Enterprise node anomaly judgment method and system based on knowledge graph

Abstract

The invention relates to the technical field of data processing, in particular to an enterprise node anomaly judgment method and system based on a knowledge graph, and the method comprises the steps: aggregating enterprise nodes based on an association hierarchy and a first association degree to form a comprehensive node, and constructing an enterprise-level knowledge graph containing a connection relationship and a second association degree, complex relations of massive enterprise nodes are abstracted into a hierarchical structure, the graph complexity is reduced, the association strength between the nodes is quantified, the target path from the abnormal enterprise node to the target enterprise node is screened in combination with the node connection relation and the second association degree, the enterprise node abnormity judgment efficiency and accuracy are improved, and the enterprise node abnormity judgment efficiency and accuracy are improved. By comprehensively considering the reference anomaly degree of the abnormal enterprise node, the importance degree of each integrated node in the target path and the second association degree between the integrated nodes, the target anomaly degree is calculated to determine the node type, and rapid and accurate anomaly judgment of the target enterprise node is realized.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method and system for determining anomaly of enterprise nodes based on a knowledge graph. Background Art

[0002] Existing methods for enterprise node anomaly judgment based on knowledge graphs usually construct graphs directly based on enterprise nodes when performing path planning and anomaly judgment based on massive enterprise node data. The number of edges increases quadratically with the number of nodes. When processing millions of enterprise nodes, path planning needs to traverse billions of edges, resulting in excessively long calculation time and inability to meet the needs of anomaly judgment in a timely manner. In addition, the graphs constructed by existing methods do not effectively quantify the strength of associations between enterprises, resulting in the path planning results possibly selecting long-distance, low-value indirect paths, reducing the effectiveness and reliability of anomaly judgment.

[0003] Therefore, how to improve the efficiency and accuracy of abnormal judgment of enterprise nodes based on knowledge graphs has become an urgent problem to be solved. Summary of the Invention

[0004] In response to the above technical problems, the technical solution adopted by the present invention is a method for determining enterprise node anomalies based on a knowledge graph. The method for determining enterprise node anomalies based on a knowledge graph includes the following steps: S10, according to the association level between each enterprise node and other enterprise nodes in the enterprise node set, and the first association degree between each enterprise node and other enterprise nodes with the corresponding association level of the first level, obtain the enterprise-level knowledge graph, wherein the association level includes the 1st level to the Nth level, and the enterprise-level knowledge graph is constructed by a number of integrated nodes, the connection relationship between the integrated nodes and the second association degree, each integrated node is obtained by combining a number of enterprise nodes, the second association degree is obtained based on the first association degree, and the connection relationship is a connected relationship or a non-connected relationship.

[0005] S20: Determine an enterprise node in the enterprise node set where an abnormality occurs as an abnormal enterprise node, and determine an enterprise node to be subjected to abnormality detection as a target enterprise node.

[0006] S30, obtaining a target path from the abnormal enterprise node to the target enterprise node based on the connection relationship and the second correlation degree between the comprehensive nodes in the enterprise-level knowledge graph.

[0007] S40 , obtaining a target abnormality degree corresponding to the target enterprise node according to the reference abnormality degree of the abnormal enterprise node, a plurality of integrated nodes in the target path, and all second association degrees corresponding to the target path.

[0008] S50 , obtaining a node type corresponding to the target enterprise node according to a target abnormality level corresponding to the target enterprise node and a preset abnormality level threshold, wherein the node type is an abnormal node or a non-abnormal node.

[0009] The present invention also provides a knowledge graph-based enterprise node anomaly judgment system, which includes: The knowledge graph construction module is used to obtain an enterprise-level knowledge graph based on the association level between each enterprise node and other enterprise nodes in the enterprise node set, and the first association degree between each enterprise node and other enterprise nodes with the corresponding association level of the first level, wherein the association level includes the 1st to the Nth levels, and the enterprise-level knowledge graph is constructed by a number of integrated nodes, the connection relationship between the integrated nodes and the second association degree. Each integrated node is obtained by combining a number of enterprise nodes. The second association degree is obtained based on the first association degree, and the connection relationship is a connected relationship or a non-connected relationship.

[0010] The enterprise node extraction module is used to determine the enterprise nodes with abnormalities in the enterprise node set as abnormal enterprise nodes, and determine the enterprise nodes to be detected for abnormalities as target enterprise nodes.

[0011] The target path acquisition module is used to obtain the target path between the abnormal enterprise node and the target enterprise node based on the connection relationship and the second correlation degree between the comprehensive nodes in the enterprise-level knowledge graph.

[0012] The target abnormality degree acquisition module is used to acquire the target abnormality degree corresponding to the target enterprise node according to the reference abnormality degree of the abnormal enterprise node, several comprehensive nodes in the target path, and all second correlation degrees corresponding to the target path.

[0013] The node type judgment module is used to obtain the node type corresponding to the target enterprise node according to the target abnormality level corresponding to the target enterprise node and the preset abnormality level threshold, wherein the node type is an abnormal node or a non-abnormal node.

[0014] The present invention has at least the following beneficial effects: by aggregating enterprise nodes based on the association level and the first association degree to form a comprehensive node, and constructing an enterprise-level knowledge graph containing connection relationships and the second association degree, it is possible to abstract the complex relationships of massive enterprise nodes into a hierarchical structure, greatly reducing the complexity of the graph, reducing the amount of path planning calculations, and at the same time quantifying the association strength between nodes, providing a data basis for accurate path planning and anomaly detection; by clearly dividing abnormal enterprise nodes and target enterprise nodes, the indiscriminate global anomaly detection is transformed into a local analysis focusing on specific nodes, reducing invalid calculations, clarifying the anomaly detection target, and improving the efficiency and pertinence of anomaly analysis; by taking comprehensive nodes as units, combining node connection relationships and the second association degree to screen abnormal enterprise nodes to target nodes The target path of the enterprise node enables the rapid location of high-value paths in the hierarchical knowledge graph, avoids blind searches, and improves the efficiency and accuracy of path planning; by comprehensively considering the reference abnormality degree of the abnormal enterprise node, the importance of each comprehensive node in the target path, and the second correlation degree between the comprehensive nodes, it enables the accurate quantification of the transmission of abnormal situations on the target path based on multi-dimensional factors, and quantifies the target abnormality degree of the target enterprise node, avoiding single-factor evaluation errors and providing enterprises with more reliable risk assessment data; by comparing the target abnormality degree of the target enterprise node with the preset threshold to determine the node type, it converts complex risk assessment results into intuitive and standardized decision signals, realizing rapid and accurate abnormality judgment of the target enterprise node. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 This is a flow chart of a method for determining anomaly of an enterprise node based on a knowledge graph provided in the first embodiment of the present invention; Figure 2 A schematic diagram of an enterprise node anomaly judgment system based on a knowledge graph provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0017] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0018] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It is understood that, where appropriate, the above-mentioned terms used to distinguish similar objects can be interchanged so that the present invention can also implement other embodiments other than the above-mentioned illustrated embodiments or described embodiments. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0019] Example 1 This embodiment provides a method for determining enterprise node anomalies based on a knowledge graph. Figure 1 As shown, the enterprise node anomaly judgment method based on knowledge graph includes the following steps: S10, according to the association level between each enterprise node and other enterprise nodes in the enterprise node set, and the first association degree between each enterprise node and other enterprise nodes with the corresponding association level of the first level, obtain the enterprise-level knowledge graph, wherein the association level includes the 1st level to the Nth level, and the enterprise-level knowledge graph is constructed by a number of integrated nodes, the connection relationship between the integrated nodes and the second association degree, each integrated node is obtained by combining a number of enterprise nodes, the second association degree is obtained based on the first association degree, and the connection relationship is a connected relationship or a non-connected relationship.

