage medium can be, but is not limited to, infrared, semiconductor systems, devices or components, or any combination thereof, used to store software programs, computer-executable programs and modules, such as the program instructions / modules corresponding to the dynamic graph analysis method for big data in this embodiment of the invention. The processor 402 executes various functional applications and data processing of the computer device by running the software programs, instructions and modules stored in the memory 403, thereby realizing the above-mentioned dynamic graph analysis method for big data.

[0063] Although this application makes various references to certain modules in the system according to the embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy distinction between each other and are not used to limit the scope of protection of this invention.

[0064] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A dynamic graph analysis method for big data, characterized in that, The method includes: In the base layer dynamic graph, K entity nodes mirror K time-series attribute data streams to K mirror nodes in the analysis layer dynamic graph according to a sliding time window. The K mirror nodes inherit the directed topology network of the base layer dynamic graph. The K mirror nodes load the K time-series attribute data streams to trigger cascaded risk transmission mining in the directed topology network, and output the real-time risk transmission path; After receiving the real-time risk transmission path from the analysis layer dynamic graph, the base layer dynamic graph stores the real-time risk transmission path locally and constructs node risk handling instructions based on the real-time risk transmission path. Based on the mirror node configuration of the real-time risk transmission path, the node risk handling instructions are transmitted back to the source entity node; Wherein, the K mirror nodes load the K time-series attribute data streams in the directed topology network to trigger cascade risk propagation mining and output real-time risk propagation paths, the method includes: Using P risk transmission direction vectors as time-series constraints and P groups of associated nodes as node selection constraints, P groups of time-series risk transmission feature data are locally called. Using the P sets of time-series risk transmission feature data as training data, a cascaded risk transmission model is trained in the directed topology network, and a cascaded risk transmission graph neural network is output, wherein the cascaded risk transmission graph neural network includes the K node transmission recognition model of the K mirror nodes; The K time-series attribute data streams are mapped and input in parallel into the K-node transmission recognition model of the cascaded risk transmission graph neural network, and the real-time risk transmission path is generated collaboratively through topological message passing; The method involves mapping and inputting the K time-series attribute data streams in parallel into the K-node transmission recognition model of the cascaded risk transmission graph neural network, and collaboratively generating the real-time risk transmission path through topological message passing. In the cascaded risk transmission graph neural network, after receiving the risk transmission identifier and risk transmission probability of A sent by the mirror node A, the B mirror node activates the transmission identification model of the B node, wherein the A mirror node and the B mirror node are out-degree connected. The time-series attribute data stream of B, the risk transmission identifier of A, and the risk transmission probability of A are loaded into the B node transmission identification model. Risk transmission is predicted through the B node transmission identification model, and the risk transmission identifier of B and the risk transmission probability of B are output. If the D node guidance is parsed from the B risk transmission identifier, then according to the D node guidance, the B risk transmission identifier and the B risk transmission probability are sent to the D mirror node, and the D node transmission identification model is activated in the cascaded risk transmission graph neural network, wherein the B mirror node is connected to the C mirror node and the D mirror node respectively. Similarly, risk identification and risk probability are recursively propagated in the cascaded risk transmission graph neural network until the probability threshold is less than a preset scale. Then, the real-time risk transmission path is generated by backtracking the node chain.

2. The dynamic graph analysis method for big data as described in claim 1, characterized in that, The method further includes: Heterogeneous data streams are fed into the underlying dynamic graph using a distributed message queue; The base layer dynamic graph decomposes the heterogeneous data stream into K time-series attribute data streams; Based on the data attribute labels of the K time-series attribute data streams, the K time-series attribute data streams are mapped and loaded into the K entity nodes in the base layer dynamic graph.

3. The dynamic graph analysis method for big data as described in claim 1, characterized in that, The method further includes: Extract K time windows of temporal risk locally from the K entity nodes; Combine and enumerate the K entity nodes to obtain After grouping entity nodes, according to the above The entity node mapping combines the K time-series risk time windows to obtain Group time series risk time window; By calculating the The risk event overlap coefficient of the group time series risk window is used to quantify the... Group entity nodes Group risk correlation; Based on the preset correlation strength threshold and the The correlation deviation of the group risk correlation is used to make a directed weighted connection of the K entity nodes to obtain the directed topology network.

4. The dynamic graph analysis method for big data as described in claim 3, characterized in that, Based on the preset correlation strength threshold and the The method further includes: performing a directed weighted connection on the K entity nodes based on the correlation deviation of the group risk correlation to obtain the directed topology network; According to the above Whether the group risk correlation falls within the preset correlation strength threshold, from the above Entity node filtering yields P groups of associated nodes; Based on the P groups of associated nodes, perform undirected topological connections on the K entity nodes to output the initial topological network; Statistically count the frequency of P risk triggering directions in the time windows of P groups of time-series risks, and construct P risk transmission direction vectors based on the frequency of the P risk triggering directions; The initial topology network is weighted in a directed manner using the P risk propagation direction vectors, and the directed topology network is output.

5. The dynamic graph analysis method for big data as described in claim 2, characterized in that, The base layer dynamic graph decomposes the heterogeneous data stream into K time-series attribute data streams, and the method includes: The heterogeneous data stream is slidably divided into multiple heterogeneous data segments; The multiple heterogeneous data segments are parsed in a structured manner to output multiple standardized attribute vectors; Predefine the K node attribute vectors for the K entity nodes; After calculating the similarity between the multiple standardized attribute vectors and the multiple sets of attribute vectors of the K node attribute vectors, the multiple sets of attribute vectors are reorganized into K sets of heterogeneous data segments according to the dynamic matching rules. The K heterogeneous data segments are spliced ​​together in time sequence to output the K time-series attribute data streams.

6. The dynamic graph analysis method for big data as described in claim 1, characterized in that, Based on the mirror node configuration of the real-time risk transmission path, the method of transmitting the node risk handling instructions back to the source entity node includes: Analyze the real-time risk transmission path and extract the source mirror node identifier; Based on the cross-layer node mapping relationship, locate the source entity node corresponding to the source mirror node identifier in the basic layer dynamic graph; After matching the node risk handling instruction with the risk identifier of the source entity node, the node risk handling instruction is sent back to the source entity node through the security instruction channel.

7. A dynamic graph analysis system for big data, characterized in that, The system is used to implement the dynamic graph analysis method for big data as described in any one of claims 1 to 6, and the system comprises: The temporal attribute data mirroring unit is used to mirror K temporal attribute data streams from K entity nodes in the base layer dynamic graph to K mirror nodes in the analysis layer dynamic graph according to a sliding time window. The K mirror nodes inherit the directed topology network of the base layer dynamic graph. The real-time risk transmission path output unit is used to load the K time-series attribute data streams into the directed topology network to trigger cascaded risk transmission mining and output the real-time risk transmission path. The node risk handling instruction construction unit is used to store the real-time risk transmission path locally after the base layer dynamic graph receives the real-time risk transmission path from the analysis layer dynamic graph, and construct node risk handling instructions based on the real-time risk transmission path. The node risk handling instruction feedback unit is used to feedback the node risk handling instruction to the source entity node based on the mirror node composition of the real-time risk transmission path.

8. An electronic device, characterized in that, The electronic device includes: Memory, used to store executable instructions; The processor, when executing executable instructions stored in the memory, implements the dynamic graph analysis method for big data as described in any one of claims 1 to 6.

Images