Abnormal behavior recognition method and device, computer equipment and readable storage medium

Abstract

The invention relates to an abnormal behavior recognition method and device, computer equipment and a readable storage medium. The method comprises the steps of obtaining a relational data model associated with an interaction behavior; analyzing the relational data model by utilizing an entity relation graph corresponding to the relational data model, and determining a target connection field of the associated data table from the fields; constructing a blood relationship graph between the data tables according to the target connection field, and identifying a data flow direction associated with the interaction behavior in the blood relationship graph; according to the data flow direction and the target connection field, constructing a graph data model based on the relation between the directed attribute graph and the topological graph; and identifying timeliness characteristics of data in the relational data model, obtaining target business data from the relational data model according to a data processing strategy corresponding to the timeliness characteristics, and updating the graph data model according to the target business data to obtain an effective graph data model used for identifying the interaction behavior abnormity. By adopting the method, the efficiency and accuracy of abnormal behavior recognition can be improved.

Description

Technical Field

[0001] The present application relates to the field of big data processing technology, and in particular to an abnormal behavior identification method, apparatus, computer equipment, and readable storage medium. Background Art

[0002] With the development of computer and internet technologies, massive amounts of data are increasingly permeating every aspect of social life. Users' lives are increasingly intertwined with various entities in digital systems. This massive amount of user data can exist in different fields and forms. For example, user web browsing information, user communication conversation records, user shopping records on e-commerce platforms, and user-initiated payment behaviors are increasingly conducted online, necessitating the identification of abnormalities in these behaviors.

[0003] Taking resource transfer scenarios as an example, to ensure the proper use of resources, it's necessary to identify anomalies in user-initiated payment behaviors for items. Traditionally, this involves traversing different data tables based on preset anomaly indicator values, comparing the retrieved data with the preset anomaly indicator values, and determining anomaly results.

[0004] However, for business scenarios involving different data sources and data of different data dimensions, relevant technologies cannot meet the efficiency and accuracy requirements for abnormal behavior identification in such scenarios. Summary of the Invention

[0005] Based on this, it is necessary to provide an abnormal behavior identification method, device, computer equipment, computer-readable storage medium and computer program product that can improve the efficiency and accuracy of abnormal behavior identification in order to address the above technical problems.

[0006] In a first aspect, the present application provides a method for identifying abnormal behavior, comprising:

[0007] Acquire multiple relational data models and entity relationship diagrams from different data sources associated with the interactive behavior; each of the relational data models includes a data table, and the data table includes multiple fields;

[0008] Analyzing the relational data model using the entity relationship diagram to obtain a target connection field associated with the data table in the relational data model;

[0009] Constructing a blood relationship diagram of the data table according to the target connection field, and identifying the data flow direction of the interactive behavior in the blood relationship diagram;

[0010] Constructing a graph data model based on the relationship between a directed attribute graph and a topology graph according to the data flow direction and the key link fields;

[0011] Identify the timeliness characteristics of the data in the relational data model, obtain target business data from the relational data model according to the data processing strategy corresponding to the timeliness characteristics, update the graph data model according to the target business data, and obtain a valid graph data model for identifying abnormal interaction behavior.

[0012] In one embodiment, identifying the timeliness characteristics of data in the relational data model includes:

[0013] If there is historical batch data in the relational data model, the corresponding timeliness feature is the historical inventory feature, and the data processing strategy is the first data processing strategy;

[0014] If there is batch incremental data in the relational data model, the corresponding timeliness feature is the batch incremental feature, and the data processing strategy is the second data processing strategy;

[0015] If real-time data exists in the relational data model, the corresponding timeliness feature is a real-time feature, and the data processing strategy is a third data processing strategy;

[0016] The timeliness of the historical batch data is less than the timeliness of the batch incremental data, and the timeliness of the batch incremental data is less than the timeliness of the real-time data.

[0017] In one embodiment, the acquiring target business data from the relational data model according to the data processing strategy corresponding to the timeliness feature, and updating the graph data model according to the target business data to obtain a valid graph data model for identifying abnormal interaction behavior includes:

[0018] When the data processing strategy is the first data processing strategy, performing an associated query on the target connection field according to the preset data collection configuration data, and determining the corresponding query data from each of the relational data models;

[0019] Processing each of the query data to construct graph data model data that satisfies the graph data model;

[0020] The graph data model is updated according to the graph data model data to obtain multiple valid graph data models for identifying abnormal interaction behaviors.

[0021] In one embodiment, the method further comprises:

[0022] Synchronize the plurality of said valid graph data models to a target database of a data processing center and generate a data write event;

[0023] In response to the data writing event, multiple threads are called to write the valid graph data models into the graph database in batches.

[0024] In one embodiment, the acquiring target business data from the relational data model according to the data processing strategy corresponding to the timeliness feature, and updating the graph data model according to the target business data to obtain a valid graph data model for identifying abnormal interaction behavior includes:

[0025] In the case where the data processing strategy is the second data processing strategy, there is batch incremental data in the data of the relational data model, and the batch incremental data is parsed into incremental event data of the graph data model;

[0026] Converting the incremental event data to obtain graph vertex and edge data that satisfies the graph data model;

[0027] The corresponding graph data models are updated according to the graph point and edge data to obtain a valid graph data model for identifying abnormal interaction behaviors.

[0028] In one embodiment, the acquiring target business data from the relational data model according to the data processing strategy corresponding to the timeliness feature, and updating the graph data model according to the target business data to obtain a valid graph data model for identifying abnormal interaction behavior includes:

[0029] When the data processing strategy is the third data processing strategy, acquiring real-time data in the relational data model;

[0030] The real-time data is converted into graph vertex-edge data that satisfies the graph data model through a data model rule engine;

[0031] The corresponding graph data model is updated according to the graph point and edge data to obtain a valid graph data model for identifying abnormal interaction behaviors.

[0032] In one embodiment, the method further comprises:

[0033] Responding to an anomaly detection request, the anomaly detection request carrying an interactive behavior identifier;

[0034] If there is interaction data corresponding to the interaction behavior identifier in the valid graph data model, the first node corresponding to the initiator account in the interaction data in the valid graph data model is set as the target point, and the second node corresponding to the recipient account in the interaction data in the valid graph data model is set as the starting point;

[0035] Determine search data with the second node as a starting point and the first node as a target point from the valid graph data model, and obtain an abnormality recognition result of the target interactive behavior based on the search data.