[0020] Among them, enterprise nodes are digital abstractions of real enterprises. Enterprises of various sizes are presented in the form of nodes in the enterprise-level knowledge graph and are distinguished by unique identifiers (such as the enterprise unified social credit code and enterprise name).

[0021] The association level is a hierarchical concept used to describe the closeness of relationships or the depth of business transactions between enterprise nodes. The first level represents enterprise nodes directly associated with the current enterprise node (e.g., through direct business collaboration, direct equity, etc.). The second level represents enterprise nodes directly associated with the first-level enterprise node corresponding to the current enterprise node, and indirectly associated with the current enterprise node. This continues until all enterprise nodes in the enterprise node set that are directly associated with the enterprise node with the Nth level association relationship with the current enterprise node have an association level less than or equal to N. In this case, the maximum association level N corresponding to the current enterprise node is determined, and the enterprise nodes with the Nth level association relationship with the current enterprise node are obtained. The larger the association level value, the more indirect and loose the association between enterprise nodes.

[0022] The first degree of association quantifies the closeness of the business relationship between two first nodes and can be calculated based on various factors, such as the volume of business transactions between enterprises, frequency of cooperation, and equity ratio. For example, the greater the volume of business transactions between two enterprises, the higher the frequency of cooperation, and the larger the equity ratio, the higher the closeness between the two enterprise nodes, and therefore the higher the first degree of association.

[0023] According to the number of first nodes corresponding to the first-level association relationship of enterprise nodes in the enterprise node set, the central node is determined to represent the enterprises with strong direct influence in the enterprise network. By extracting core nodes layer by layer, it helps to build a comprehensive node system with clear hierarchy and no redundancy.

[0024] Then, with the central node as the core, based on the first degree of association between each enterprise node and other enterprise nodes at the corresponding level 1, the connection relationship and second degree of association between the current comprehensive node and each other comprehensive node are obtained. The connection relationship and second degree of association between comprehensive nodes are used to construct an enterprise-level knowledge graph, which is used for path planning and abnormal node identification between all enterprise nodes. The second degree of association is used to quantify the closeness of the business relationship between two comprehensive nodes.

[0025] In one embodiment, S10 includes the following steps: S110, based on the association level between each enterprise node and other enterprise nodes in the enterprise node set, a central node is selected from the enterprise node set, and a target level value M corresponding to the central node is obtained, where the target level value M is the maximum association level covered when constructing a comprehensive node with the central node as the core, 1≤M≤N. S120 , forming a comprehensive node corresponding to the central node based on the central node and all enterprise nodes whose association levels with the central node are from the 1st layer to the Mth layer.

[0026] S130, deleting all enterprise nodes in the integrated node from the enterprise node set, and repeating step S110 according to the deleted enterprise node set until the enterprise node set is an empty set, and all integrated nodes are obtained.

[0027] S140, for each integrated node, based on the association level between each enterprise node in the current integrated node and other enterprise nodes in the current integrated node, and the first association level between each enterprise node in the current integrated node and each other enterprise node with the corresponding association level of the first layer and belonging to other integrated nodes, obtain the connection relationship and the second association level between the current integrated node and each other integrated node.

[0028] S150, obtaining the enterprise-level knowledge graph corresponding to all enterprise nodes based on the connection relationship and the second correlation degree between each comprehensive node and all other comprehensive nodes.

[0029] Among them, the central node is an enterprise node that occupies a core position in the enterprise node set, and the number of directly and indirectly related enterprise nodes in the enterprise node set meets the preset judgment conditions. It plays a key hub role in the enterprise network and has a significant influence on inter-enterprise relationships and business transactions.

[0030] The target level value M is the maximum associated level covered when constructing a comprehensive node with the central node as the core. It determines the selection range of enterprise nodes associated with the central node and directly affects the composition of the comprehensive node and the structure of the knowledge graph.

[0031] Through a recursive, hierarchical screening mechanism, the combined comprehensive nodes and their included enterprise nodes are gradually removed from the enterprise node set, ensuring that each iteration recalculates the central node and comprehensive node based on the remaining uncombined enterprise nodes. Furthermore, the scale of nodes processed in each iteration gradually decreases, avoiding repeated calculations of the entire data set and significantly reducing time and space complexity.

[0032] A connected relationship means that the corresponding two integrated nodes are directly connected; a non-connected relationship means that the corresponding two integrated nodes are not directly connected.

[0033] The comprehensive nodes are used as nodes of the enterprise-level knowledge graph, and the connection edges of the enterprise-level knowledge graph are constructed according to the connection relationship and the second correlation degree between the comprehensive nodes, thereby constructing the enterprise-level knowledge graph.

[0034] As mentioned above, by screening central nodes based on the association level and determining the target level value M, the core hub nodes in the enterprise node network are accurately identified, and the reasonable influence range of the central node is delineated; by integrating the central node and the enterprise nodes with the association levels of the 1st to the Mth layer into comprehensive nodes, the complex enterprise relationship network is abstracted into a structured node cluster, which effectively reduces the complexity of the graph, improves the data processing efficiency, and enhances the ability of the knowledge graph to express the enterprise association structure, making the knowledge graph structure more compact and focused; by recursively deleting the processed nodes and repeatedly constructing the comprehensive nodes, the massive enterprise nodes are systematically divided into non-heavy nodes. The stacked comprehensive node collection forms a hierarchical graph structure, avoids data redundancy, and improves the interpretability and compactness of the knowledge graph; by analyzing the association level and association degree between comprehensive nodes, quantifying the connection strength between different node clusters, establishing a macro-level relationship network, and by mapping the association degree to edge length and constructing an enterprise-level knowledge graph, the abstract enterprise relationship is transformed into a visual, computable, simplified and highly compact graph model, providing an accurate weight basis for path planning between enterprise nodes, significantly improving the efficiency and accuracy of path planning, and supporting multi-dimensional abnormal node judgment, enhancing the decision-making assistance capability of the knowledge graph.

[0035] In one specific embodiment, S110 includes the following steps: S111, for any enterprise node in the enterprise node set, according to the association level between the current enterprise node and other enterprise nodes, obtain the i-th node number corresponding to all enterprise nodes with the i-th association level between the current enterprise node, where i≤N.

[0036] S112 , according to the first node quantity corresponding to each enterprise node, determine the enterprise node corresponding to the largest first node quantity in the enterprise node set as the central node.

[0037] S113 , obtaining a node category corresponding to the central node according to the number of nodes from the first to the Nth corresponding to the central node, wherein the node category is a super node or a non-super node.

[0038] S114, if the node category corresponding to the central node is a super node, then the target level value M corresponding to the central node is obtained based on the number of nodes from the 1st to the Nth corresponding to the central node, wherein the number of nodes from the 1st to the Mth corresponding to the central node meets the preset judgment condition, 1<M≤N.

[0039] S115 , if the node category corresponding to the central node is a non-super node, then determine the target level value M corresponding to the central node to be 1.

[0040] Among them, the number of nodes in the i-th layer is the total number of all enterprise nodes with the i-th level of association with the current enterprise node, reflecting the influence range and connection breadth of the current enterprise node at the i-th level of association.

