Abnormal resource interaction behavior detection method, device and equipment and readable storage medium

Abstract

The invention relates to an abnormal resource interaction behavior detection method and device, equipment and a readable storage medium. The method comprises the following steps: acquiring an original knowledge graph, and extracting a target sub-graph formed by a target account node corresponding to a target transaction edge and adjacent account nodes associated with the target account node from the original knowledge graph; determining subgraph structure information of the target subgraph, and performing format conversion on the subgraph structure information to obtain a structured subgraph text in a preset structured text format; a preset sample prompt template is obtained, and a complete prompt template meeting the large language model input requirement is generated according to the structured sub-text and preset sample prompt; and inputting the complete prompt template into the large language model for reasoning, and generating a reasoning result about whether the target sub-graph has the abnormal resource interaction behavior or not. By adopting the method, the accuracy of abnormal resource interaction behavior detection can be improved.

Description

Technical Field

[0001] This application relates to the field of risk control technology, and in particular to a method, apparatus, device, and readable storage medium for detecting abnormal resource interaction behavior. Background Technology

[0002] With the continuous expansion of global financial transactions and increasingly frequent cross-border capital flows, resource interaction behaviors are becoming more complex, covert, and inter-institutional, posing a serious challenge to financial regulation and compliance systems. To ensure the security of resources during resource interactions, it is necessary to detect these interactions. Existing resource interaction detection methods rely on financial knowledge graphs to capture the complex relationships between accounts, transactions, and institutions.

[0003] However, this rule-based detection method relies on expert experience to set static thresholds, resulting in insufficient flexibility and adaptability. It can only detect simple, existing abnormal resource interactions, and suffers from a high false alarm rate when dealing with complex abnormal resource interactions. Therefore, a method to improve detection accuracy is needed. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product for detecting abnormal resource interaction behavior that can improve the accuracy of detecting abnormal resource interaction behavior in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for detecting abnormal resource interaction behavior, including:

[0006] Obtain the original knowledge graph, and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node;

[0007] Determine the subgraph structure information of the target subgraph, and perform format conversion on the subgraph structure information to obtain structured subgraph text in a preset structured text format;

[0008] Obtain a preset sample prompt template, and generate a complete prompt template that meets the input requirements of a large language model based on the structured subgraph text and the preset sample prompt;

[0009] The complete prompt template is input into the large language model for inference, generating an inference result indicating whether the target subgraph exhibits abnormal resource interaction behavior.

[0010] In one embodiment, obtaining the original knowledge graph includes:

[0011] The original knowledge graph is obtained from the Neo4j graph database. The graph structure information of the original knowledge graph includes a set of nodes, a set of edges, and a set of attributes. The set of nodes includes multiple account nodes. The edges in the set of edges represent the resource interaction behavior between two associated account nodes. The set of attributes includes the account node attribute information of each account node and the resource interaction behavior attribute information of each edge.

[0012] In one embodiment, extracting a target subgraph from the original knowledge graph, consisting of the target account node corresponding to the target transaction edge and adjacent account nodes associated with the target account node, includes:

[0013] Obtain the attribute set of the original knowledge graph, and determine the target transaction edge that meets the preset suspicious transaction conditions from the original knowledge graph based on the account node attribute information and the resource interaction behavior attribute information of each edge in the attribute set.

[0014] The account nodes at both ends of the target transaction edge are obtained as target account nodes. Taking each target account node as the starting account node, all directly adjacent account nodes of the starting account node are visited, and the process is progressively advanced to the unvisited directly adjacent account nodes of each directly adjacent account node until the diffusion depth reaches a preset K-hop threshold, thus obtaining the target subgraph.

[0015] In one embodiment, the step of format conversion of the subgraph structure information to obtain structured subgraph text in a preset structured text format includes:

[0016] Determine the account node attribute information of each account node and the resource interaction behavior attribute information of each edge in the subgraph structure information, and convert the account node attribute information according to the preset node formatting template to obtain the formatted vertex text description.

[0017] The resource interaction behavior attribute information is formatted according to a preset edge formatting template to obtain a formatted edge text description.

[0018] The structured subgraph text is obtained based on the formatted vertex text description and the formatted edge text description.

[0019] In one embodiment, obtaining the preset sample prompt template includes:

[0020] Obtain first characteristic description data of abnormal resource interaction behavior and second characteristic description data of non-suspicious resource interaction behavior;

[0021] A sample example is determined based on the first feature description data and the second feature description data;

[0022] Obtain the prompt title, task, and output format of the large language model, and construct a preset sample prompt template according to the prompt title, task, output format, and sample example in a preset format.

[0023] In one embodiment, generating a complete prompt template that meets the input requirements of a large language model based on the structured subgraph text and the preset sample prompt template includes:

[0024] The structured subgraph text is embedded into the placeholder position of the test data in the task to obtain the verification prompt template;

[0025] The format uniformity of the prompt template to be verified is validated to obtain a complete prompt template that meets the input requirements of the large language model.

[0026] In one embodiment, the step of inputting the complete prompt template into the large language model for inference and generating an inference result indicating whether the target subgraph exhibits abnormal resource interaction behavior includes:

[0027] The complete prompt template is input into the large language model. Based on the sample examples and prompt titles in the complete prompt template, the large language model infers the structured subgraph text and generates an inference result on whether the target subgraph has abnormal resource interaction behavior.

[0028] The reasoning results are output according to the output format.

[0029] Secondly, this application also provides an abnormal resource interaction behavior detection device, comprising:

[0030] The subgraph extraction module is used to obtain the original knowledge graph and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node.

[0031] The format conversion module is used to determine the subgraph structure information of the target subgraph, convert the subgraph structure information into a format, and obtain a structured subgraph text in a preset structured text format.

[0032] The template construction module is used to obtain a preset sample prompt template and generate a complete prompt template that meets the input requirements of the large language model based on the structured subgraph text and the preset sample prompt.

[0033] The reasoning module is used to input the complete prompt template into the large language model for reasoning and generate a reasoning result on whether the target subgraph has abnormal resource interaction behavior.

[0034] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0035] Obtain the original knowledge graph, and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node;

[0036] Determine the subgraph structure information of the target subgraph, and perform format conversion on the subgraph structure information to obtain structured subgraph text in a preset structured text format;

[0037] Obtain a preset sample prompt template, and generate a complete prompt template that meets the input requirements of a large language model based on the structured subgraph text and the preset sample prompt;

[0038] The complete prompt template is input into the large language model for inference, generating an inference result indicating whether the target subgraph exhibits abnormal resource interaction behavior.