[0036] In one embodiment, determining search data with the second node as a starting point and the first node as a target point from the valid graph data model, and obtaining an abnormality recognition result of the target interactive behavior based on the search data, includes:

[0037] Determine, from the valid graph data model, all traversal paths starting from the second node and ending at the first node;

[0038] Screening all the traversal paths to obtain a valid path;

[0039] If the valid path forms a ring link, identifying the number of nodes in the valid path and / or attribute information between the nodes;

[0040] If the number of nodes is greater than a preset number of nodes, and / or the resource quota in the attribute information of the node is greater than a preset quota, it is determined that the target interaction behavior is abnormal.

[0041] In a second aspect, the present application further provides an abnormal behavior identification device, comprising:

[0042] A data acquisition module, configured to acquire a plurality of relational data models and entity relationship diagrams from different data sources associated with the interaction behavior; each of the relational data models includes a data table, and each data table includes a plurality of fields;

[0043] A data analysis module, configured to analyze the relational data model using the entity relationship diagram to obtain a target connection field associated with the data table in the relational data model;

[0044] A relationship graph construction module, configured to construct a blood relationship graph of the data table according to the target connection field, and identify the data flow direction of the interactive behavior in the blood relationship graph;

[0045] A graph data model construction module, configured to construct a graph data model based on the relationship between the directed attribute graph and the topology graph according to the data flow direction and the key link fields;

[0046] Identify the timeliness characteristics of the data in the relational data model, obtain target business data from the relational data model according to the data processing strategy corresponding to the timeliness characteristics, update the graph data model according to the target business data, and obtain a valid graph data model for identifying abnormal interaction behavior.

[0047] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described above when executing the computer program.

[0048] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of any one of the methods described above when the computer program is executed by a processor.

[0049] In a fifth aspect, the present application also provides a computer program product, comprising a computer program, which implements the steps of any one of the methods described above when executed by a processor.

[0050] The above-mentioned abnormal behavior identification method, apparatus, computer device, computer-readable storage medium, and computer program product use entity relationship diagrams to analyze multi-source and multi-dimensional relational data models associated with interactive behaviors, obtain target key fields with data lineage relationships, and construct a lineage relationship graph based on this to identify the data flow direction associated with interactive behaviors in the lineage relationship graph; construct a graph data model based on the relationship between directed attribute graphs and topology graphs based on the data flow direction and target connection fields; identify the timeliness characteristics of data in the relational data model, obtain target business data from the relational data model based on the data processing strategy corresponding to the timeliness characteristics, and update the graph data model based on the target business data to obtain an effective graph data model for identifying abnormal interactive behaviors. In other words, the original relational database and table structure are refined to extract a topology model suitable for the graph database, and a graph data model with the relationship between directed attribute graphs and topology graphs is constructed. Abnormal behavior identification is achieved based on the graph data model. Compared with the recursive query based on the traditional database in the traditional technology, cross-database query and conversion of data tables with different structures are avoided, the processing steps are simplified, and the efficiency of abnormal behavior identification is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 This is a diagram of an application environment of an abnormal behavior identification method in one embodiment;

[0053] Figure 2 1 is a flow chart of a method for identifying abnormal behavior in one embodiment;

[0054] Figure 3 A partial schematic diagram of an entity relationship diagram in one embodiment;

[0055] Figure 4 A schematic diagram of a blood relationship diagram in one embodiment;

[0056] Figure 5 is a schematic diagram of a graph data model based on the relationship between a directed attribute graph and a topology graph in one embodiment;

[0057] Figure 6 A schematic diagram of a data solution processing scenario diagram in one embodiment;

[0058] Figure 7 A schematic diagram of a method for implementing abnormal behavior identification based on a valid graph data model in one embodiment;

[0059] Figure 8 This is an example diagram of a ring transaction in one embodiment;

[0060] Figure 9 A schematic diagram of the system architecture of an abnormal behavior identification method in one embodiment;

[0061] Figure 10 is a structural block diagram of an abnormal behavior identification device in one embodiment;

[0062] Figure 11 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0064] In recent years, the widespread adoption of new technologies such as mobile payments, big data, and cloud computing in the financial sector has boosted the efficiency of financial services and promoted digital financial inclusion. However, this has also brought about a series of financial security issues, such as unusual behavior related to resource transfers. Anti-money laundering, for example, is a key area of ​​compliance monitoring for financial institutions. Therefore, accurately detecting unusual behavior is a pressing issue.

[0065] Taking the payment industry as an example, identifying and preventing money laundering risks is a key issue that every payment company must address. Generally speaking, identifying money laundering requires first collecting business data (account data, corporate / individual authentication documents, transactions, behavior logs, order data, and more). This multi-dimensional, multi-layered, and multi-source data is cleansed and aggregated through a data system to generate effective supporting data for risk control and assessment systems (e.g., fund flow, transaction frequency, large-value transactions, and transaction networks). Key indicators such as transaction characteristics, customer characteristics, and behavioral characteristics are then compared to identify transactions and customers suspected of money laundering, such as ring transactions, dispersed transfers, and quick in-and-out transactions. Combined with early warning systems, these systems can provide preventative measures such as blocking and early warning. However, traditional anti-money laundering systems often face challenges in this process: cleaning and converting massive amounts of historical data from multiple dimensions and sources, resulting in complex and time-consuming processing and difficulty ensuring data accuracy. A single data collection approach struggles to handle the diverse business data output, making it difficult to ensure data consistency and timeliness. When traditional relational databases handle complex analysis of multi-source heterogeneous data, frequent cross-table JOIN operations result in large amounts of network I / O overhead, making it difficult for query optimizers to optimize execution plans for large-scale data. At the same time, the normalized storage model limits the flexibility of complex aggregate statistics, affecting the system's real-time analysis capabilities. Due to the limitations of the data model, traditional relational databases have difficulty processing circular capital flow analysis in real time, and recursive query performance drops sharply as the number of levels increases.

[0066] To address the low efficiency and accuracy of abnormal behavior identification in related technologies, we proposed an abnormal behavior identification method. This method restructures the traditional relational data model into a topological relationship model based on an attribute graph. This method uses a graph database instead of a traditional relational database for graph traversal queries. This replaces traditional multi-table JOIN queries, overcomes the performance bottleneck of deep-association queries on multi-source data, improves the system's query efficiency and overall performance, and ensures the accuracy of abnormal behavior identification.

[0067] The abnormal behavior identification method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 via a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104 or placed on the cloud or other network servers.