[0041] There are different levels of association relationships between enterprise nodes. By traversing each enterprise node in the enterprise node set and counting the number of other enterprise nodes that are at the i-th association level with the current enterprise node, the connection scale of each enterprise node at different association levels can be quantified from a quantitative dimension, providing basic data for subsequent screening of central nodes.

[0042] The number of first nodes represents the degree of direct connection between the corresponding enterprise node and other enterprise nodes. The higher the degree of direct connection, the more prominent the enterprise node's core position in the enterprise network. Therefore, the enterprise node with the largest number of first nodes in the enterprise node set is identified as the central node, quickly locking in the enterprise with the greatest direct influence in the enterprise network.

[0043] Central nodes are classified by analyzing their connections across multiple association levels (number of nodes from the 1st to the Nth level). Correspondingly, if a central node has a high number of nodes at multiple levels, it indicates that its influence is not limited to directly affiliated enterprises but also extends to a wider range of indirectly affiliated enterprises. It is defined as a super node. Based on the number of nodes, the target level value M corresponding to the preset judgment conditions is determined. This ensures that the influence of the central node falls within a reasonable and representative range from the 1st to the Mth level, covering major affiliated enterprises without causing information redundancy due to too many levels. This serves as the basis for enterprise node integration. Conversely, a central node with a low level of influence is considered a non-super node, whose influence is primarily concentrated on directly affiliated enterprise nodes (the 1st level) and is weaker at higher levels. Therefore, directly assigning the target level value M = 1 to the central node helps further refine the attributes and influence range of the central node. While ensuring information integrity, it avoids the introduction of excessive irrelevant information due to too many levels, making the constructed comprehensive node more refined and the knowledge graph structure clearer, which is conducive to improving the accuracy and efficiency of path planning and abnormal node identification between enterprise nodes.

[0044] Super nodes represent enterprise nodes with extensive influence and rich and deep connections within the enterprise network. Non-super nodes represent enterprise nodes with relatively limited influence.

[0045] As mentioned above, by counting the number of nodes of each enterprise node at different levels, a quantitative indicator is provided for the subsequent screening of central nodes, making node screening more objective and scientific, and avoiding the arbitrariness of subjective judgment. Taking the number of the first node as the screening basis, the core enterprise can be efficiently located from the massive enterprise nodes, highlighting the focus of the knowledge graph, and laying a good foundation for the subsequent composition of comprehensive nodes and the construction of the entire knowledge graph. By classifying the central nodes, the status and role of the central nodes in the enterprise network can be more accurately described, providing a more detailed basis for the subsequent determination of the target level value M, so that the knowledge graph can more accurately reflect the complex relationship structure between enterprises, enhance the analysis and application value of the knowledge graph, and determine the appropriate target level value M according to the characteristics of the central node. It can accurately delineate the scope of enterprise nodes closely related to the central node, while ensuring information integrity, avoiding the introduction of too much irrelevant information due to too many levels, making the constructed comprehensive nodes more refined and the knowledge graph structure clearer, which is conducive to improving the accuracy and efficiency of path planning and abnormal node judgment between enterprise nodes.

[0046] In a specific embodiment, the preset judgment condition is: The sum of the number of nodes from the 1st to the M-1th corresponding to the central node is less than the preset number threshold, and the sum of the number of nodes from the 1st to the Mth corresponding to the central node is greater than or equal to the preset number threshold.

[0047] The preset threshold is a numerical standard set by implementers based on the scale of the enterprise network, the sophistication of the knowledge graph, and other factors. It serves as a key indicator for measuring the adequacy of the central node's influence coverage. The threshold can be adjusted based on specific needs in different enterprise network scenarios. For example, for larger enterprise networks with complex relationships, the threshold can be set relatively high to ensure that a sufficient number of enterprise nodes closely connected to the central node are selected. For smaller enterprise networks with relatively simple relationships, the threshold can be lowered appropriately.

[0048] This preset judgment condition determines the target level value M by comparing the relationship between the cumulative number of nodes of the central node at different levels and the preset number threshold. Correspondingly, in an enterprise network, the influence of the central node gradually weakens as the associated levels extend. When the cumulative number of nodes reaches or exceeds the preset number threshold, it means that this level and the levels within it have already covered a sufficient number of associated enterprises of the central node and can better represent the influence range of the central node. If the level continues to increase, the contribution of the newly added associated enterprises to the influence of the central node will be small, and redundant information will be introduced. Therefore, determining M based on this condition can ensure that the main associated enterprises of the central node are covered while avoiding the complexity of information caused by excessive extension of the level.

[0049] The clear preset judgment conditions mentioned above provide a clear and quantifiable standard for determining the target hierarchical value M, making the determination process of M more objective and standardized, so that the screened M can accurately define the scope of enterprise nodes closely related to the central node. The constructed comprehensive node not only fully retains the core related information of the central node, but also effectively reduces unnecessary hierarchical expansion, which helps to optimize the structure of the knowledge graph, reduce the complexity of the graph, improve the efficiency and accuracy of subsequent path planning and abnormal node judgment based on the knowledge graph, and enhance the practicality and effectiveness of the knowledge graph in actual enterprise applications.

[0050] In a specific embodiment, S120 includes the following steps: S121: The central node and all enterprise nodes associated with the central node at the 1st to Mth levels are taken as first nodes.

[0051] S122, for any first node, based on the first degree of association between each first node whose association level with the current first node is the first layer and the current first node, obtain the first side length corresponding to the first side between each first node whose association level with the current first node is the first layer and the current first node, wherein the first side length is negatively correlated with the corresponding first degree of association.

[0052] S123, constructing an enterprise subgraph corresponding to the central node based on all first nodes corresponding to the central node and first edge lengths corresponding to all first edges, and treating the enterprise subgraph corresponding to the central node as a comprehensive node corresponding to the central node.

[0053] The higher the first degree of association, the closer the business connection between the two enterprises. The first degree of association between each first node and other first nodes at level 1 is converted into the first edge length of the first edge. A higher first degree of association and a shorter first edge length indicate a closer relationship between the two first nodes. Conversely, a lower first degree of association and a longer first edge length indicate a weaker relationship between the two first nodes. By converting the abstract first degree of association into an intuitive geometric distance, the subsequent construction and analysis of enterprise subgraphs is facilitated.

[0054] The enterprise subgraph takes the central node as the core and connects each directly related enterprise node through second edges of different lengths, intuitively showing the relationship network between the central node and its related enterprise nodes.

[0055] In the above, with the central node as the core, the association levels between the central node and the second edges of different lengths are connected layer by layer from the 1st layer to the Mth layer, and the enterprise sub-graph corresponding to the central node is constructed, and the enterprise sub-graph is regarded as a comprehensive node, thereby simplifying the structure of the knowledge graph at a higher level, and abstracting the complex sub-network into a single node, which is convenient for overall analysis and processing, thereby reducing the amount of calculation when processing massive enterprise nodes, and improving the efficiency of path planning and abnormal node judgment. At the same time, the comprehensive node retains the key relationship information of the internal nodes. When in-depth analysis is required, the sub-graph can be further expanded, realizing the flexible application of the knowledge graph at different levels of abstraction.

[0056] In a specific embodiment, S140 includes the following steps: S141 , each enterprise node whose association level with the central node in the current integrated node is the Mth layer is regarded as an edge node in the current integrated node.

[0057] S142, each enterprise node in the other integrated nodes whose association level with each edge node is the first layer is determined as a related node corresponding to the current integrated node, and a node pair consisting of each edge node and each corresponding related node is obtained.

[0058] S143 , for any related node corresponding to the current integrated node, determining the connection relationship between the current integrated node and the integrated node to which the current related node belongs as a connected relationship.