[0039] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0040] Obtain the original knowledge graph, and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node;

[0041] Determine the subgraph structure information of the target subgraph, and perform format conversion on the subgraph structure information to obtain structured subgraph text in a preset structured text format;

[0042] Obtain a preset sample prompt template, and generate a complete prompt template that meets the input requirements of a large language model based on the structured subgraph text and the preset sample prompt;

[0043] The complete prompt template is input into the large language model for inference, generating an inference result indicating whether the target subgraph exhibits abnormal resource interaction behavior.

[0044] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0045] Obtain the original knowledge graph, and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node;

[0046] Determine the subgraph structure information of the target subgraph, and perform format conversion on the subgraph structure information to obtain structured subgraph text in a preset structured text format;

[0047] Obtain a preset sample prompt template, and generate a complete prompt template that meets the input requirements of a large language model based on the structured subgraph text and the preset sample prompt;

[0048] The complete prompt template is input into the large language model for inference, generating an inference result indicating whether the target subgraph exhibits abnormal resource interaction behavior.

[0049] The aforementioned abnormal resource interaction behavior detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product extract a lightweight target subgraph from the original knowledge graph, consisting of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node. This target subgraph is then format-converted to obtain a structured subgraph text that a large language model can understand and recognize. A template is constructed using a preset sample prompt template and this structured subgraph text, resulting in a complete prompt template that meets the input requirements of the large language model. This complete prompt template construction reduces reliance on labeled data. Inputting the complete prompt template into the large language model for reasoning, compared to inputting the entire knowledge graph, controls computational overhead while ensuring interpretability. Utilizing the semantic understanding of the large language model and the original knowledge graph, in addition to recognizing traditional abnormal resource interaction behaviors, it can also identify complex abnormal resource interaction behaviors, improving the model's accuracy and interpretability in recognizing complex abnormal resource interaction behaviors. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is an application environment diagram of an abnormal resource interaction behavior detection method in one embodiment;

[0052] Figure 2 This is a flowchart illustrating an abnormal resource interaction behavior detection method in one embodiment;

[0053] Figure 3 This is a flowchart illustrating a method for extracting a target subgraph in one embodiment;

[0054] Figure 4This is a flowchart illustrating a method for constructing a preset sample prompt template in one embodiment;

[0055] Figure 5 This is a schematic diagram illustrating abnormal resource interaction behavior in one embodiment;

[0056] Figure 6 This is a schematic diagram of a preset sample prompt template in one embodiment;

[0057] Figure 7 This is a flowchart illustrating an abnormal resource interaction behavior detection method in another embodiment;

[0058] Figure 8 This is a flowchart illustrating the abnormal resource interaction behavior detection method in yet another embodiment;

[0059] Figure 9 This is a structural block diagram of an abnormal resource interaction behavior detection device in one embodiment;

[0060] Figure 10 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0062] Traditional methods for detecting abnormal resource interaction behavior rely on relevant resource knowledge graphs to capture complex relationships between accounts, transactions, and institutions. However, these methods lack flexibility and adaptability, making it difficult to handle complex or novel abnormal resource interaction patterns, resulting in a high false positive rate. Traditional machine learning models (such as XGBoost and Random Forest) focus on individual feature analysis and have limited ability to reason about long-range, multi-hop relationships within knowledge graphs, failing to effectively identify complex resource interaction data links. Graph Neural Networks (GNNs) can utilize graph structures for deep reasoning, but their "black box" nature leads to a lack of interpretability, failing to provide clear evidence for regulatory decisions and hindering their practical application.

[0063] To address the technical problem of low accuracy in detecting abnormal resource interaction behaviors in related technologies, a new method for detecting abnormal resource interaction behaviors is proposed. This method integrates a large language model and a knowledge graph. By extracting the target subgraph from the original knowledge graph and converting the subgraph structure information of the target subgraph into a pre-defined structured text format, a sample is constructed based on a pre-defined sample prompt template and the structured subgraph text. The constructed complete prompt template is then input into the large language model to guide inference and output interpretable inference results. This improves the ability to identify complex abnormal resource interaction behaviors and reduces the false negative rate of abnormal resource interaction behaviors in complex scenarios.

[0064] The abnormal resource interaction behavior detection method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud server or other network server. Terminal 102 obtains the original knowledge graph from server 104, extracts the target subgraph from the original knowledge graph, consisting of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node; determines the subgraph structure information of the target subgraph, performs format conversion on the subgraph structure information, and obtains the structured subgraph text in a preset structured text format; obtains a preset sample prompt template, and generates a complete prompt template that meets the input requirements of the large language model based on the structured subgraph text and the preset sample prompt; inputs the complete prompt template into the large language model for reasoning, and generates a reasoning result on whether the target subgraph exhibits abnormal resource interaction behavior. It is understood that abnormal resource interaction behavior can be an unreasonable resource transfer behavior, and resources can be, but are not limited to, money, goods, etc.

[0065] The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, etc. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0066] In one exemplary embodiment, such as Figure 2 As shown, a method for detecting abnormal resource interaction behavior is provided, and this method is applied to... Figure 1 Taking the terminal in the example, the explanation includes the following steps 202 to 208. Wherein:

[0067] Step 202: Obtain the original knowledge graph and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node.

[0068] The original knowledge graph can be a graph structure data composed of account nodes and transaction edges, used to represent the relationships between accounts in financial transactions. Accounts are used as nodes in the original knowledge graph, and resource interaction behaviors between accounts are used as edges to connect the corresponding account nodes. Resource interaction behaviors can also be understood as transaction records. Edges in the original knowledge graph, i.e., transaction edges, can represent the existence of a fund flow relationship between two accounts, that is, the existence of resource interaction behaviors. The original knowledge graph can include the original financial knowledge graph.

[0069] Furthermore, the graph structure information of the original knowledge graph includes a set of nodes, a set of edges, and a set of attributes. The set of nodes includes multiple account nodes, the edges in the edge set represent the resource interaction behavior between two related account nodes, and the attribute set includes the account node attribute information of each account node and the resource interaction behavior attribute information of each edge. The account node attribute information may include the account type, account opening time, etc. The resource interaction behavior attribute information, also called edge attributes, may include the transaction amount, transaction time, and corresponding payment method of the resource interaction, etc.

[0070] Understandably, before obtaining the original knowledge graph, it is necessary to define the graph first. In this embodiment, the knowledge graph involved is a directed attribute graph, which can be represented as a directed attribute graph. ,in, This is a set of nodes, including personal accounts and business accounts. Personal accounts and business accounts are abstracted into one type of node, namely account nodes, which constitute the set of accounts. (n is the total number of individual and business accounts constructed), the account set belongs to ,Right now . A set of edges containing transaction relationships (i.e., resource interaction behaviors), i.e., transaction edges, the set of transaction relationships. ( (Total number of transactions constructed), the set of transaction relationships belongs to ,Right now For ease of description, account node attributes are called node attributes, and resource interaction behavior attribute information is called edge attributes.