[0068] The terminal 102 obtains a relational data model associated with the interactive behavior from the server 104; the relational data model includes multiple data tables, each data table represents an entity, and the fields in the data table represent the attributes of the entity; an entity relationship diagram corresponding to the relational data model is determined, the relational data model is analyzed using the entity relationship diagram, and the target connection field of the associated data table is determined from the field; a blood relationship diagram between the data tables is constructed based on the target connection field, and the data flow direction associated with the interactive behavior in the blood relationship diagram is identified; a graph data model based on the relationship between the directed attribute graph and the topology graph is constructed based on the data flow direction and the target connection field; the timeliness characteristics of the data in the relational data model are identified, and the target business data is obtained from the relational data model according to the data processing strategy corresponding to the timeliness characteristics, and the graph data model is updated according to the target business data to obtain an effective graph data model for identifying abnormal interactive behaviors.

[0069] The terminal 102 may be, but is not limited to, various personal computers, laptops, smartphones, tablet computers, IoT devices, and portable wearable devices. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0070] In an exemplary embodiment, Figure 2 As shown, a method for identifying abnormal behavior is provided, which is applied to Figure 1 The terminal in FIG is taken as an example to illustrate the method, including the following steps 202 to 210. Among them:

[0071] Step 202: Obtain a relational data model associated with the interactive behavior; the relational data model includes multiple data tables, each data table represents an entity, and the fields in the data table represent attributes of the entity.

[0072] Among them, the interactive behavior can be a payment interactive behavior or a receiving behavior or sending behavior in a logistics scenario. The abnormality of the payment interactive behavior can be an abnormality in the path of the payment resource, and the abnormality of the receiving behavior and / or sending behavior in the logistics scenario can be an abnormality in the logistics path, which may be a package swap or an abnormality in the transportation path. This example takes the payment interactive behavior as an example to illustrate that the relational data model associated with the interactive behavior includes the existing business data and source table range that need to be converted into a graph data model. The source table range can include multiple data tables, and the data table can be a user table, an account table, a user operation behavior record table, a transaction table, a table related to user authentication related materials, and a supplier table. Each data table includes multiple fields, and the columns corresponding to the fields are used to represent the attributes of the entity (for example, the name and email address in the user table).

[0073] Step 204: determine an entity relationship diagram corresponding to the relational data model, analyze the relational data model using the entity relationship diagram, and determine a target connection field of the associated data table from the fields.

[0074] The entity-relationship diagram can be determined based on existing methods, which will not be elaborated here. The entity-relationship diagram is used to visualize data tables, their attributes, and the relationships between them in a relational data model. The target join field can be extracted from multiple data tables with the same or related meanings. For example, in a user payment scenario, "User ID" can be used as the target join field to link the user information table, payment record table, and product information table.

[0075] like Figure 3 The figure below shows a partial diagram of an entity-relationship diagram in an exemplary embodiment, illustrating the relationships between the authentication materials table, user table, transaction record table, user operation record table, and supplier table, as well as the attributes (i.e., fields) of each data table. Fields in the authentication materials table include user ID, document ID, document number, document type, and time. Fields in the account table include user ID, document ID, account type, account number, and creation time. Fields in the transaction record table include transaction ID, user ID, paying account ID, receiving account ID, transaction amount, and transaction time. Fields in the user operation record table include user ID, login device ID, IP address, region, and time. Fields in the user table include user ID, mobile phone number, email address, and creation time. Fields in the supplier table include merchant ID, mobile phone number, email address, and creation time. Based on the entity-relationship diagram, it can be determined that the key fields in the user table, account table, user operation record table, and transaction table are user ID and account ID, which are the target connection fields of the current relational data model.

[0076] Step 206: construct a blood relationship diagram between the data tables based on the target connection field, and identify the data flow associated with the interactive behavior in the blood relationship diagram.

[0077] Among them, the blood relationship diagram can be a graphical representation method for showing the dependency or association relationship between data tables. Exemplarily, the blood relationship diagram can be implemented in the form of a directed acyclic graph (DAG), where the nodes represent data tables and the edges represent the association paths between data tables. By treating each data table as a node in the graph and determining the association relationship between data tables based on the target connection field, a complete blood relationship diagram is finally generated, which can clearly present the dependency structure between data tables and facilitate subsequent data flow analysis.

[0078] Data flow can refer to the data transmission path between different data tables. In the payment scenario, the user's payment amount may flow from the user table to the account table, and then to the transaction record table. Figure 4 As shown, a schematic diagram of a blood relationship diagram is provided, which shows the blood relationship between the user table, supplier table, account table and transaction record table. Figure 3 The fields shown are the same. By constructing a lineage relationship diagram, it can be identified that the key data flow of the current transaction is from the user table to the account table, and then to the transaction record table.

[0079] Step 208: Construct a graph data model based on the relationship between the directed attribute graph and the topology graph according to the data flow direction and the target connection field.

[0080] Among them, the method for determining nodes in the graph data model can be: if the data fields in the data table are independent entities in business logic, directly map the data table to the nodes in the graph data model, for example, directly map the user table to the user node in the graph data model.

[0081] If a data table contains multiple entities of different types, the table can be split into multiple nodes in a graph data model to better represent the relationships between these entities. The data table is split and mapped to multiple nodes in the graph data model. For example, an order table may contain order information, customer information, and product information. These can be split into "order nodes," "customer nodes," and "product nodes," respectively. The edges between nodes can be understood as foreign key relationships between tables.

[0082] The graph data model can be a general transaction graph data model that complies with the payment industry. For example, Figure 5 As shown in the figure, it is a schematic diagram of a graph data model based on the relationship between a directed attribute graph and a topological graph, wherein the user point contains basic user information, and its attributes include mobile phone number, email address, user ID, and creation time; the merchant point contains basic user information; the account point contains basic transfer and payment information, and its attributes include: user ID, account ID, payment account number, and user type; the transaction point contains basic transaction information, and its attributes include: user ID, payment account ID, payment account ID, transaction amount, transaction time, transaction type, and authentication material points, etc.

[0083] Step 210: Identify the timeliness characteristics of the data in the relational data model, obtain target business data from the relational data model according to the data processing strategy corresponding to the timeliness characteristics, update the graph data model according to the target business data, and obtain a valid graph data model for identifying abnormal interaction behaviors.

[0084] It's important to note that when extracting, converting, and loading massive amounts of historical and real-time incremental data into the target system, complex data cleansing rules and conversion logic can impact data accuracy, timeliness, and consistency. Therefore, it's important to determine the appropriate data processing strategies based on the data's timeliness.

[0085] Timeliness features include historical inventory, batch increments, and real-time. The corresponding data processing strategies are inventory data processing mechanism, batch increment data processing mechanism, and real-time increment data processing mechanism. The inventory data processing mechanism uses a distributed data cleaning framework to achieve intelligent data sharding and parallel processing. It also integrates a rules engine to perform multi-dimensional verification of processing results, improve processing efficiency through parallel computing, and ensure data consistency.