[0059] S144, for any integrated node that has a connected relationship with the current integrated node, based on all node pairs corresponding to the current integrated node and any integrated node that has a connected relationship with the current integrated node, and the first degree of association between the edge node and the related node in each node pair, obtain the second degree of association between the current integrated node and any integrated node that has a connected relationship with the current integrated node.

[0060] S145 : Determine the connection relationship between the integrated node that does not include any related node in the current integrated node and the current integrated node as a non-connected relationship.

[0061] S146: Determine the preset degree value as the second correlation degree between the current integrated node and the integrated node that has a non-connected connection relationship with the current integrated node.

[0062] The marginal influence of a comprehensive node is reflected through the enterprise nodes at its upper level (layer M). These edge nodes have weak connections to the central node but can serve as interfaces to external comprehensive nodes. Therefore, the enterprise nodes corresponding to the edge node's first-level associated nodes in other comprehensive nodes are considered the related nodes of the current comprehensive node, directly reflecting the interaction between the current comprehensive node and other comprehensive nodes. A node pair is formed based on the related nodes and each corresponding edge node. This can be further viewed as a node pair between the current comprehensive node corresponding to the edge node and the comprehensive node corresponding to the related node.

[0063] Furthermore, since there may be several enterprise nodes whose association level with each edge node is the first layer, there may be several node pairs corresponding to the current integrated node and any integrated node whose connection relationship with the current integrated node is a connected relationship. Then, based on the first degree of association between the edge node and the relevant node in each node pair, and the association level between the relevant node in the node pair and the central node in the integrated node to which it belongs, the second degree of association between the current integrated node and any integrated node whose connection relationship with the current integrated node is a connected relationship is obtained.

[0064] Among them, the influence weight of the corresponding node pair can be set according to the association level between the relevant nodes in each node pair and the central node in the integrated node to which they belong, which is used to represent the difference in influence of the node pair in the measurement of the degree of association between the integrated nodes. Correspondingly, the relevant nodes at the lower level are closer to the central node of the integrated node to which they belong, closer to the core resources or relationships of the whole, and the relationship with the central node of the integrated node to which they belong is more solid and less prone to fluctuation. Therefore, the association between the relevant nodes at the lower level and the external edge nodes can better represent the overall interactive ability of the integrated node. Therefore, the association level is positively correlated with the influence weight, and the influence weight can be set within the range of (0, 1) to maintain dimensional consistency.

[0065] Furthermore, the first degree of association between the edge node and the related node in the node pair can be weighted and summed according to the influence weight to obtain the second degree of association between the current integrated node and any integrated node that has a connected relationship with the current integrated node.

[0066] For example, if the edge node a of integrated node A m There is a first-level association between enterprise node b1 and integrated node B, so it is considered that A and B are connected through a m A connecting bridge is established with b1.

[0067] The preset degree value is 0, indicating that there is no direct correlation between the corresponding comprehensive nodes.

[0068] As mentioned above, through edge node association analysis, the relationship modeling between comprehensive nodes is transformed into direct association analysis of boundary nodes, which reduces the computational complexity. By filtering non-connected relationships, the number of edges in the subsequent knowledge graph is significantly reduced. While maintaining the accuracy of the relationship, the computational efficiency and graph interpretability are greatly improved, thereby reducing the path search space and improving the efficiency of subsequent path planning between enterprise nodes.

[0069] In one specific embodiment, S150 includes the following steps: S151, for any two integrated nodes that are connected in a connected relationship, obtain the second side length corresponding to the second side between the two integrated nodes according to the second degree of association between the two integrated nodes, wherein the second side length is negatively correlated with the corresponding second degree of association.

[0070] S152, constructing an enterprise-level knowledge graph corresponding to all enterprise nodes based on all comprehensive nodes and the second side length corresponding to the second side between any two second nodes with a connected relationship.

[0071] Among them, negative correlation mapping is used to convert the second degree of association into geometric distance, so that the association strength and physical distance form an intuitive correspondence, thereby converting the abstract association strength into a measurable physical property in the graph, so that the path planning algorithm can directly use the second side length as the weight to calculate the shortest path, thereby improving the rationality of subsequent path planning.

[0072] Correspondingly, the higher the second correlation degree, the shorter the corresponding second side length, indicating that the spatial distance between the two integrated nodes in the graph is closer. The lower the second correlation degree, the longer the corresponding second side length, indicating that the spatial distance between the two integrated nodes in the graph is farther.

[0073] Those skilled in the art will appreciate that any path planning algorithm in the prior art falls within the scope of protection of the present invention, for example, Dijkstra algorithm, Algorithm, BSF algorithm, ant colony algorithm, will not be described in detail here.

[0074] S20, determining an enterprise node in the enterprise node set where an abnormality occurs as an abnormal enterprise node, and determining an enterprise node to be subjected to abnormality detection as a target enterprise node.

[0075] Abnormal enterprise nodes are nodes corresponding to enterprises currently experiencing operational risks, data anomalies, or violations, identified based on historical data, real-time monitoring, or external early warning systems. This embodiment selects an abnormal enterprise node as the starting point for anomaly propagation analysis, tracing the impact of the abnormal situation on other enterprise nodes. For example, an enterprise experiencing unusual fluctuations in financial indicators, frequent defaults, or network security vulnerabilities may be marked as an abnormal enterprise node.

[0076] Target enterprise nodes are selected based on business needs (such as risk prevention and control, and supply chain stability analysis) to identify enterprise nodes that require focused inspection to determine if they are affected by anomalies. These nodes serve as the endpoints of anomaly detection. By analyzing the associated paths with the anomaly enterprise nodes, we determine whether the target enterprise nodes present anomaly risks. For example, in a supply chain scenario, the target enterprise nodes may be direct or indirect suppliers, partners, or other enterprises of the anomaly enterprise.

[0077] As mentioned above, by clarifying the abnormal enterprise nodes and target enterprise nodes, a clear target is provided for path planning, and the detection scope is narrowed to the set of nodes involved in the associated paths of the two, avoiding blind search, significantly reducing the amount of calculation, and supporting real-time updates of abnormal enterprise nodes and target enterprise nodes to adapt to dynamic changes in the enterprise network.

[0078] S30, obtaining a target path from the abnormal enterprise node to the target enterprise node based on the connection relationship and the second correlation degree between the comprehensive nodes in the enterprise-level knowledge graph.

[0079] In a specific embodiment, S30 includes the following steps: S310 , according to the number of enterprise nodes included in each integrated node, the integrated node to which the abnormal enterprise node belongs is used as the starting node, and the integrated node to which the target enterprise node belongs is used as the ending node.

[0080] S320, based on the connection relationship between the comprehensive nodes in the enterprise-level knowledge graph, obtain several first candidate paths between the starting node and the ending node, wherein each first candidate path includes several comprehensive nodes in a sequential order.

[0081] S330 : Acquire all second correlation degrees included in each first candidate path according to the second correlation degrees between any two integrated nodes having a connected relationship.

[0082] S340: Obtain a first priority corresponding to each first candidate path according to all second association degrees included in each first candidate path.

[0083] S350: Determine the first candidate path corresponding to the highest first priority as the target path.

[0084] The abnormal enterprise nodes and target enterprise nodes are mapped to their respective integrated nodes, transforming the node-level path search into an integrated node-level path search. Because the integrated node aggregates the enterprise nodes, the number of nodes involved in the path search is significantly reduced.