[0071] It is a collection of attributes, including node attributes. and edge attributes ,Right now Node attributes Includes account node attributes (Account type acct_type, Account opening time acct_open) Edge attributes Includes transaction edge attributes (Transaction amount trans_amt, transaction time trans_time, payment method trans_method) The attributes of account nodes and edges are shown in Table 1:

[0072]

[0073] Target transaction edges can be obtained by filtering specific transaction edges from the original knowledge graph for analysis. Specific transaction edges can be transaction edges with a transaction frequency greater than a preset frequency and a transaction amount less than a preset amount within a preset time period, and / or, transaction edges corresponding to a preset account. Target account nodes can be two account nodes connected by the target transaction edge. Adjacent account nodes can be directly adjacent account nodes connected to the target account node via transaction edges, and / or, indirectly adjacent account nodes. The target subgraph can be a local graph structure composed of target transaction edges, target account nodes, and adjacent account nodes.

[0074] Extracting the target subgraph can be achieved by extracting a local graph structure containing the target transaction edge, the target account node, and adjacent account nodes from the original knowledge graph. Furthermore, the target subgraph can be extracted using a graph traversal algorithm, starting from the target transaction edge and expanding to include adjacent account nodes with a certain number of hops.

[0075] For example, taking the original knowledge graph as a financial knowledge graph, the transaction edges with a transaction frequency greater than a preset frequency and a transaction amount less than a preset amount within a preset time period are determined from the financial knowledge graph, and / or the transaction edges corresponding to preset accounts are taken as target transaction edges. A graph traversal algorithm is used to start from the target transaction edge, expand the adjacent account nodes by a certain number of hops, and extract the target subgraph from the financial knowledge graph.

[0076] Step 204: Determine the subgraph structure information of the target subgraph, convert the subgraph structure information into a format, and obtain the structured subgraph text in the preset structured text format.

[0077] The subgraph structure information can include the topological structure and attribute information of nodes and edges in the target subgraph. The attribute information can include the attribute information of account nodes and the edge attribute information of edges in the target subgraph. It is understandable that the purpose of formatting the subgraph structure information is to transform it into a structured text format that can be understood and processed by a large language model, thereby achieving semantic mapping from graph data to natural language.

[0078] Structured subgraph text can be a structured representation of subgraph structure information converted into text format. This can be achieved by using a preset text template to convert graph structure information into text. The format conversion of subgraph structure information can involve obtaining the vertex and edge sets from the subgraph structure information. The vertex set is a subset of the node set of the original knowledge graph. Each vertex is converted according to a preset node formatting template, and each transaction edge in the edge set is converted according to a preset edge formatting template, resulting in a structured subgraph text in a preset structured text format. This structured subgraph text includes both the vertices and edges of the target subgraph. The preset structured text format only needs to be a format that is understandable and processable by a large language model.

[0079] Step 206: Obtain the preset sample prompt template and generate a complete prompt template that meets the input requirements of the large language model based on the structured subgraph text and the preset sample prompt.

[0080] The preset sample prompt template can be a text template used to guide a large language model in understanding the input data. The preset sample prompt template defines a unified input and output format, including four parts: prompt title, sample example, analysis task placeholder, and output format. Only a small number of sample prompts are used in the sample examples within the preset sample prompt template.

[0081] A complete prompt template can be the final input text generated by combining structured subgraph text and preset sample prompt templates. It can be generated by inserting structured subgraph text into preset sample prompt templates. The complete prompt template can be used as input to a large language model to guide its reasoning.

[0082] Understandably, the purpose of generating a complete prompt template that meets the input requirements of the large language model based on structured subgraph text and preset sample prompts is to construct a few-sample prompt system for abnormal resource interaction scenarios. Through the technical solution of "typical pattern library + standardized prompt template", the large language model (LLM) is injected with domain knowledge and reasoning constraints, enabling it to accurately identify suspicious transaction patterns hidden in the subgraph text.

[0083] Step 208: Input the complete prompt template into the large language model for reasoning and generate a reasoning result on whether there is abnormal resource interaction behavior in the target subgraph.

[0084] Specifically, inference using a large language model can be achieved by passing a complete prompt template as input. Furthermore, inference using a large language model can be executed via API calls or by loading a local model.

[0085] For example, the complete prompt template is passed to the model via the API or localized call interface of the Large Language Model (LLM). Based on the sample examples and instructions in the complete prompt template, the LLM performs transaction topology analysis on the structured subgraph text within the template and outputs a reasoning result indicating whether the target subgraph exhibits abnormal resource interaction behavior. This reasoning result includes a conclusion, an explanation, and a pattern recognition mechanism. For instance, the conclusion could be a determination of whether the target subgraph is suspicious. The explanation could be a natural language interpretation consistent with financial investigation logic, outlining the basis for the judgment. The pattern recognition mechanism could be a list of detected abnormal resource interaction behavior patterns.

[0086] For example, taking the detection of abnormal cross-border fund flows as an example, a cross-border remittance transaction was detected. This transaction involved multiple accounts, and the flow of funds was complex. The target subgraph consisting of the transaction edges and their associated accounts was extracted from the original knowledge graph. Its structural information was analyzed and structured text was generated. Combined with a preset sample prompt template, a complete prompt template was generated. The text was then input into a large language model for reasoning, and finally it was determined that the transaction had the risk of abnormal resource interaction.

[0087] The aforementioned method for detecting abnormal resource interactions extracts a lightweight target subgraph from the original knowledge graph. This subgraph consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node. The subgraph is then formatted to obtain a structured subgraph text that the large language model can understand and recognize. A template is constructed using a pre-set sample prompt template and this structured subgraph text, resulting in a complete prompt template that meets the input requirements of the large language model. This complete prompt template construction reduces reliance on labeled data. Inputting the complete prompt template into the large language model for reasoning, compared to inputting the entire knowledge graph, controls computational overhead while ensuring interpretability. Utilizing the semantic understanding of the large language model and the original knowledge graph, in addition to recognizing traditional abnormal resource interactions, it can also identify complex abnormal resource interactions, improving the model's accuracy and interpretability in recognizing complex abnormal resource interactions.