[0086] The batch incremental data processing mechanism plans processing tasks in advance, adopts an event pre-generation model, uses preset concurrent processing and parsing architecture technology to maximize system processing capabilities, introduces a task scheduling optimizer, rationally maximizes the use of system resources, and improves batch data processing capabilities.

[0087] The real-time incremental data processing mechanism, namely the binlog subscription mechanism based on the data processing center, realizes real-time data capture, integrates the data model mapping rule engine, supports flexible model conversion, and introduces a data quality inspection engine to ensure data accuracy.

[0088] The above three mechanisms all implement flushable cleaning mechanisms, support data re-cleaning, and meet the needs of different data processing scenarios, greatly improving the accuracy and timeliness of data cleaning and ensuring data consistency.

[0089] Anomalous behavior identification based on an effective graph data model can be achieved by using a graph loop detection algorithm to identify closed-loop transaction patterns in real time and analyze the flow of resources to determine whether payment interactions are abnormal. Compared to recursive queries in traditional relational databases, this approach leverages the node-first traversal characteristics of graph databases and the linear correlation between query performance and path depth. This effectively solves the performance degradation of traditional recursive queries as the depth of the hierarchy increases, significantly improving the efficiency of analyzing complex interactive behavior networks.

[0090] In the above-mentioned abnormal behavior identification method, an entity relationship diagram is used to analyze the multi-source and multi-dimensional relational data model associated with the interactive behavior, and the target key fields with data lineage relationships are obtained. On this basis, a lineage relationship diagram is constructed to identify the data flow direction associated with the interactive behavior in the lineage relationship diagram; according to the data flow direction and the target connection field, a graph data model based on the relationship between the directed attribute graph and the topology graph is constructed; the timeliness characteristics of the data in the relational data model are identified, and the target business data is obtained from the relational data model according to the data processing strategy corresponding to the timeliness characteristics. The graph data model is updated according to the target business data to obtain an effective graph data model for identifying abnormal interactive behavior. In other words, the original relational database and table structure are refined to extract a topology model suitable for the graph database, and a graph data model with the relationship between the directed attribute graph and the topology graph is constructed. Abnormal behavior identification is realized based on the graph data model. Compared with the recursive query based on the traditional database in the traditional technology, cross-database query and conversion of data tables with different structures are avoided, the processing steps are simplified, and the efficiency of abnormal behavior identification is improved.

[0091] In an exemplary embodiment, identifying the timeliness characteristics of data in a relational data model includes:

[0092] If there is historical batch data in the relational data model, the corresponding timeliness feature is the historical inventory feature, and the data processing strategy is the first data processing strategy; if there is batch incremental data in the relational data model, the corresponding timeliness feature is the batch incremental feature, and the data processing strategy is the second data processing strategy; if there is real-time data in the relational data model, the corresponding timeliness feature is the real-time feature, and the data processing strategy is the third data processing strategy.

[0093] The timeliness of historical batch data is less than that of batch incremental data, which in turn is less than that of real-time data. The first data processing strategy is the existing data processing mechanism, the second data processing strategy is the batch incremental data processing mechanism, and the third data processing strategy is the real-time incremental data processing mechanism.

[0094] Batch incremental data is a data scenario beyond existing historical data and real-time data. For example, after the risk management system is launched, after the existing historical data processing is completed and before the real-time data processing system is activated, the business system generates new incremental data without downtime. This is batch incremental data.

[0095] In the above embodiments, corresponding data processing mechanisms are adopted for different scene data to ensure the accuracy and precision of the data.

[0096] The following are specific processing methods for converting corresponding data into graph data models based on different data processing strategies, such as Figure 6 As shown, it is a scenario diagram of a data solution processing scheme in an exemplary embodiment, including a first data processing strategy (i.e., a historical inventory data processing scheme), a second data processing strategy (i.e., a batch incremental data processing scheme), and a third data processing strategy (i.e., a real-time data processing scheme), where time 1 is later than time 2.

[0097] Case 1: When the data processing strategy is the first data processing strategy, according to the preset data collection configuration data, an associated query is performed on the target connection field, and the corresponding query data is determined from each relational data model; each query data is processed to construct graph data model data that meets the graph data model; the graph data model is updated according to the graph data model data to obtain multiple valid graph data models for identifying abnormal interaction behaviors.

[0098] Among them, the preset collection configuration includes determining the data source of the collection data source of the data processing component based on the relational data model, and setting multiple data processing tasks in the data processing component based on the relational data model and the graph data model. The data processing tasks include performing an associated query on the target connection field of the source table of the relational data model to obtain query data, and pre-processing the query data through preset data cleaning and / or preset filtering rules to construct graph data model data that meets the graph data model, that is, graph node edge data.

[0099] Furthermore, the preset data cleaning and / or preset screening rules are determined based on the target graph database. The data processing component may be a distributed big data processing tool MaxComputer. This example is illustrated using MaxComputer as the data collection tool.

[0100] When using data processing components, such as MaxComputer's data processing tasks to perform data cleansing and transformation, you can use time as the sharding key and, based on its intelligent partitioning and data storage capabilities, orchestrate the execution order of data development tasks to meet data order dependencies. It should be noted that data development tasks refer to constructing graph node and edge data from historical inventory data.

[0101] Optionally, the graph data model is updated according to the graph data model data to obtain a valid graph data model for identifying abnormal interaction behaviors. The validity of the graph data model data can be verified. After verification by the MaxComputer verification task, the graph data model data is used to update the nodes and edges in the graph data model to obtain a valid graph data model.

[0102] On this basis, multiple valid graph data models are further synchronized to the target library of the data processing center to generate data write events; in response to the data write events, multiple threads are called to write each valid graph data model into the graph database in batches.

[0103] For example, MaxCompute's data synchronization capabilities can be leveraged to push multiple valid graph data models to the target database in the data processing center, generating data write events. This trigger mode notifies the data processing center, and then batch writes the data to the graph database using multi-threaded tasks. This allows for online cleansing, conversion, and online import of existing data. Furthermore, MaxCompute also supports offline downloading of constructed valid graph data models and importing them into the graph database, completing online cleansing, conversion, and offline import of historical existing data. The specific implementation depends on the volume of initialized business data and is not detailed here.

[0104] In addition, it should be noted that when developing data tasks based on the data processing component MaxCompute to produce graph data models, due to the characteristics of graph databases, all label IDs must be globally unique. In other words, all point IDs, or node IDs, must be globally unique. In this case, business data must be orchestrated in advance. This can be achieved by sampling a universal MaxCompute unique ID solution:

[0105] The total length of the ID is 16 characters, for example: 1001000000000001.