[0085] Based on the connection relationships between the comprehensive nodes in the enterprise-level knowledge graph, a graph search algorithm is used to find all possible paths between the starting node and the ending node to form a first set of candidate paths. Those skilled in the art will recognize that any graph search algorithm in the prior art falls within the scope of protection of the present invention, such as breadth-first search (BFS) and depth-first search (DFS), and will not be described in detail here.

[0086] The second correlation degree reflects the closeness of the service correlation between the integrated nodes and provides a quantitative basis for the calculation of path priority.

[0087] Based on all the second correlation degrees contained in each first candidate path, the first priority corresponding to each first candidate path is calculated through methods such as average calculation and weighted average calculation. This facilitates the rapid screening of the optimal path between integrated nodes, improving the accuracy and decision-making efficiency of path planning between enterprise nodes. Correspondingly, the first candidate path with a higher average second correlation degree has a higher first priority.

[0088] As mentioned above, by integrating node-level path search and priority screening, the computational complexity is significantly reduced compared to the traditional method of directly searching for paths at the enterprise node level. The path priority is quantified based on the second degree of association, so that the planned target path is more in line with the actual business association strength of the enterprise, avoiding the selection of low-value and weakly associated paths, and improving the accuracy of the path planning results between enterprise nodes.

[0089] S40 , obtaining a target abnormality degree corresponding to the target enterprise node according to the reference abnormality degree of the abnormal enterprise node, a plurality of integrated nodes in the target path, and all second association degrees corresponding to the target path.

[0090] Among them, the reference abnormality degree is a quantitative value of the abnormal risk determined by the abnormal enterprise node, which can be calculated based on multi-dimensional data such as financial indicators and violation records. This embodiment directly obtains the reference abnormality degree as the initial value for abnormal risk propagation, providing a starting point for the calculation of the abnormality degree of the target enterprise node.

[0091] In a specific embodiment, S40 includes the following steps: S410 , for any integrated node, according to the order of the integrated nodes in the target path, the integrated node preceding the current integrated node is determined as the first reference node, and the integrated node following the current integrated node is determined as the second reference node.

[0092] S420 , determining the edge node corresponding to each related node corresponding to the current integrated node in the first reference node in the current integrated node as a first key node corresponding to the current integrated node.

[0093] S430 , determining the edge node corresponding to each related node corresponding to the current integrated node in the second reference node in the current integrated node as a second key node corresponding to the current integrated node.

[0094] S440, based on the hierarchical relationship between each enterprise node included in the current integrated node, obtain several second candidate paths between each first key node and each second key node in the current integrated node, wherein each second candidate path includes several enterprise nodes in a sequential order.

[0095] S450 , according to the first association degree between each enterprise node in the current integrated node and the corresponding other enterprise nodes with the association level of the first layer, obtain all first association degrees included in each second candidate path corresponding to the current integrated node.

[0096] S460 : Acquire a third correlation degree corresponding to each second candidate path corresponding to the current integrated node according to all first correlation degrees included in each second candidate path corresponding to the current integrated node.

[0097] S470: Determine the sum of all third association degrees corresponding to the current integrated node as the importance degree corresponding to the current integrated node.

[0098] S480 , obtaining a target abnormality degree corresponding to the target enterprise node according to the reference abnormality degree of the abnormal enterprise node, the importance degree corresponding to each integrated node in the target path, and all second association degrees corresponding to the target path.

[0099] Among them, according to the sequence of each integrated node in the target path, the first reference node preceding it and the second reference node following it are determined for each integrated node. By clarifying the sequence relationship between the integrated nodes, a logical chain of abnormal conduction is constructed, providing a basic framework for the subsequent analysis of the associated paths between the integrated nodes.

[0100] If the current integrated node corresponds to several related nodes in the first reference node, and each related node corresponding to the first reference node corresponds to an edge node in the current integrated node, then each first key node is a key interface node for abnormalities transmitted from the first reference node to the current integrated node. If the current integrated node corresponds to several related nodes in the second reference node, and each related node corresponding to the second reference node corresponds to an edge node in the current integrated node, then each second key node is a key interface node for abnormalities transmitted from the current integrated node to the second reference node.

[0101] The second candidate path is a possible path between the first and second key nodes in the current integrated node. It is used to provide a set of path selections for the anomaly's internal transmission within the integrated node, thereby screening out the key transmission paths. Using a graph search algorithm, all possible paths between each first key node and each second key node are identified. A second candidate path set is formed based on all possible paths between all first key nodes and all second key nodes. By exploring potential transmission paths within the nodes, the potential for anomaly propagation within the integrated node is fully covered, avoiding the omission of important internal transmission paths, ensuring the integrity of the anomaly propagation analysis, and providing sufficient data support for accurately assessing the degree of anomaly.

[0102] The third degree of association is calculated based on the first degree of association between each enterprise node in each second candidate path. It is used to quantify the efficiency of anomaly propagation along the second candidate path. For example, for any second candidate path, the first degrees of association between several enterprise nodes that exist in a certain order within the current second candidate path are used to obtain all first degrees of association within the current second candidate path. Using methods such as average and weighted average calculations, the third degree of association corresponding to each second candidate path is calculated. This quantifies the smoothness of the path from the first key node (input interface) to the second key node (output interface) within the current integrated node, and represents the strength of the association within the current integrated node.

[0103] Third, a higher degree of correlation indicates less attenuation of the abnormal signal within the integrated node, faster propagation speed, and higher propagation efficiency. Second, a greater number of candidate paths indicates that the abnormality can spread through multiple paths within the integrated node, increasing the overall risk.

[0104] Therefore, the sum of all third correlation degrees within the integrated node is determined as the importance degree corresponding to the current integrated node, which represents the contribution degree of the current integrated node to abnormal conduction in the target path.

[0105] The target anomaly level is the reference anomaly level of the abnormal enterprise node. After transmission through the target path, the final quantified anomaly risk value of the target enterprise node serves as the core result of target enterprise node anomaly detection and is used for subsequent node type determination. Specifically, the target anomaly level corresponding to the target enterprise node is derived by comprehensively considering the reference anomaly level of the abnormal enterprise node, the importance of each integrated node in the target path, and the secondary correlation between integrated nodes. This organically combines factors such as the anomaly source risk, the importance of path nodes, and the strength of correlation between nodes to achieve accurate transmission calculation of anomaly risk.

[0106] As mentioned above, we deeply analyze the propagation paths of abnormal situations in various enterprise nodes within the comprehensive node, accurately capture all key nodes and all feasible paths for the transmission of abnormal situations within the comprehensive node, and quantify the contribution of the comprehensive node to the abnormal transmission through correlation analysis. We comprehensively consider multi-dimensional factors such as the source of the abnormality, the importance of the comprehensive nodes in the path, and the strength of the correlation between nodes, so as to make the calculation of the target abnormality level of the target enterprise node more accurate.

[0107] In a specific implementation, S480 includes the following steps: S481 , acquiring the abnormal diffusion degree corresponding to the target path according to the importance degree corresponding to each integrated node in the target path and all second association degrees corresponding to the target path.

[0108] S482: Obtain a target abnormality degree corresponding to the target enterprise node based on the reference abnormality degree and abnormality diffusion degree of the abnormal enterprise node.

[0109] Based on the importance of each integrated node in the target path and the secondary correlation between integrated nodes, the node importance and correlation strength are combined to calculate the anomaly diffusion degree corresponding to the target path. The importance reflects the contribution of the integrated node to the anomaly transmission, while the secondary correlation reflects the closeness of risk transmission between integrated nodes. The combination of the two can quantify the risk diffusion capacity along the entire target path.