[0088] Understandably, to support efficient attribute graph querying and subgraph extraction, the original knowledge graph can be obtained from a graph database capable of efficient attribute graph querying, and the target subgraph can be extracted from the original knowledge graph in the graph database. In an exemplary embodiment, the original knowledge graph is obtained from the Neo4j graph database. The graph structure information of the original knowledge graph includes a node set, an edge set, and an attribute set. The node set includes multiple account nodes, the edges in the edge set represent the resource interaction behavior between two associated account nodes, and the attribute set includes the account node attribute information of each account node and the resource interaction behavior attribute information of each edge.

[0089] Neo4j graph database is a graph database system used to store and manage graph-structured data. It can be used for efficient storage and retrieval of account node and transaction edge information in financial transaction knowledge graphs. It can utilize predefined knowledge graphs. Import a graph database that supports efficient property graph queries, and use Neo4j graph database for mapping and storage, including account nodes. Mapped to nodes in Neo4j, transaction relationship edges Mapped to Relationships in Neo4j, node attributes With edge attributes These are mapped to the properties of nodes and relationships, respectively. It should be noted that the graph database, as the storage medium, adopts a pluggable storage component architecture in this embodiment, allowing for flexible replacement based on the financial institution's existing technology stack, data scale, and security requirements (such as using NebulaGraph, ArangoDB, etc.).

[0090] Furthermore, in terms of data import strategy selection, historical transaction data is imported in batches to initialize the graph. Daily incremental updates can be imported in T+1 or in real time depending on the scenario requirements to ensure that the constructed graph meets the data extraction needs of scenario analysis. The graph must support efficient querying of attribute graphs and extraction of subgraphs.

[0091] In one exemplary embodiment, such as Figure 3 As shown, a method for extracting a target subgraph is provided, including the following steps:

[0092] Step 302: Obtain the attribute set of the original knowledge graph. Based on the account node attribute information and resource interaction behavior attribute information of each edge in the attribute set, determine the target transaction edge that meets the preset suspicious transaction conditions from the original knowledge graph.

[0093] The account node attribute information may also include the region information of the account corresponding to the account node. It should be noted that the transaction relationship edge in the original knowledge graph corresponding to the target transaction to be detected is denoted as... ( (The set of transaction edges in the global graph). ,in For the source account, For the target account. This information can originate from a pool of suspicious transactions that financial institutions need to verify, specifically the transaction side to be verified within that pool, which is also the target transaction side. Resource interaction behavior attribute information includes transaction time and transaction amount.

[0094] It is understandable that the extraction of the target subgraph refers to extracting a local subgraph centered on the target transaction edge and including multi-hop neighborhood relationships from the original knowledge graph, providing structured data with complete context for subsequent suspicious pattern analysis and identification. Preset suspicious transaction conditions include at least one of the following: a preset region corresponding to abnormal resource interaction behavior, where transactions between accounts belonging to this preset region are identified as abnormal resource interaction lines; or a preset list corresponding to abnormal resource interaction behavior; or a transaction edge where the transaction frequency is greater than the preset frequency and the transaction amount is less than the preset amount within a preset time period. For example, high-frequency, low-amount transactions exist within a specified time window (i.e., the preset time period), which can be expressed by the formula: Quantitative judgment, including: It is a threshold for the number of transactions. This refers to the threshold for small transaction amounts, which can be preset and set based on actual needs. It is the length of the time window. The number of transactions within the time window. For the amount of a single transaction, The transaction time is used to identify the account to be verified, and one of its transaction sides is selected as the transaction time. .

[0095] Step 304: Obtain the account nodes at both ends of the target transaction edge as target account nodes. Using each target account node as the starting account node, visit all directly adjacent account nodes of the starting account node, and proceed layer by layer to the unvisited directly adjacent account nodes of each directly adjacent account node until the diffusion depth reaches the preset K-hop threshold to obtain the target subgraph.

[0096] The extraction of the target subgraph can be K-hop subgraph extraction, also known as the suspicious transaction K-hop subgraph. K-hop subgraph extraction can be understood as focusing on local substructures related to the target element from a large-scale graph; that is, focusing on local subgraph structures related to the target transaction edges from the original knowledge graph. The subgraph range is controlled by limiting the "hop count" (i.e., the number of levels in the transaction relationship), thus reducing analysis complexity while retaining key association information. The K-hop threshold can be a preset maximum number of hops for graph traversal, used to control the range of candidate subgraphs and limit their complexity, improving analysis efficiency. Furthermore, the K-hop threshold can be manually set or determined based on training with historical data. For example, the K-hop threshold can include, but is not limited to, one or more of the following: a 1-hop threshold, a 2-hop threshold, and a 3-hop threshold.

[0097] Subgraph extraction can be implemented based on the Algorithm 1 algorithm (BFS algorithm). The principle is to use the target transaction edge as the initial edge, obtain the vertices at both ends of the initial edge, and then perform breadth-first diffusion based on these two vertices (for example, using the BFS algorithm, starting from the specified starting node, visiting all the adjacent nodes of the starting node, and then visiting all the unvisited adjacent nodes of these adjacent nodes one by one, expanding outward layer by layer). When the diffusion reaches the specified K hops, the diffusion stops and the traversed subgraph is returned.

[0098] The process of progressively accessing unvisited directly adjacent account nodes to each directly adjacent account node can be achieved using a graph traversal strategy, expanding the access scope layer by layer. Furthermore, this process of progressively accessing unvisited directly adjacent account nodes to each directly adjacent account node can be accomplished using breadth-first search or depth-first search to achieve multi-hop access, thus achieving the technical effect of constructing a multi-layered account association structure.

[0099] The following is an example of subgraph extraction, where the target subgraph is denoted as . ,in , , . Represents the vertex set of the original graph. Represents the edge set of the original graph. Original image attribute set : Query the target transaction edge : Query hop count, : vertices of a jump graph : edge set of a jump graph : Jump graph attribute set.

[0100] By setting relevant codes: Input the original knowledge graph Target transaction side , number of jumps Output Jumping board Initialize the BFS queue Q={( }, the set of visited edges visited={ Specifically, by running the subgraph extraction code, the node set is first initialized. Edge set Attribute set Initialize the BFS queue Q={( }, and the set of visited edges visited={ Next, the hierarchical traversal phase begins. Queue Q is retrieved, and it is determined whether the hop count h corresponding to the current edge is less than or equal to the target hop count k. If the diffusion has not reached the target hop count, the current edge is... and associated start and end points And the corresponding attributes are added in sequence. , , Collection, calling the function adjacentEdges( , Get All adjacent edges, for each adjacent edge If an edge has not been visited, it is added to the queue, and its hop count is mapped to h+1. If an edge has been visited, it is added to the visited set. This process continues until all edges of the target edge are found, completing the k-hop subgraph. Query and return.