[0106] Composition rules: The first 6 digits of the custom business number segment (100100: point, 200100: edge) + the last 10 digits are the current number of rows. If the number is less than 10, the leading 0 is added (0000000001). The current rules can meet the requirements of 100,000 different business types of label points and edges. The number of historical data in a single table is 10 billion to generate a unique ID.

[0107] Generation method: Custom number segments are incremented based on dependency order. Data rows start at 1 for a single table and increment by +1. The data is retrieved using the ROW_NUMBER() window function in DataWorks. The generated SQL example is: SELECT CAST(CONCAT('100100',LPAD(ROW_NUMBER() OVER(ORDER BY RAND()),10,'0')) AS BIGINT).

[0108] The function descriptions in the sample SQL are as follows: the LPA function fills insufficient digits with 0s, the CONCAT function concatenates, the CAST function converts STRING to BIGINT, and ROW_NUMBER() is a window function that obtains the number of rows.

[0109] Case 2: When the data processing strategy is the second data processing strategy, there is batch incremental data in the data of the relational data model, and the batch incremental data is parsed into incremental event data of the graph data model; the incremental event data is converted and processed to obtain graph point and edge data that meets the graph data model; the corresponding graph data models are updated according to the graph point and edge data to obtain an effective graph data model for identifying abnormal interaction behavior.

[0110] For example, based on MaxComputer's incremental data recognition and time slicing capabilities, a business relational data model for batch incremental data is generated, and based on pre-entered data synchronization rules, the batch incremental data is synchronized to the business relational data model. Based on the scheduled tasks of the data processing center system, the system memory cache data queue is fully utilized, and combined with multi-threading, the batch incremental data is quickly parsed into incremental event data of the graph data model. Based on the task scheduling of the data processing center, incremental events trigger scheduled cleaning and conversion tasks, which regularly scan event data. After passing through the data model mapping rule engine, the event data is converted into graph point and edge data. The corresponding graph data models are updated according to the graph point and edge data to obtain a valid graph data model for identifying abnormal interactive behavior, and the valid graph data model is stored in the graph database, thus completing the online cleaning, conversion and online storage of batch incremental business data in the graph database.

[0111] Case 3: When the data processing strategy is the third data processing strategy, real-time data in the relational data model is obtained; the real-time data is converted into graph point and edge data that satisfies the graph data model through the data model rule engine; the corresponding graph data model is updated according to the graph point and edge data to obtain an effective graph data model for identifying abnormal interaction behaviors.

[0112] For example, the terminal's data center subscribes to the binLog of the business data source to perceive incremental business data changes in real time. The data model rule engine then converts the real-time data into graph edge data. After conversion, the quality check engine is triggered to complete data anomaly inspection and processing. The graph data processing engine then adds or updates graph edge data based on the graph edge data, updating the corresponding graph data model to obtain a valid graph data model for identifying anomalies in interactive behavior, thus completing real-time data processing. Data anomaly inspection and processing, such as identifying erroneous and duplicate data, automatically correcting erroneous data, and deleting duplicate data, ensures data accuracy.

[0113] In the above embodiment, by sampling different processing methods for historical inventory data, batch incremental data processing, and real-time data processing, this approach avoids the problem of complex data cleansing rules and conversion logic affecting data accuracy, timeliness, and consistency during the extraction, conversion, and loading of massive amounts of historical and real-time incremental data into the target system. Furthermore, this approach not only meets the practical implementation requirements of the payment industry for converting business data into graph data models, but is also applicable to data cleansing and conversion in other business scenarios.

[0114] Based on the above processing steps, a valid graph data model is obtained. The following provides a method for realizing abnormal behavior recognition based on the valid graph data model, such as Figure 7 As shown, the following steps are included:

[0115] Step 702: respond to an anomaly detection request, where the anomaly detection request carries an interactive behavior identifier.

[0116] It's important to note that abnormal behavior identification can be a form of circular transaction identification. Therefore, effective circular transaction identification requires the establishment of a near-real-time processing system at the terminal. This system's basic modules include transaction risk control detection, risk control decision-making, and risk control rules. During data processing, while automatically triggering transaction risk control detection, it also provides external access to risk detection via an API, meeting detection requirements across multiple scenarios.

[0117] For example, in a payment scenario, in response to an anomaly detection request that carries an interaction behavior identifier, a specific transaction is detected to determine whether it is abnormal. Transaction data related to the specific transaction is obtained, including the initiator's account and the recipient's account.

[0118] Step 704: If there is interaction data corresponding to the interaction behavior identifier in the valid graph data model, the first node corresponding to the initiator account in the interaction data in the valid graph data model is set as the target point, and the second node corresponding to the recipient account in the interaction data in the valid graph data model is set as the starting point.

[0119] For example, if a valid graph data model contains interaction data corresponding to an interaction behavior identifier—that is, nodes and edges related to the initiator and recipient accounts—then transaction risk control is triggered, first triggering a loop transaction check. Leveraging the graph database's native traversal capabilities, the first node corresponding to the initiator account in the valid graph data model is used as the target point, and the second node corresponding to the recipient account in the valid graph data model is used as the starting point to search for all possible connection paths. It should be noted that the maximum path length can be limited, for example, to a maximum of 5 hops, to avoid overly large search spaces.

[0120] Optionally, in an exemplary embodiment, if there is no interaction data corresponding to the interaction behavior identifier in the effective graph data model, it means that the interaction behavior is a new transaction. The effective graph data model is updated according to the data processing strategy corresponding to the real-time data to obtain an updated effective graph data model, that is, an edge relationship corresponding to the new transaction is created in the effective graph data model.

[0121] Step 706 : determining search data starting from the second node and targeting the first node from the valid graph data model, and obtaining an abnormality recognition result of the target interactive behavior based on the search data.

[0122] The search data includes all traversal paths starting from the second node and ending at the first node, as well as attribute information of edges between nodes in the traversal paths, including transaction time and transaction amount, etc. Target Interaction Behavior Interaction Behavior Identifier corresponds to the interaction behavior.

[0123] Exemplarily, search data with the second node as the starting point and the first node as the target point is determined from the valid graph data model, and the search data is identified for anomalies according to pre-entered risk control rules through the risk control decision engine. When the preset abnormal conditions are met, an abnormal prompt is generated and / or the interactive behavior is interrupted.

[0124] Optionally, in an exemplary embodiment, a method is provided for obtaining an abnormality identification result of a target interactive behavior based on search data, including: determining all traversal paths with a second node as the starting point and a first node as the target point from a valid graph data model; screening all traversal paths to obtain a valid path; if the valid path constitutes a ring link, identifying the number of nodes in the valid path (which can be understood as the path length) and / or the attribute information between the nodes; if the number of nodes is greater than a preset number of nodes, and / or the resource amount in the attribute information of the node is greater than a preset amount, determining that the target interactive behavior is abnormal.