[0110] The degree of abnormal diffusion is a quantitative indicator that measures the ability of abnormal risks to spread on the target path. It comprehensively reflects the impact of the importance of each comprehensive node in the path and the strength of the association between nodes on the risk diffusion.

[0111] The reference anomaly level determines the initial magnitude of risk, while the anomaly diffusion level determines the magnitude of risk change along the path. Using the reference anomaly level of the abnormal enterprise node as the risk source and combining it with the anomaly diffusion level, the initial risk is calculated based on the diffusion capacity of the path, resulting in the target anomaly level corresponding to the target enterprise node.

[0112] For example, the target abnormality degree W corresponding to the target enterprise node is W = W0 × KS, where W0 is the reference abnormality degree of the abnormal enterprise node, and the abnormal diffusion degree KS corresponding to the target path is KS = (∑ Ф-1 t=1 ((ZY t +ZY t+1 ) / (2×ZY 0 )×GL t(t+1) )) / (Ф-1), where Ф is the total number of synthesis nodes in the target path, t=1, 2, ..., Ф-1, ZY t is the importance of the t-th comprehensive node in the target path, ZY t+1is the importance of the t+1th comprehensive node in the target path, ZY 0 is the maximum value of the importance of the Ф comprehensive nodes in the target path, GL t(t+1) It is the second degree of association between the tth integrated node and the t+1th integrated node in the target path.

[0113] As described above, the node characteristics of the comprehensive nodes in the target path and the correlation characteristics between the comprehensive nodes are used to quantitatively calculate the abnormal transmission situation of the reference abnormality degree of the abnormal enterprise node, thereby realizing a refined assessment of the target abnormality degree of the target enterprise node and improving the assessment accuracy of the target abnormality degree.

[0114] S50 , obtaining a node type corresponding to the target enterprise node according to a target abnormality level corresponding to the target enterprise node and a preset abnormality level threshold, wherein the node type is an abnormal node or a non-abnormal node.

[0115] Among them, the preset abnormality threshold is a risk critical value pre-set according to the business characteristics of the enterprise, industry standards or historical data. It can be dynamically adjusted by the implementer according to the actual situation, and used as a judgment basis for dividing node types to clearly define the boundary between normal and abnormal states.

[0116] If the target abnormality level corresponding to the target enterprise node is greater than or equal to the preset abnormality level threshold, the node type corresponding to the target enterprise node is determined to be an abnormal node. If the target abnormality level corresponding to the target enterprise node is less than the preset abnormality level threshold, the node type corresponding to the target enterprise node is determined to be a non-abnormal node.

[0117] The risk status of the target enterprise node is identified by the node type, providing the enterprise with intuitive risk classification results, facilitating the formulation of targeted management strategies.

[0118] As described above, by aggregating enterprise nodes based on the association level and the first association degree to form comprehensive nodes, and constructing an enterprise-level knowledge graph containing connection relationships and the second association degree, the complex relationships of massive enterprise nodes can be abstracted into a hierarchical structure, which greatly reduces the complexity of the graph and the amount of path planning calculations. At the same time, the strength of the association between nodes is quantified, providing a data basis for accurate path planning and anomaly detection; by clearly dividing abnormal enterprise nodes and target enterprise nodes, the indiscriminate global anomaly detection is transformed into a local analysis focusing on specific nodes, reducing invalid calculations, clarifying the anomaly detection target, and improving the efficiency and pertinence of anomaly analysis; by taking comprehensive nodes as units, combining node connection relationships and the second association degree to screen the target path from abnormal enterprise nodes to target enterprise nodes, the target path can be quickly determined in the hierarchical knowledge graph. It locates high-value paths, avoids blind searches, and improves path planning efficiency and accuracy; by comprehensively considering the reference abnormality degree of abnormal enterprise nodes, the importance of each integrated node in the target path, and the second correlation degree between the integrated nodes, it enables the accurate quantification of the transmission of abnormal situations on the target path based on multi-dimensional factors, and quantifies the target abnormality degree of the target enterprise node, avoiding single-factor evaluation errors and providing enterprises with more reliable risk assessment data; by comparing the target abnormality degree of the target enterprise node with the preset threshold to determine the node type, it converts complex risk assessment results into intuitive and standardized decision signals, and realizes rapid and accurate abnormality judgment of the target enterprise node, which can support the enterprise's dynamic risk warning and resource optimization allocation, and improve the standardization and response efficiency of risk management.

[0119] Example 2 This second embodiment provides an enterprise node abnormality judgment system based on knowledge graph, such as Figure 2 As shown, the enterprise node anomaly judgment system based on knowledge graph includes: The knowledge graph construction module 21 is used to obtain an enterprise-level knowledge graph based on the association hierarchy between each enterprise node and other enterprise nodes in the enterprise node set, and the first degree of association between each enterprise node and other enterprise nodes with the corresponding association hierarchy being the first level, wherein the association hierarchy includes the first level to the Nth level, and the enterprise-level knowledge graph is constructed by a number of integrated nodes, the connection relationship between the integrated nodes, and the second degree of association. Each integrated node is obtained by combining a number of enterprise nodes, the second degree of association is obtained based on the first degree of association, and the connection relationship is a connected relationship or a non-connected relationship.

[0120] The enterprise node extraction module 22 is configured to determine an enterprise node in the enterprise node set where an abnormality occurs as an abnormal enterprise node, and determine an enterprise node to be subjected to abnormality detection as a target enterprise node.

[0121] The target path acquisition module 23 is used to acquire the target path between the abnormal enterprise node and the target enterprise node based on the connection relationship and the second correlation degree between the comprehensive nodes in the enterprise-level knowledge graph.

[0122] The target abnormality degree acquisition module 24 is configured to acquire the target abnormality degree corresponding to the target enterprise node according to the reference abnormality degree of the abnormal enterprise node, a plurality of integrated nodes in the target path, and all second correlation degrees corresponding to the target path.

[0123] The node type determination module 25 is configured to obtain the node type corresponding to the target enterprise node according to the target abnormality level corresponding to the target enterprise node and a preset abnormality level threshold, wherein the node type is an abnormal node or a non-abnormal node.

[0124] In a specific embodiment, the knowledge graph construction module 21 includes: The central node screening submodule is used to screen out central nodes from the enterprise node set according to the association level between each enterprise node and other enterprise nodes in the enterprise node set, and obtain the target level value M corresponding to the central node, where 1≤M≤N.

[0125] The first integrated node acquisition submodule is used to form an integrated node corresponding to the central node based on the central node and all enterprise nodes whose association levels with the central node are from the 1st layer to the Mth layer.

[0126] The second integrated node acquisition submodule is used to delete all enterprise nodes in the integrated node from the enterprise node set, and repeatedly execute the central node screening submodule according to the deleted enterprise node set until the enterprise node set is an empty set, and all integrated nodes are acquired.

[0127] The comprehensive node relationship analysis submodule is used to obtain the connection relationship and the second degree of association between the current comprehensive node and all other comprehensive nodes for each comprehensive node based on the association level between each enterprise node in the current comprehensive node and other enterprise nodes, and the first degree of association between each enterprise node and other enterprise nodes with the corresponding association level of the first layer.

[0128] The knowledge graph construction submodule is used to obtain the enterprise-level knowledge graph corresponding to all enterprise nodes based on the connection relationship and the second correlation degree between each comprehensive node and all other comprehensive nodes.