[0101] In the above method, subgraph extraction can focus the analysis scope from massive global data to the local network most relevant to the target transaction, greatly improving analysis efficiency. At the same time, it ensures that the extracted subgraph fully preserves the fund flow, account relationship and transaction time sequence information around the target transaction, providing the necessary structural foundation for subsequent pattern recognition and interpretable reasoning.

[0102] To enable large language models to understand the graph structure information of the target subgraph, in an exemplary embodiment, the subgraph structure information is format-converted to obtain structured subgraph text in a preset structured text format, including:

[0103] Determine the account node attribute information of each account node and the resource interaction behavior attribute information of each edge in the subgraph structure information. Convert the account node attribute information according to the preset node formatting template to obtain the formatted vertex text description. Convert the resource interaction behavior attribute information according to the preset edge formatting template to obtain the formatted edge text description. Based on the formatted vertex text description and the formatted edge text description, obtain the structured subgraph text.

[0104] The format conversion of subgraph structure information can be achieved using the attribute graph text serialization algorithm Algorithm2. This algorithm employs a node-first, temporal edge sorting strategy to convert subgraph structure information into structured text. The variables in Algorithm2 include: : The set of vertices in a jump graph; : edge set of a jump graph; : Jump graph attribute set; T: Structured text.

[0105] Account node attribute information can include the account node's attribute name, attribute value, and id value. The attribute name includes the account type and account opening time. The account type can include individual account type and enterprise account type. Each attribute name has its own corresponding attribute value.

[0106] The default node formatting template includes information such as the vertex type, id value, attribute set, the name of the nth attribute, and the value of the nth attribute. The default node formatting template built into the `nodeFormat` function can be represented as:

[0107] -{v.type}:{v.id}({v.attrs[0].name}:{v.attrs[0].value}; {v.attrs[1].name}:{v.attrs[1].value};...{v.attrs[n].name}:{v.attrs[n].value};)

[0108] Where v.type is the type of vertex v; v.id is the unique id value of vertex v; v.attrs is the set of attributes of vertex v, v.attrs[n].name represents the name of the nth attribute of vertex v, and v.attrs[n].value represents the value of the nth attribute of vertex v.

[0109] Resource interaction behavior attribute information includes the edge's attribute name, attribute value, the ID value of the starting account node and the ID value of the ending account node. The attribute name includes transaction amount, transaction time and payment method, etc., and each attribute name has its own corresponding attribute value.

[0110] The preset edge formatting template includes the ID value of the starting point of the edge, the ID value of the ending point, the attribute set, the attribute name of the nth attribute of the edge, and the attribute value of the nth attribute of the edge. The built-in preset edge formatting template of the edgeFormat function can be represented as:

[0111] -{e.srcId} transfers_to {e.dstId} ({e.attrs[0].name}:{e.attrs[0].value}; {e.attrs[1].name}:{e.attrs[1].value};...{e.attrs[n].name}:{e.attrs[n].value};)

[0112] Where e.srcId is the id value of the starting point corresponding to edge e; e.dstId is the id value of the ending point corresponding to edge e; e.attrs is the attribute set of edge e, e.attrs[n].name represents the attribute name of the nth attribute of edge e, and e.attrs[n].value represents the attribute value of the nth attribute of edge e.

[0113] Based on the formatted vertex text descriptions and the formatted edge text descriptions, the structured subgraph text is obtained. That is, the structured subgraph text can be a structured text representation composed of formatted vertex text descriptions and formatted edge text descriptions. For example, the structured subgraph text T contains partition identifiers for nodes and edges (< <nodes> > < <edges>> can be represented as:

[0114] < <nodes>>

[0115] - Account: acct_001 (acct_type: Salary; acct_open: 2025 / 03 / 01)

[0116] - Account: acct_002 (acct_type: Company; acct_open: 2025 / 05 / 30)

[0117] < <edges>>

[0118] - acct_001 transfers_to acct_002 (trans_amt: 5056.22; trans_time:2025 / 09 / 01 09:02:09; trans_type: Reinvestment).

[0119] For example, based on the target subgraph, a vertex set in the target subgraph is obtained. Each vertex in the vertex set is converted according to the format defined in `nodeFormat` to obtain a formatted vertex text description. An edge set in the target subgraph is obtained. The edges in the edge set are first sorted in ascending order by transaction time, and then each edge in the edge set is converted according to the format defined in `edgeFormat` to obtain a formatted edge text description. Based on the formatted vertex text descriptions and the formatted edge text descriptions, a structured subgraph text output is obtained, which includes both vertices and edges in the target subgraph. For example, extracting the target subgraph. All vertices For each Call the function nodeFormat( Format vertex text descriptions and add them to T; extract the target subgraph. All vertices , call Sort by transaction time in ascending order to obtain For each Call the function edgeFormat( Format the edge text description and add it to T.

[0120] In the above approach, by transforming the extracted target subgraph from graph structure information into a structured text format that can be understood and processed by the large language model, the semantic mapping from graph data to natural language is realized, thereby enhancing the large language model's ability to understand complex resource interaction behaviors and further improving the accuracy of abnormal resource interaction behavior detection.

[0121] In one exemplary embodiment, such as Figure 4 As shown, the construction of a preset sample prompt template is provided, including the following steps:

[0122] Step 402: Obtain the first feature description data of abnormal resource interaction behavior and the second feature description data of non-suspicious resource interaction behavior.

[0123] Step 404: Determine the sample example based on the first feature description data and the second feature description data.

[0124] Among them, there are at least 8 typical patterns of abnormal resource interaction behavior, and each abnormal resource interaction behavior pattern has its own corresponding first feature description data. There are at least 4 patterns of non-suspicious resource interaction behavior, and each non-suspicious resource interaction behavior pattern has its own corresponding second feature description data.

[0125] For example, a set of 8 typical abnormal resource interaction behavior patterns was constructed. ,like Figure 5 As shown, and a set of four types of non-suspicious resource interaction behavior patterns. Pattern library collection The following are the feature data of each pattern in the pattern library, as shown in Table 2:

[0126]

[0127] Understandably, the pattern library employs a dynamically updatable modular architecture, supporting the addition of both suspicious and non-suspicious patterns. When adding a pattern, its unique identifier and topological characteristics must be defined before it is added to the pattern library. The feature descriptions of different patterns correspond to their respective first feature description data or second feature description data.

[0128] Step 406: Obtain the prompt title, analysis task placeholder and output format of the large language model, and construct a preset sample prompt template according to the preset format based on the prompt title, task, output format and sample example.