[0125] Exemplarily, search data with the second node as the starting point and the first node as the target point is determined from the valid graph data model, and all traversal paths in the search data are screened to obtain a valid path; if the valid path constitutes a ring link, the search data, the number of nodes in the valid path, and / or the attribute information between the nodes (such as the rationality of the transaction time sequence or the transaction amount relationship in the nodes) are identified through the risk control decision engine according to the pre-entered risk control rules. If the number of nodes is greater than the preset number of nodes, and / or the resource amount in the attribute information of the node is greater than the preset amount, the target interaction behavior is determined to be abnormal.

[0126] For example, a query solution using the declarative graph query language Cypher can be used to find all possible paths from the target account of a new transaction back to the transaction's origin account, while also considering that the transaction time is limited to 1-2 months, the transaction amount fluctuation does not exceed 10%, and the maximum path length is limited to 5 hops. Figure 8 As shown, it is an example diagram of a circular transaction in an exemplary embodiment, including five accounts ABCDE, showing the flow direction and amount of funds between the five accounts.

[0127] In the above embodiment, by utilizing an effective graph data model, the problem of difficulty in identifying the flow of funds in circular transactions and the performance problem caused by circular queries when using traditional database queries are solved, and the efficiency of identifying circular transactions is improved by using a reasonable real-time query method.

[0128] In an exemplary embodiment, a method for identifying abnormal behavior is provided, comprising the following steps:

[0129] Obtain a relational data model associated with the interactive behavior; the relational data model includes multiple data tables, each data table represents an entity, and the fields in the data table represent the attributes of the entity; determine the entity relationship diagram corresponding to the relational data model, use the entity relationship diagram to analyze the relational data model, and determine the target connection field of the associated data table from the field; construct a lineage relationship diagram between the data tables based on the target connection field, and identify the data flow direction associated with the interactive behavior in the lineage relationship diagram; construct a graph data model based on the relationship between the directed attribute graph and the topology graph based on the data flow direction and the target connection field; identify the timeliness characteristics of the data in the relational data model, obtain the target business data from the relational data model according to the data processing strategy corresponding to the timeliness characteristics, update the graph data model according to the target business data, and obtain an effective graph data model for identifying abnormal interactive behavior.

[0130] In response to the anomaly detection request, the anomaly detection request carries an interaction behavior identifier; if there is no interaction data corresponding to the interaction behavior identifier in the valid graph data model, it means that the interaction behavior is a new transaction, and the valid graph data model is updated according to the data processing strategy corresponding to the real-time data to obtain an updated valid graph data model, that is, an edge relationship corresponding to the new transaction is created in the valid graph data model.

[0131] If there is interaction data corresponding to the interaction behavior identifier in the valid graph data model, the first node corresponding to the initiator account in the interaction data in the valid graph data model is taken as the target point, and the second node corresponding to the recipient account in the interaction data in the valid graph data model is taken as the starting point; search data with the second node as the starting point and the first node as the target point is determined from the valid graph data model, and the abnormal identification result of the target interaction behavior is obtained based on the search data.

[0132] The following are applications based on the above abnormal behavior identification method, including the following:

[0133] Business Background: User A, an individual merchant, places an order on a cross-border trading platform. Merchant B provides the goods for the transaction. User A completes the payment through a cross-border payment company. The cross-border payment company needs to identify whether this payment from A to B is a ring-shaped transaction pattern suspected of money laundering. Business Requirements: Historical user and transaction data, including user A, merchant B, receiving and paying accounts, and transaction history.

[0134] The specific identification includes the following steps:

[0135] S11: Complete the construction of the graph data model: Summarize the business data and business requirements of the relational database and design a graph data model that suits the current scenario. For example, by sorting out and summarizing the relationships between the user table, account table, and transaction record table, we can obtain a graph transaction data model: user points, account points, transaction points, and also obtain the transaction relationship edge data model (starting point account A - ending point account B).

[0136] S12: Use MaxCompute to write a data development task to generate point and edge data based on key attributes of existing historical business data, and generate a unique ID for the data during the output process. This is implemented using the solution described above.

[0137] S13: Write data verification development tasks in MaxCompute based on pre-determined data verification rules to verify the validity of the generated graph data.

[0138] S14: Use MaxCompute's data synchronization capabilities to synchronize the generated valid graph data to the target database in the data center. Through the trigger mode, notify the data processing center to complete the graph data and write it into the graph database through the graph database API.

[0139] S15: Use MaxCompute's incremental data recognition capabilities to synchronize batch incremental business data, such as transaction data, to the data processing center library.

[0140] S16: The data center uses scheduled tasks, fully utilizes the system memory cache data queue, and combines multi-threading to quickly parse batch incremental business data into incremental event data of the graph data model.

[0141] S17: Relying on the task scheduling of the data processing center, incremental events trigger scheduled cleaning and conversion tasks, regularly scan event data, and convert the event data into graph point and edge data through the data model mapping rule engine to complete the conversion of batch incremental data. Then, through the graph database API, the graph point and edge data are written into the graph database.

[0142] S18: The data center subscribes to the binLog of the business data source to perceive the changes in business incremental data in real time;

[0143] S19: The business data is converted into graph point and edge data through the data model rule engine;

[0144] S20: triggering the quality check engine at the same time to remove redundant and duplicate data to ensure data accuracy;

[0145] S21: Based on the results of the graph data difference comparison engine, the graph point and edge data are added or updated. For example, for a new transaction business event, after parsing and conversion, the account point, transaction point, and transaction edge are obtained. If it is found that there is no transaction edge between the starting account point and the end account, a new transaction edge is added.

[0146] S22: When the starting account A of the new transaction completes the establishment of a transaction edge with the end account B, the transaction risk control detection is triggered. First, the loop transaction check is triggered, and the end account B is checked as the starting account of the check statement, and the transaction starting account A is checked as the end account of the check statement, and real-time identification of environmental transactions is performed.

[0147] S23: Finally, based on the query results of the circular transaction link, the pre-set risk control rules are obtained through risk control decision-making to determine the risk level of the current transaction circular transaction and whether there is suspicion of anti-money laundering transactions, so as to implement measures such as warnings.

[0148] In this embodiment, the original relational database and table structure are refined to obtain a topological model suitable for the graph database, and a graph data model with the relationship between the attribute graph and the topological graph is constructed. Abnormal behavior recognition is implemented based on the graph data model. By utilizing an effective graph data model, the problem of difficulty in identifying the flow of funds in circular transactions and the performance problems caused by circular queries when using traditional database queries are solved. By using a reasonable real-time query method, the recognition efficiency of circular transactions is improved.