[0129] In one embodiment, the central node screening submodule includes: The node quantity statistics unit is used to obtain the i-th node number corresponding to all enterprise nodes with an association level of the i-th layer between the current enterprise node and any enterprise node in the enterprise node set according to the association level between the current enterprise node and other enterprise nodes, where i≤N.

[0130] The central node acquisition unit is used to determine the enterprise node corresponding to the largest number of first nodes in the enterprise node set as the central node according to the number of first nodes corresponding to each enterprise node.

[0131] The node category acquisition unit is used to acquire the node category corresponding to the central node according to the number of nodes from the first to the Nth corresponding to the central node, wherein the node category is a super node or a non-super node.

[0132] The first target level value acquisition unit is used to obtain the target level value M corresponding to the central node based on the number of nodes from the 1st to the Nth corresponding to the central node if the node category corresponding to the central node is a super node, wherein the number of nodes from the 1st to the Mth corresponding to the central node meets the preset judgment condition, 1<M≤N.

[0133] The second target level value obtaining unit is configured to determine a target level value M=1 corresponding to the central node if the node category corresponding to the central node is a non-super node.

[0134] In a specific embodiment, the first integrated node acquisition submodule includes: The first node determination unit is configured to determine the central node and all enterprise nodes whose association levels with the central node are from the 1st layer to the Mth layer as first nodes.

[0135] The first side length acquisition unit is used to obtain, for any first node, the first side length corresponding to the first side between each first node whose association level with the current first node is the first layer and the current first node based on the first degree of association between each first node whose association level with the current first node is the first layer and the current first node, wherein the first side length is negatively correlated with the corresponding first degree of association.

[0136] The comprehensive node acquisition unit is used to construct the enterprise sub-graph corresponding to the central node based on all the first nodes corresponding to the central node and the first side lengths corresponding to all the first sides, and regard the enterprise sub-graph corresponding to the central node as the comprehensive node corresponding to the central node.

[0137] In a specific embodiment, the comprehensive node relationship analysis submodule includes: The edge node acquisition unit is configured to take each enterprise node whose association level with the central node in the current integrated node is the Mth layer as an edge node in the current integrated node.

[0138] The related node acquisition unit is used to determine each enterprise node in other integrated nodes whose association level with each edge node is the first layer as the related node corresponding to the current integrated node, and obtain the node pairs consisting of each edge node and each corresponding related node.

[0139] The first relationship determining unit is configured to determine, for any related node corresponding to the current integrated node, a connection relationship between the current integrated node and the integrated node to which the current related node belongs as a connected relationship.

[0140] The first degree acquisition unit is used to obtain the second degree of association between the current integrated node and any integrated node that has a connected relationship with the current integrated node, based on all node pairs corresponding to the current integrated node and any integrated node that has a connected relationship with the current integrated node, as well as the first degree of association between the edge node and the related node in each node pair, for any integrated node that has a connected relationship with the current integrated node.

[0141] The second relationship determining unit is configured to determine the connection relationship between the integrated node that does not include any related node in the current integrated node and the current integrated node as a non-connected relationship.

[0142] The second degree acquisition unit is configured to determine the preset degree value as a second correlation degree between the current integrated node and an integrated node that has a non-connected connection relationship with the current integrated node.

[0143] In a specific embodiment, the knowledge graph construction submodule includes: The second side length acquisition unit is used to obtain the second side length corresponding to the second side between any two comprehensive nodes that are connected in a connected relationship according to the second degree of association between the two comprehensive nodes, wherein the second side length is negatively correlated with the corresponding second degree of association.

[0144] The knowledge graph construction unit is used to construct an enterprise-level knowledge graph corresponding to all enterprise nodes based on all comprehensive nodes and the second side length corresponding to the second side between any two second nodes with a connected relationship.

[0145] In a specific embodiment, the target path acquisition module 23 includes: The start and end node determination submodule is used to determine the integrated node to which the abnormal enterprise node belongs as the start node and the integrated node to which the target enterprise node belongs as the end node according to the number of enterprise nodes included in each integrated node.

[0146] The first candidate path acquisition submodule is used to obtain several first candidate paths between the starting node and the ending node based on the connection relationship between the comprehensive nodes in the enterprise-level knowledge graph, wherein each first candidate path includes several comprehensive nodes in a certain order.

[0147] The second correlation degree acquisition submodule is configured to acquire all second correlation degrees included in each first candidate path according to the second correlation degree between any two integrated nodes having a connected relationship.

[0148] The first priority acquisition submodule is configured to acquire the first priority corresponding to each first candidate path according to all second association degrees included in each first candidate path.

[0149] The target path determination submodule is configured to determine the first candidate path corresponding to the largest first priority as the target path.

[0150] In a specific embodiment, the target abnormality degree acquisition module 24 includes: The reference node determination submodule is used to determine, for any integrated node, the integrated node that precedes the current integrated node as the first reference node and the integrated node that follows the current integrated node as the second reference node according to the order of the integrated nodes in the target path.

[0151] The first key node determination submodule is configured to determine the edge node corresponding to each related node corresponding to the current integrated node in the first reference node as a first key node corresponding to the current integrated node.

[0152] The second key node determination submodule is configured to determine the edge node corresponding to each related node corresponding to the current integrated node in the second reference node as a second key node corresponding to the current integrated node.

[0153] The second candidate path acquisition submodule is used to acquire a plurality of second candidate paths between each first key node and each second key node in the current integrated node according to the hierarchical relationship between each enterprise node included in the current integrated node.

[0154] The first correlation degree acquisition submodule is used to obtain all first correlation degrees included in each second candidate path corresponding to the current integrated node based on the first correlation degree between each enterprise node in the current integrated node and other enterprise nodes with the corresponding correlation level of layer 1.

[0155] The third correlation degree acquisition submodule is configured to acquire a third correlation degree corresponding to each second candidate path corresponding to the current integrated node according to all first correlation degrees included in each second candidate path corresponding to the current integrated node.

[0156] The importance determination submodule is configured to determine the sum of all third association degrees corresponding to the current integrated node as the importance corresponding to the current integrated node.

[0157] The target abnormality degree acquisition submodule is used to obtain the target abnormality degree corresponding to the target enterprise node based on the reference abnormality degree of the abnormal enterprise node, the importance degree corresponding to each comprehensive node in the target path, and all second correlation degrees corresponding to the target path.

[0158] In a specific embodiment, the target abnormality degree acquisition submodule includes: The abnormal diffusion degree acquisition unit is used to acquire the abnormal diffusion degree corresponding to the target path according to the importance degree corresponding to each comprehensive node in the target path and all the second correlation degrees corresponding to the target path.

[0159] The target abnormality degree acquisition unit is used to acquire the target abnormality degree corresponding to the target enterprise node according to the reference abnormality degree and abnormal diffusion degree of the abnormal enterprise node.

[0160] It should be noted that the information interaction, execution process and other contents between the above modules are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0161] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any form. Although the present invention has been disclosed as above in terms of preferred embodiments, they are not intended to limit the present invention. Any technician familiar with this profession can make some changes or modifications to equivalent embodiments of equivalent changes using the technical contents disclosed above without departing from the scope of the technical solution of the present invention. However, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A method for judging enterprise node anomalies based on knowledge graph, characterized in that: The method for determining enterprise node anomaly based on knowledge graph includes the following steps: S10, obtaining an enterprise-level knowledge graph based on a plurality of integrated nodes corresponding to the enterprise node set, the connection relationship between the integrated nodes, and the second degree of association, wherein each integrated node is obtained by combining a plurality of enterprise nodes in the enterprise node set; S20, obtaining a target path from an abnormal enterprise node to a target enterprise node in the enterprise node set according to the enterprise-level knowledge graph; S30, obtaining a target abnormality degree corresponding to the target enterprise node based on the reference abnormality degree of the abnormal enterprise node, a plurality of integrated nodes in the target path, and all second association degrees corresponding to the target path; S40 , obtaining a node type corresponding to the target enterprise node according to a target abnormality level corresponding to the target enterprise node and a preset abnormality level threshold, wherein the node type is an abnormal node or a non-abnormal node.