[0129] The prompt title clarifies the role and responsibilities of the LLM and provides a framework description of the prompt template. The sample examples, i.e., a small number of sample examples, contain feature description data of the typical and non-suspicious patterns mentioned above. The analysis task clarifies the analysis objective and provides input data to be detected, such as the structured subgraph text defined in the above embodiments. The output format defines the LLM's output format and content scope.

[0130] The structure of the preset sample prompt template can be represented as follows:

[0131] ;

[0132] in, To indicate the title, For the mission, For example, For the output format. In an exemplary embodiment, such as Figure 6 The diagram shows a pre-defined sample prompt template, comprising four parts: prompt title, few-sample example, task, and output format. The prompt title clearly defines the LLM's role and responsibilities, such as being responsible for reviewing account behavior patterns to identify potential anomalous resource interaction events. The template framework is explained, for example, the observation data is presented as graph data converted into serialized text, where... <nodes>> For accounts (including account type and account opening date), < <edges>The text indicates a transfer relationship (including transaction amount, transaction time, and payment method). A series of resource interaction behavior patterns are then provided, represented as serialized subgraph text, along with a set of test data. Your task is to determine whether this test data conforms to an abnormal resource interaction behavior pattern and answer according to the output format requirements. The few-sample examples include the resource interaction behavior patterns shown in Table 2 above. The task includes a description of "using your knowledge of abnormal resource interaction behavior patterns and the given example patterns, predict whether the resource interaction behavior given in the test data might be part of an abnormal resource interaction behavior plan," along with placeholders for the test data. The output format includes a conclusion (e.g., whether it is suspected of being an abnormal resource interaction behavior, output "suspicious" or "not suspicious"), an explanation (including 2-3 reasons), and a pattern identification (e.g., if the above patterns are matched, provide the corresponding pattern label).

[0133] Understandably, the preset sample prompt template supports dynamic pattern injection. When the pattern library P is updated, cases of that pattern can be automatically added to the small sample example set without modifying the overall template structure. Furthermore, managing sample cases through configuration files enables one-click updates and adapts to rapid iterations of new patterns.

[0134] In this embodiment, by constructing a few-sample prompting system adapted to abnormal resource interaction scenarios, and by using a typical pattern library plus standardized prompt templates, domain knowledge and reasoning constraints are injected into the large language model, enabling it to accurately identify suspicious transaction patterns hidden in subgraph text.

[0135] In an exemplary embodiment, generating a complete prompt template that meets the input requirements of a large language model based on structured subgraph text and a preset sample prompt template includes: embedding the structured subgraph text into the placeholder position of the test data in the task within the preset sample prompt template to obtain a prompt template to be verified; performing format uniformity verification on the prompt template to be verified to obtain a complete prompt template that meets the input requirements of a large language model.

[0136] Format consistency verification is a process of checking and correcting the format consistency of prompt templates. Its basic operation involves checking the syntax, structure, and semantics of the prompt templates based on preset format rules. Furthermore, format consistency verification can be performed using regular expressions, syntax tree parsing, or model input format specifications, thereby ensuring that the prompt templates conform to the input format requirements of large language models.

[0137] For example, a few-sample prompt template, i.e., a preset sample prompt template, is loaded through a prompt template parser. The parser parses the instructions in the template according to preset rules (e.g., keywords such as "typical abnormal resource interaction behavior pattern", "non-abnormal resource interaction pattern", "task"). Then, the subgraph text loader reads the structured subgraph text and automatically embeds the structured subgraph text according to the placeholder positions of the test data in the task of the preset sample prompt template. After embedding, a format uniformity check is performed, and a complete prompt template conforming to the LLM input specification is output. It can be understood that each LLM call first puts the test data into the preset sample prompt template, forming a complete prompt template with the test data, and then submits it to the LLM.

[0138] In the above embodiments, the accuracy and stability of model inference can be improved by co-embedding structured subgraph text with preset sample prompt templates and verifying format uniformity.

[0139] Large language model reasoning and interpretable output can be achieved through a technical process of "cue template parsing - subgraph text embedding - LLM contextual reasoning - structured result output". The above embodiment describes the implementation steps of "cue template parsing - subgraph text embedding" to obtain a complete cue template. The following is the implementation of "LLM contextual reasoning - structured result output".

[0140] In an exemplary embodiment, the complete prompt template is input into a large language model for inference, generating an inference result indicating whether the target subgraph exhibits abnormal resource interaction behavior, including:

[0141] The complete prompt template is input into the large language model. Based on the sample examples and prompt titles in the complete prompt template, the large language model infers the structured subgraph text and generates an inference result on whether there is abnormal resource interaction behavior in the target subgraph.

[0142] The large language model adopts a modular LLM calling architecture, which supports flexible access to mainstream open source / closed source LLMs (such as GPT-4, Claude, Llama, etc.). In this example, the GPT-4 multimodal model can be used, but is not limited to.

[0143] For example, the model is passed in through the LLM API or a localized call interface. During inference, the core parameter `temperature` is set, with a default value of 0.1. Based on the examples and instructions in the complete prompt template, the LLM performs inference tasks such as transaction topology analysis, transaction timing verification, and transaction amount verification on the structured subgraph text in the complete prompt template, and outputs the inference result indicating whether there is abnormal resource interaction behavior in the target subgraph. Among these, transaction amount verification can check the rationality of transaction values, and transaction timing verification can verify the logical order of transaction timestamps and detect whether the time is abnormal.

[0144] The reasoning result may include the following:

[0145] Conclusion: Determine whether the target subgraph is suspicious, such as "suspicious" or "not suspicious"; Explanation: Generate a natural language explanation that conforms to the logic of financial investigation, explaining the basis for the judgment; Pattern Recognition: List the types of abnormal resource interaction behavior patterns detected, such as "fan-out" and "simple loop".

[0146] Furthermore, the output inference results can be standardized and persisted. This involves reading the raw LLM output using a structured result parser, extracting fields according to a standardized JSON format, and outputting a structured result with complete field information. For example, the structured result can be represented as:

[0147] {

[0148] / / The unique identifier of the original target transaction edge

[0149] "transaction_id": "e_001",

[0150] / / Suspiciousness determination result

[0151] "is_suspicious": true,

[0152] / / Identify suspicious patterns in the matching; otherwise, use [].

[0153] "patterns": ["fan-out", "simple loop"],

[0154] / / Natural Language Explanation Containing Key Evidence

[0155] The transfers from five accounts, including acct_003, were all for 4,999 yuan each (close to the 5,000 yuan threshold for small transactions), which meets the characteristics of the fan-out pattern: 'a single account transferring funds to multiple accounts in a short period of time'.