[0149] The following is the system architecture based on the above abnormal behavior recognition, such as Figure 9 As shown, the above abnormal behavior recognition method can be based on Figure 9The system architecture shown in the figure includes data sources, a distributed data processing framework, and a data processing center. Data sources include multiple business data sources related to interactive behavior, including account data, KYC information, transaction data, order data, and behavior logs. The distributed data processing framework performs data extraction, data cleansing, rule validation, and data push. The data processing center processes the data pushed by the distributed processing framework. The data processing center includes a data service layer, a real-time processing system, a monitoring and early warning layer, a coordination and scheduling layer, a data processing layer, and a data support layer. The data service layer includes reporting, data analysis, and business applications, while the real-time processing system includes transaction risk control detection, risk control decision-making, and risk control rules. The monitoring and early warning layer includes system monitoring and early warning management. The coordination and scheduling layer includes the event management center and the task scheduling center. The data processing layer includes a real-time processing engine, an offline computing engine, a data cleansing engine, a data model rule engine, a quality inspection engine, and a storage adaptation engine. The data support layer includes a graph service engine, a vector service engine, and a MySQL engine.

[0150] Based on the distributed data processing framework, data is extracted from multiple data sources in the manner defined above, resulting in historical inventory data, batch incremental data, and real-time data. The extracted data is then pushed to the data processing center, which processes the acquired data based on the aforementioned method to identify abnormal behavior.

[0151] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0152] Based on the same inventive concept, the present application also provides an abnormal behavior identification device for implementing the abnormal behavior identification method described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more abnormal behavior identification device embodiments provided below can be found in the above-mentioned limitations of the abnormal behavior identification method and will not be repeated here.

[0153] In an exemplary embodiment, Figure 10 As shown, an abnormal behavior identification device is provided, including: a data acquisition module 1002, a data analysis module 1004, a relationship graph construction module 1006 and a graph data model construction module 1008, wherein:

[0154] The data acquisition module 1002 is used to acquire a relational data model associated with the interactive behavior; the relational data model includes multiple data tables, each data table represents an entity, and the fields in the data table represent attributes of the entity.

[0155] The data analysis module 1004 is used to determine an entity relationship diagram corresponding to the relational data model, analyze the relational data model using the entity relationship diagram, and determine the target connection field of the associated data table from the fields.

[0156] The relationship diagram construction module 1006 is used to construct a blood relationship diagram of the data table according to the target connection field and identify the data flow direction of the interactive behavior in the blood relationship diagram.

[0157] A graph data model construction module 1008 is used to construct a graph data model based on the relationship between the directed attribute graph and the topology graph according to the data flow direction and the target connection field;

[0158] Identify the timeliness characteristics of data in the relational data model, obtain the target business data from the relational data model according to the data processing strategy corresponding to the timeliness characteristics, update the graph data model according to the target business data, and obtain an effective graph data model for identifying abnormal interaction behaviors.

[0159] The above-mentioned abnormal behavior identification device uses an entity relationship diagram to analyze the multi-source and multi-dimensional relational data model associated with the interactive behavior, obtains the target key field with data lineage relationship, and constructs a lineage relationship diagram on this basis to identify the data flow direction associated with the interactive behavior in the lineage relationship diagram; according to the data flow direction and the target connection field, a graph data model based on the relationship between the directed attribute graph and the topology graph is constructed; the timeliness characteristics of the data in the relational data model are identified, and the target business data is obtained from the relational data model according to the data processing strategy corresponding to the timeliness characteristics. The graph data model is updated according to the target business data to obtain an effective graph data model for identifying abnormal interactive behavior. In other words, the original relational database and table structure are refined to extract a topology model suitable for the graph database, and a graph data model with the relationship between the directed attribute graph and the topology graph is constructed. Abnormal behavior identification is realized based on the graph data model. Compared with the recursive query based on the traditional database in the traditional technology, cross-database query and conversion of data tables with different structures are avoided, the processing steps are simplified, and the efficiency of abnormal behavior identification is improved.

[0160] In an exemplary embodiment, the graph data model construction module 1008 is further configured to: if there is historical batch data in the relational data model, then the corresponding timeliness feature is the historical inventory feature, and the data processing strategy is the first data processing strategy;

[0161] If there is batch incremental data in the relational data model, the corresponding timeliness feature is the batch incremental feature, and the data processing strategy is the second data processing strategy;

[0162] If there is real-time data in the relational data model, the corresponding timeliness feature is the real-time feature, and the data processing strategy is the third data processing strategy;

[0163] The timeliness of historical batch data is less than that of batch incremental data, and the timeliness of batch incremental data is less than that of real-time data.

[0164] In an exemplary embodiment, the graph data model construction module 1008 is further configured to, when the data processing strategy is the first data processing strategy, perform an association query on the target connection field according to the preset data collection configuration data, and determine the corresponding query data from each relational data model;

[0165] Process each query data and construct graph data model data that satisfies the graph data model;

[0166] The graph data model is updated according to the graph data model data to obtain multiple valid graph data models for identifying abnormal interaction behaviors.

[0167] In an exemplary embodiment, the graph data model construction module 1008 is further configured to synchronize multiple valid graph data models to a target repository in a data processing center and generate a data write event;

[0168] In response to a data write event, multiple threads are called to write each valid graph data model into the graph database in batches.

[0169] In an exemplary embodiment, the graph data model construction module 1008 is further configured to, when the data processing strategy is the second data processing strategy, parse the batch incremental data into incremental event data of the graph data model when there is batch incremental data in the data of the relational data model;

[0170] Convert incremental event data to obtain graph vertex and edge data that meets the graph data model;

[0171] The corresponding graph data models are updated according to the graph point and edge data to obtain an effective graph data model for identifying abnormal interaction behaviors.

[0172] In an exemplary embodiment, the graph data model construction module 1008 is further configured to obtain real-time data in the relational data model when the data processing strategy is the third data processing strategy;

[0173] The data model rule engine converts real-time data into graph vertex and edge data that satisfies the graph data model;

[0174] The corresponding graph data model is updated according to the graph point and edge data to obtain an effective graph data model for identifying abnormal interaction behaviors.

[0175] In an exemplary embodiment, the abnormal behavior identification method further includes an identification module, the identification module being configured to respond to an abnormality detection request, the abnormality detection request carrying an interactive behavior identifier;

[0176] If there is interaction data corresponding to the interaction behavior identifier in the valid graph data model, the first node corresponding to the initiator's account in the valid graph data model in the interaction data is set as the target point, and the second node corresponding to the recipient's account in the valid graph data model in the interaction data is set as the starting point;

[0177] Determine search data with the second node as the starting point and the first node as the target point from the valid graph data model, and obtain an abnormality recognition result of the target interactive behavior based on the search data.