2. The enterprise node anomaly judgment method based on knowledge graph according to claim 1 is characterized in that: S10 includes the following steps: S110, based on the association levels between other enterprise nodes in the enterprise node set, a central node is selected from the enterprise node set, and a target level value M corresponding to the central node is obtained, wherein the association levels include levels 1 to N, and the target level value M is the maximum association level covered when constructing a comprehensive node with the central node as the core, and 1≤M≤N; S120, forming a comprehensive node corresponding to the central node based on the central node and all enterprise nodes whose association levels with the central node are from the 1st layer to the Mth layer; S130, deleting all enterprise nodes in the integrated node from the enterprise node set, and repeating step S110 based on the deleted enterprise node set until the enterprise node set is empty and all integrated nodes are obtained; S140, analyzing the connection relationship and correlation degree between the comprehensive nodes, and obtaining the enterprise-level knowledge graph corresponding to all enterprise nodes.

3. The enterprise node abnormality judgment method based on knowledge graph according to claim 2 is characterized in that: S140 includes the following steps: S141, for each integrated node, obtaining a connection relationship between the current integrated node and each other integrated node based on the association level between each enterprise node in the current integrated node and other enterprise nodes in the current integrated node, where the connection relationship is a connected relationship or a non-connected relationship; S142, obtaining a second degree of association between the current integrated node and each of the other integrated nodes based on the connection relationship between the current integrated node and each of the other integrated nodes, and the first degree of association between each enterprise node in the current integrated node and each of the other enterprise nodes at the first level of association and belonging to other integrated nodes; S143, according to the connection relationship and the second correlation degree between each comprehensive node and all other comprehensive nodes, obtain the enterprise-level knowledge graph corresponding to all enterprise nodes.

4. The enterprise node anomaly judgment method based on knowledge graph according to claim 3 is characterized in that: S141 includes the following steps: S1411, each enterprise node with an M-th association level with the central node in the current integrated node is regarded as an edge node in the current integrated node; S1412, determining each enterprise node in the other integrated nodes that has a first-level association level with each edge node as a related node corresponding to the current integrated node; S1413, for any related node corresponding to the current integrated node, determining the connection relationship between the current integrated node and the integrated node to which the current related node belongs as a connected relationship; S1414: Determine the connection relationship between the integrated node that does not include any related node in the current integrated node and the current integrated node as a non-connected relationship.

5. The enterprise node anomaly judgment method based on knowledge graph according to claim 4 is characterized in that: S142 includes the following steps: S1421, for the current integrated node, obtain a node pair consisting of each edge node and each corresponding related node; S1422: For any integrated node that is in a connected relationship with the current integrated node, a second degree of association between the current integrated node and any integrated node that is in a connected relationship with the current integrated node is obtained based on all node pairs corresponding to the current integrated node and any integrated node that is in a connected relationship with the current integrated node, and the first degree of association between the edge node and the related node in each node pair; S1423: Determine the preset degree value as the second correlation degree between the current integrated node and the integrated node that has a non-connected connection relationship with the current integrated node.

6. The enterprise node anomaly judgment method based on knowledge graph according to claim 5 is characterized in that: S20 includes the following steps: S210, based on the number of enterprise nodes included in each integrated node, taking the integrated node to which the abnormal enterprise node belongs as the starting node and taking the integrated node to which the target enterprise node belongs as the ending node; S220, obtaining a plurality of first candidate paths between a start node and an end node based on the connection relationship between the comprehensive nodes in the enterprise-level knowledge graph, wherein each first candidate path includes a plurality of comprehensive nodes in a sequential order; S230, acquiring all second correlation degrees included in each first candidate path according to the second correlation degrees between any two integrated nodes having a connected relationship; S240, obtaining a first priority corresponding to each first candidate path according to all second association degrees included in each first candidate path; S250: Determine the first candidate path corresponding to the highest first priority as the target path.

7. The enterprise node abnormality judgment method based on knowledge graph according to claim 6 is characterized in that: S30 includes the following steps: S310, for any integrated node, according to the sequence of the integrated nodes in the target path and all node pairs corresponding to the current integrated node, obtain a plurality of first key nodes and a plurality of second key nodes in the current integrated node; S320, obtaining the importance of the current integrated node based on the hierarchical relationships among all first key nodes and all second key nodes in the current integrated node, the enterprise nodes included in the current integrated node, and the first association levels between each enterprise node in the current integrated node and other enterprise nodes at the corresponding first association level; S330 , obtaining a target abnormality degree corresponding to the target enterprise node according to the reference abnormality degree of the abnormal enterprise node, the importance degree corresponding to each integrated node in the target path, and all second association degrees corresponding to the target path.

8. The enterprise node anomaly judgment method based on knowledge graph according to claim 7 is characterized in that: S310 includes the following steps: S311, for any integrated node, according to the order of the integrated nodes in the target path, determine the integrated node that is one step ahead of the current integrated node as the first reference node, and determine the integrated node that is one step behind the current integrated node as the second reference node; S312, determining each edge node corresponding to each related node corresponding to the current integrated node in the first reference node as a first key node corresponding to the current integrated node; S313 , determining the edge node corresponding to each related node corresponding to the current integrated node in the second reference node in the current integrated node as a second key node corresponding to the current integrated node.

9. The enterprise node anomaly judgment method based on knowledge graph according to claim 8 is characterized in that: S320 includes the following steps: S321, according to the hierarchical relationship between each enterprise node included in the current integrated node, obtain a plurality of second candidate paths between each first key node and each second key node in the current integrated node; S322, based on the first correlation degree between each enterprise node in the current integrated node and the corresponding other enterprise nodes at the first correlation level, obtain all first correlation degrees included in each second candidate path corresponding to the current integrated node; S323, acquiring a third correlation degree corresponding to each second candidate path corresponding to the current integrated node according to all first correlation degrees included in each second candidate path corresponding to the current integrated node; S324: Determine the sum of all third association degrees corresponding to the current integrated node as the importance degree corresponding to the current integrated node.

10. A knowledge graph-based enterprise node anomaly judgment system, characterized by: The enterprise node anomaly judgment system based on knowledge graph includes: A knowledge graph construction module is used to obtain an enterprise-level knowledge graph based on a number of comprehensive nodes corresponding to the enterprise node set, the connection relationship between the comprehensive nodes, and the second degree of association, wherein each comprehensive node is obtained by combining a number of enterprise nodes in the enterprise node set; A target path acquisition module is used to acquire a target path between an abnormal enterprise node and a target enterprise node in the enterprise node set according to the enterprise-level knowledge graph; a target abnormality degree acquisition module, configured to acquire a target abnormality degree corresponding to the target enterprise node based on the reference abnormality degree of the abnormal enterprise node, a plurality of integrated nodes in the target path, and all second association degrees corresponding to the target path; The node type judgment module is used to obtain the node type corresponding to the target enterprise node according to the target abnormality level corresponding to the target enterprise node and a preset abnormality level threshold, wherein the node type is an abnormal node or a non-abnormal node.

Images