[0156] / / Core account nodes supporting the conclusions

[0157] "key_evidence_nodes": ["acct_001", "acct_002", "acct_003"],

[0158] / / Core trading side supporting the conclusion

[0159] "key_evidence_edges": ["e_001", "e_002", "e_003"],

[0160] / / Timestamp generated for inference results (format: YYYY-MM-DD HH:MM:SS)

[0161] "timestamp": "2025-09-01 09:30:00"

[0162] };

[0163] The formatted results are persistently stored in a relational database, providing financial institutions with the opportunity to query the identification results for further system processing or manual verification.

[0164] In the above embodiments, by relying on the in-context learning capabilities of LLM and the semantic understanding capabilities in the financial field, the system completes the judgment of suspicious transactions, pattern recognition and the generation of interpretable conclusions, and performs standardized processing and persistent storage on the output results.

[0165] In one exemplary embodiment, such as Figure 7 As shown, a method for detecting abnormal resource interaction behavior is provided, and this method is applied to... Figure 1 Taking the terminal in the example, the explanation includes the following steps:

[0166] Step 702: Define the financial knowledge graph and import the defined financial knowledge graph into the graph database.

[0167] Step 704: Obtain the global financial knowledge graph from the graph database, extract the suspicious transaction K-jump subgraph from the global financial knowledge graph, and use the suspicious transaction K-jump subgraph as the target subgraph.

[0168] Among them, the global financial knowledge graph can be understood as the original financial knowledge graph.

[0169] Step 706: Convert the format of the target subgraph to obtain the structured subgraph text.

[0170] Step 708: Construct a few-sample prompt based on the preset resource interaction behavior to obtain a preset sample prompt template.

[0171] Among them, the preset resource interaction behaviors include at least the above-mentioned set of 8 typical abnormal resource interaction behavior patterns and 4 sets of non-suspicious resource interaction behavior patterns.

[0172] Step 710: Generate a complete prompt template that meets the input requirements of the large language model based on the structured subgraph text and preset sample prompts.

[0173] Step 712: Input the complete prompt template into the large language model for reasoning, output the reasoning result, and standardize and persist the reasoning result.

[0174] It is understood that the specific implementation of this embodiment can be achieved in the manner defined above, and will not be elaborated here.

[0175] In one exemplary embodiment, such as Figure 8 As shown, a flowchart of an abnormal resource interaction behavior detection method is provided. The method involves obtaining a global financial knowledge graph from a graph database, extracting a suspicious transaction K-hop subgraph from the global financial knowledge graph, using the suspicious transaction K-hop subgraph as the target subgraph, and converting the subgraph structure information of the target subgraph to obtain structured subgraph text, also known as graph structure serialized text. Based on preset resource interaction behaviors, a few-sample prompt is constructed to obtain a preset sample prompt template. A complete prompt template that meets the input requirements of a large language model is generated based on the structured subgraph text and the preset sample prompt. The complete prompt template is then input into the large language model for inference, and the inference result is output.

[0176] In the above embodiments, a financial knowledge graph modeling and dynamic storage mechanism based on attribute graphs is used to extract K-hop subgraphs centered on suspicious transactions, ensuring the integrity and traceability of local related information. On this basis, a topology-preserving structured text serialization method is used to achieve high-fidelity conversion of graph structure to natural language. A few-sample prompting construction technology based on a typical abnormal resource interaction pattern library is used to improve the model's ability to identify and explain complex money laundering behaviors. A modular LLM inference framework is also used to support the access of multiple models and output structured and interpretable detection results. This approach uses LLM to generate natural language explanations that conform to the logic of financial investigations, improving the credibility and auditability of detection results and breaking through the interpretation bottleneck of traditional "black box" models. Combining multi-hop relationship reasoning from knowledge graphs with semantic understanding from LLM, it possesses stronger capabilities for recognizing complex patterns. A few-sample hint mechanism enables rapid adaptation, reducing reliance on labeled data and supporting the dynamic expansion of new abnormal resource interaction behavior patterns. Furthermore, by quickly screening lightweight subgraphs using the knowledge graph and then applying LLM reasoning to the subgraph model, interpretability is ensured while controlling computational overhead, meeting the low latency and high concurrency requirements of real-time financial detection, thus demonstrating greater practicality and feasibility. It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction for the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts involved in the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0177] Based on the same inventive concept, this application also provides an abnormal resource interaction behavior detection device for implementing the abnormal resource interaction behavior detection method described above. The solution provided by this device is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more embodiments of the abnormal resource interaction behavior detection device provided below can be found in the limitations of the abnormal resource interaction behavior detection method described above, and will not be repeated here.

[0178] In one exemplary embodiment, such as Figure 9 As shown, an abnormal resource interaction behavior detection device is provided, including: a subgraph extraction module 902, a format conversion module 904, a template construction module 906, and an inference module 908, wherein:

[0179] The subgraph extraction module 902 is used to obtain the original knowledge graph and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node.

[0180] The format conversion module 904 is used to determine the subgraph structure information of the target subgraph, convert the subgraph structure information into a format, and obtain the structured subgraph text in a preset structured text format.

[0181] The template building module 906 is used to obtain preset sample prompt templates and generate complete prompt templates that meet the input requirements of the large language model based on the structured subgraph text and preset sample prompts.

[0182] The reasoning module 908 is used to input the complete prompt template into the large language model for reasoning and generate a reasoning result on whether there is abnormal resource interaction behavior in the target subgraph.

[0183] The aforementioned abnormal resource interaction behavior detection device extracts a lightweight target subgraph from the original knowledge graph, consisting of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node. This target subgraph is then format-converted to obtain structured subgraph text that the large language model can understand and recognize. Using a preset sample prompt template and this structured subgraph text, a complete prompt template that meets the input requirements of the large language model is constructed. This complete prompt template construction reduces the dependence on labeled data. Inputting the complete prompt template into the large language model for reasoning, compared to inputting the entire knowledge graph, controls computational overhead while ensuring interpretability. Utilizing the semantic understanding of the large language model and the original knowledge graph, in addition to recognizing traditional abnormal resource interaction behaviors, it can also identify complex abnormal resource interaction behaviors, improving the model's accuracy and interpretability in recognizing complex abnormal resource interaction behaviors.

[0184] In an exemplary embodiment, the abnormal resource interaction behavior detection device further includes a graph determination module, used to obtain an original knowledge graph from the Neo4j graph database. The graph structure information of the original knowledge graph includes a node set, an edge set, and an attribute set. The node set includes multiple account nodes, the edges in the edge set represent the resource interaction behavior between two associated account nodes, and the attribute set includes the account node attribute information of each account node and the resource interaction behavior attribute information of each edge.