[0178] an identification module for determining, from a valid graph data model, all traversal paths starting from the second node and ending at the first node; screening all traversal paths to obtain valid paths; and identifying the number of nodes in the valid path and / or attribute information between the nodes if the valid path forms a ring link;

[0179] If the number of nodes is greater than the preset number of nodes, and / or the resource quota in the attribute information of the node is greater than the preset quota, it is determined that the target interaction behavior is abnormal.

[0180] Each module in the abnormal behavior identification device described above may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in hardware form, or may be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0181] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 11As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, an abnormal behavior identification method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0182] Those skilled in the art will understand that Figure 11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0183] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0184] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0185] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0186] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0187] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile memory and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a programmable logic unit (PLC), a data processing logic unit based on quantum computing, an artificial intelligence (AI) processor, and the like.

[0188] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0189] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for identifying abnormal behavior, characterized in that: The method comprises: Acquire a relational data model associated with the interactive behavior; the relational data model includes a plurality of data tables, each of the data tables represents an entity, and the fields in the data tables represent attributes of the entity; Determining an entity relationship diagram corresponding to the relational data model, analyzing the relational data model using the entity relationship diagram, and determining a target connection field associated with the data table from the fields; Constructing a kinship diagram between the data tables according to the target connection field, and identifying a data flow direction associated with the interactive behavior in the kinship diagram; Constructing a graph data model based on the relationship between a directed attribute graph and a topology graph according to the data flow direction and the target connection field; Identify the timeliness characteristics of the data in the relational data model, obtain target business data from the relational data model according to the data processing strategy corresponding to the timeliness characteristics, update the graph data model according to the target business data, and obtain a valid graph data model for identifying abnormal interaction behavior.

2. The method according to claim 1, characterized in that The identifying the timeliness characteristics of the data in the relational data model includes: If there is historical batch data in the relational data model, the corresponding timeliness feature is the historical inventory feature, and the data processing strategy is the first data processing strategy; If there is batch incremental data in the relational data model, the corresponding timeliness feature is the batch incremental feature, and the data processing strategy is the second data processing strategy; If real-time data exists in the relational data model, the corresponding timeliness feature is a real-time feature, and the data processing strategy is a third data processing strategy; The timeliness of the historical batch data is less than the timeliness of the batch incremental data, and the timeliness of the batch incremental data is less than the timeliness of the real-time data.

3. The method according to claim 2, characterized in that The step of acquiring target business data from the relational data model according to the data processing strategy corresponding to the timeliness feature, and updating the graph data model according to the target business data to obtain a valid graph data model for identifying abnormal interaction behaviors includes: When the data processing strategy is the first data processing strategy, performing an associated query on the target connection field according to the preset data collection configuration data, and determining the corresponding query data from each of the relational data models; Processing each of the query data to construct graph data model data that satisfies the graph data model; The graph data model is updated according to the graph data model data to obtain multiple valid graph data models for identifying abnormal interaction behaviors.

4. The method according to claim 3, characterized in that The method further comprises: Synchronize the plurality of said valid graph data models to a target database of a data processing center and generate a data write event; In response to the data writing event, multiple threads are called to write the valid graph data models into the graph database in batches.

5. The method according to claim 2, characterized in that The step of acquiring target business data from the relational data model according to the data processing strategy corresponding to the timeliness feature, and updating the graph data model according to the target business data to obtain a valid graph data model for identifying abnormal interaction behaviors includes: In the case where the data processing strategy is the second data processing strategy, there is batch incremental data in the data of the relational data model, and the batch incremental data is parsed into incremental event data of the graph data model; Converting the incremental event data to obtain graph vertex and edge data that satisfies the graph data model; The corresponding graph data models are updated according to the graph point and edge data to obtain a valid graph data model for identifying abnormal interaction behaviors.

6. The method according to claim 2, characterized in that The step of acquiring target business data from the relational data model according to the data processing strategy corresponding to the timeliness feature, and updating the graph data model according to the target business data to obtain a valid graph data model for identifying abnormal interaction behaviors includes: When the data processing strategy is the third data processing strategy, acquiring real-time data in the relational data model; The real-time data is converted into graph vertex-edge data that satisfies the graph data model through a data model rule engine; The corresponding graph data model is updated according to the graph point and edge data to obtain a valid graph data model for identifying abnormal interaction behaviors.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Responding to an anomaly detection request, the anomaly detection request carrying an interactive behavior identifier; If there is interaction data corresponding to the interaction behavior identifier in the valid graph data model, the first node corresponding to the initiator account in the interaction data in the valid graph data model is set as the target point, and the second node corresponding to the recipient account in the interaction data in the valid graph data model is set as the starting point; Determine search data with the second node as a starting point and the first node as a target point from the valid graph data model, and obtain an abnormality recognition result of the target interactive behavior based on the search data.

8. The method according to claim 7, characterized in that The determining, from the valid graph data model, search data with the second node as a starting point and the first node as a target point, and obtaining an abnormality recognition result of the target interactive behavior based on the search data, includes: Determine, from the valid graph data model, all traversal paths starting from the second node and ending at the first node; Screening all the traversal paths to obtain a valid path; If the valid path forms a ring link, identifying the number of nodes in the valid path and / or attribute information between the nodes; If the number of nodes is greater than a preset number of nodes, and / or the resource quota in the attribute information of the node is greater than a preset quota, it is determined that the target interaction behavior is abnormal.

9. An abnormal behavior recognition device, characterized in that: The device comprises: A data acquisition module, configured to acquire a relational data model associated with the interaction behavior; the relational data model includes a plurality of data tables, each of which represents an entity, and the fields in the data tables represent attributes of the entity; a data analysis module, configured to determine an entity relationship diagram corresponding to the relational data model, analyze the relational data model using the entity relationship diagram, and determine a target connection field associated with the data table from the fields; A relationship graph construction module, configured to construct a blood relationship graph of the data table according to the target connection field, and identify the data flow direction of the interactive behavior in the blood relationship graph; A graph data model construction module, configured to construct a graph data model based on the relationship between a directed attribute graph and a topology graph according to the data flow direction and the target connection field; Identify the timeliness characteristics of the data in the relational data model, obtain target business data from the relational data model according to the data processing strategy corresponding to the timeliness characteristics, update the graph data model according to the target business data, and obtain a valid graph data model for identifying abnormal interaction behavior.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images