[0185] In an exemplary embodiment, the subgraph extraction module 902 is further configured to obtain the attribute set of the original knowledge graph, and determine the target transaction edge that meets the preset suspicious transaction conditions from the original knowledge graph based on the account node attribute information and the resource interaction behavior attribute information of each edge in the attribute set.

[0186] Obtain the account nodes at both ends of the target transaction edge as target account nodes. Using each target account node as the starting account node, visit all directly adjacent account nodes of the starting account node, and proceed layer by layer to the unvisited directly adjacent account nodes of each directly adjacent account node until the diffusion depth reaches the preset K-hop threshold to obtain the target subgraph.

[0187] In an exemplary embodiment, the format conversion module 904 is further configured to determine the account node attribute information of each account node and the resource interaction behavior attribute information of each edge in the subgraph structure information, and to convert the account node attribute information according to a preset node formatting template to obtain a formatted vertex text description.

[0188] The resource interaction behavior attribute information is formatted according to the preset edge formatting template to obtain the formatted edge text description;

[0189] The structured subgraph text is obtained based on the formatted vertex text description and the formatted edge text description.

[0190] In an exemplary embodiment, the template construction module 906 is further configured to obtain first feature description data of abnormal resource interaction behavior and second feature description data of non-suspicious resource interaction behavior;

[0191] The sample example is determined based on the first feature description data and the second feature description data;

[0192] Obtain the prompt title, task, and output format of the large language model, and construct a preset sample prompt template according to the preset format based on the prompt title, task, output format, and sample example.

[0193] In an exemplary embodiment, the template building module 906 is further configured to embed the structured subgraph text into the placeholder position of the test data in the task to obtain the verification prompt template.

[0194] The format uniformity of the verification prompt template is validated to obtain a complete prompt template that meets the input requirements of the large language model.

[0195] In an exemplary embodiment, the inference module 908 is used to input the complete prompt template into the large language model. Based on the sample examples and prompt titles in the complete prompt template, the large language model infers the structured subgraph text and generates an inference result on whether the target subgraph has abnormal resource interaction behavior. The inference result is then output according to the output format.

[0196] Each module in the aforementioned abnormal resource interaction behavior detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0197] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a method for detecting abnormal resource interaction behavior. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0198] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0199] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0200] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0201] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0202] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0203] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0204] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0205] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.< / edges> < / nodes> < / edges> < / nodes> < / edges> < / nodes>

Claims

1. A method for detecting abnormal resource interaction behavior, characterized in that, The method includes: Obtain the original knowledge graph, and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node; Determine the subgraph structure information of the target subgraph, and perform format conversion on the subgraph structure information to obtain structured subgraph text in a preset structured text format; Obtain a preset sample prompt template, and generate a complete prompt template that meets the input requirements of a large language model based on the structured subgraph text and the preset sample prompt; The complete prompt template is input into the large language model for inference, generating an inference result indicating whether the target subgraph exhibits abnormal resource interaction behavior.

2. The method according to claim 1, characterized in that, The process of obtaining the original knowledge graph includes: The original knowledge graph is obtained from the Neo4j graph database. The graph structure information of the original knowledge graph includes a set of nodes, a set of edges, and a set of attributes. The set of nodes includes multiple account nodes. The edges in the set of edges represent the resource interaction behavior between two associated account nodes. The set of attributes includes the account node attribute information of each account node and the resource interaction behavior attribute information of each edge.

3. The method according to claim 1, characterized in that, The step of extracting a target subgraph from the original knowledge graph, consisting of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node, includes: Obtain the attribute set of the original knowledge graph, and determine the target transaction edge that meets the preset suspicious transaction conditions from the original knowledge graph based on the account node attribute information and resource interaction behavior attribute information of each edge in the attribute set. The account nodes at both ends of the target transaction edge are obtained as target account nodes. Taking each target account node as the starting account node, all directly adjacent account nodes of the starting account node are visited, and the process is progressively advanced to the unvisited directly adjacent account nodes of each directly adjacent account node until the diffusion depth reaches a preset K-hop threshold, thus obtaining the target subgraph.

4. The method according to any one of claims 1 to 3, characterized in that, The step of converting the subgraph structure information to obtain structured subgraph text in a preset structured text format includes: Determine the account node attribute information of each account node and the resource interaction behavior attribute information of each edge in the subgraph structure information, and convert the account node attribute information according to the preset node formatting template to obtain the formatted vertex text description. The resource interaction behavior attribute information is formatted according to a preset edge formatting template to obtain a formatted edge text description. The structured subgraph text is obtained based on the formatted vertex text description and the formatted edge text description.

5. The method according to any one of claims 1 to 3, characterized in that, The method for obtaining the preset sample prompt template includes: Obtain first characteristic description data of abnormal resource interaction behavior and second characteristic description data of non-suspicious resource interaction behavior; A sample example is determined based on the first feature description data and the second feature description data; Obtain the prompt title, task, and output format of the large language model, and construct a preset sample prompt template according to the prompt title, task, output format, and sample example in a preset format.

6. The method according to claim 5, characterized in that, The step of generating a complete prompt template that meets the input requirements of a large language model based on the structured subgraph text and the preset sample prompt template includes: The structured subgraph text is embedded into the placeholder position of the test data in the task to obtain the verification prompt template; The format uniformity of the prompt template to be verified is validated to obtain a complete prompt template that meets the input requirements of the large language model.

7. The method according to claim 6, characterized in that, The step of inputting the complete prompt template into the large language model for reasoning and generating a reasoning result on whether the target subgraph exhibits abnormal resource interaction behavior includes: The complete prompt template is input into the large language model. Based on the sample examples and prompt titles in the complete prompt template, the large language model infers the structured subgraph text and generates an inference result on whether the target subgraph has abnormal resource interaction behavior. The reasoning results are output according to the output format.

8. An abnormal resource interaction behavior detection device, characterized in that, The device includes: The subgraph extraction module is used to obtain the original knowledge graph and extract the target subgraph from the original knowledge graph, which consists of the target account node corresponding to the target transaction edge and the adjacent account nodes associated with the target account node. The format conversion module is used to determine the subgraph structure information of the target subgraph, convert the subgraph structure information into a format, and obtain a structured subgraph text in a preset structured text format. The template construction module is used to obtain a preset sample prompt template and generate a complete prompt template that meets the input requirements of the large language model based on the structured subgraph text and the preset sample prompt. The reasoning module is used to input the complete prompt template into the large language model for reasoning and generate a reasoning result on whether the target subgraph has abnormal resource interaction behavior.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images