Account risk identification method and device, equipment, medium and program product

Abstract

The invention provides an account risk identification method which can be applied to the field of big data. The account risk identification method comprises the steps of obtaining customer identity information, account attribute information and account transaction information of each to-be-identified account in a plurality of to-be-identified accounts; checking the customer identity information of each account to be recognized in the plurality of accounts to be recognized, and screening out a plurality of suspicious accounts from the plurality of accounts to be recognized according to an obtained checking result; constructing a relation graph according to the client identity information, the account attribute information and the account transaction information of each suspicious account in the plurality of suspicious accounts by using a graph processing framework; the relation graph is processed through a preset graph algorithm, a processing result is obtained, and the preset graph algorithm is used for recognizing abnormal nodes in the relation graph; and determining risk information of the plurality of accounts to be identified according to the processing result. The invention further provides an account risk identification device and equipment, a medium and a program product.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of big data, and in particular to an account risk identification method, device, equipment, medium and program product. BACKGROUND

[0002] In some examples, traditional bank account risk detection mainly relies on preset rule library to analyze isolated transaction behavior of a single account. When there is a risk account in multiple associated accounts, the risk information of the account cannot be accurately identified. SUMMARY

[0003] In view of the above problems, the present application provides an account risk identification method, device, equipment, medium and program product for improving the accuracy of account risk identification.

[0004] According to a first aspect of the present application, an account risk identification method is provided, comprising: obtaining customer identity information, account attribute information and account transaction information of each of a plurality of to-be-identified accounts; verifying the customer identity information of each of the plurality of to-be-identified accounts, and screening a plurality of suspicious accounts from the plurality of to-be-identified accounts according to the obtained verification result; using a graph processing framework, constructing a relationship graph according to the customer identity information, the account attribute information and the account transaction information of each of the plurality of suspicious accounts, wherein the relationship graph is composed of a plurality of nodes, the plurality of nodes are connected to each other through edges, a node represents a customer identity or an account attribute corresponding to a suspicious account, and an edge represents an association between different nodes; processing the relationship graph using a preset graph algorithm to obtain a processing result, wherein the preset graph algorithm is used to identify an abnormal node in the relationship graph; and determining risk information of the plurality of to-be-identified accounts according to the processing result.

[0005] According to an embodiment of the present application, the processing result obtained by processing the relationship graph using the preset graph algorithm comprises: performing associated transaction analysis on the relationship graph using the preset graph algorithm to obtain at least one abnormal node; determining a relationship subgraph based on the relationship graph according to the edges connected to the at least one abnormal node, wherein the relationship subgraph at least includes the at least one abnormal node; and determining the processing result according to the account transaction information between each node in the relationship subgraph, wherein the processing result represents an account type of an account corresponding to each node in the relationship subgraph.

[0006] According to an embodiment of the present application, the associated transaction analysis on the relationship graph using the preset graph algorithm to obtain at least one abnormal node comprises: performing associated transaction analysis on the relationship graph using a plurality of preset graph algorithms to obtain at least one abnormal node, wherein the plurality of preset graph algorithms at least include a community discovery algorithm, a centrality analysis algorithm, a betweenness centrality algorithm and a path analysis algorithm.

[0007] According to an embodiment of the present application, the relationship sub-graph is determined based on the relationship graph according to edges connected to the at least one abnormal node, including: filtering at least one associated node from the relationship graph according to edges connected to the at least one abnormal node, wherein the associated node is connected to the abnormal node through at least one edge; and determining the relationship sub-graph according to the at least one abnormal node and the at least one associated node.

[0008] According to an embodiment of the present application, the processing result is determined according to the account transaction information between the nodes in the relationship sub-graph, including: determining the transaction characteristics of each node in the relationship sub-graph according to the account transaction information between the nodes in the relationship sub-graph; and determining the account type of the account corresponding to each node in the relationship sub-graph according to the transaction characteristics of each node in the relationship sub-graph by using a preset rule library to obtain the processing result, wherein the preset rule library represents the mapping relationship between different transaction characteristics and account types.

[0009] According to an embodiment of the present application, the risk information of the plurality of to-be-identified accounts is determined according to the processing result, including: determining a first risk level corresponding to each account type according to the account type of the account corresponding to each node in the relationship sub-graph represented by the processing result; determining a normal node belonging to the relationship graph and not belonging to the relationship sub-graph from the relationship graph according to the relationship graph and the relationship sub-graph, and determining a second risk level of the account corresponding to the normal node, wherein the account risk represented by the first risk level is higher than the account risk represented by the second risk level.

[0010] According to an embodiment of the present application, the customer identity information of each to-be-identified account in the plurality of to-be-identified accounts is verified, and a plurality of suspicious accounts are selected from the plurality of to-be-identified accounts according to the obtained verification result, including: verifying the customer identity information of each to-be-identified account in the plurality of to-be-identified accounts to obtain a verification result; and determining the to-be-identified account corresponding to the verification result as a suspicious account in a case where the verification result represents that the customer identity verification is inconsistent, or the mobile phone number real-name verification fails, or there is a judicial risk in the customer identity information.

[0011] The second aspect of the present application provides an account risk identification device, comprising: an acquisition module configured to acquire customer identity information, account attribute information and account transaction information of each of a plurality of to-be-identified accounts; a verification module configured to verify the customer identity information of each of the plurality of to-be-identified accounts, and filter a plurality of suspicious accounts from the plurality of to-be-identified accounts according to a verification result obtained; a construction module configured to construct a relationship graph according to the customer identity information, the account attribute information and the account transaction information of each of the plurality of suspicious accounts by using a graph processing framework, wherein the relationship graph is composed of a plurality of nodes, the plurality of nodes are connected to each other by edges, a node represents a customer identity or an account attribute corresponding to a suspicious account, and an edge represents an association between different nodes; a processing module configured to process the relationship graph by using a preset graph algorithm to obtain a processing result, wherein the preset graph algorithm is used to identify an abnormal node in the relationship graph; and a determination module configured to determine risk information of the plurality of to-be-identified accounts according to the processing result.

[0012] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory configured to store one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method.

[0013] The fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions are executed by a processor to implement the steps of the method.

[0014] The fifth aspect of the present application further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the method. BRIEF DESCRIPTION OF DRAWINGS

[0015] The above content of the present application and other purposes, features and advantages will be more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0016] Figure 1 An application scenario diagram of an account risk identification method, device, equipment, medium and program product according to an embodiment of the present application is schematically shown;

[0017] Figure 2 A flowchart of an account risk identification method according to an embodiment of the present application is schematically shown;

[0018] Figure 3 A flowchart of an account risk identification method according to another embodiment of the present application is schematically shown;

[0019] Figure 4A structural block diagram of an account risk identification apparatus according to an embodiment of the present application is schematically shown; and

[0020] Figure 5 A block diagram of an electronic device suitable for implementing an account risk identification method according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0021] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely exemplary and is not intended to limit the scope of the application. In the following detailed description of the embodiments of the present application, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that one or more embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present application.

[0022] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present application. The terms "include", "comprise" and the like used herein indicate the presence of the features, steps, operations and / or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

[0023] All terms used herein, including technical and scientific terms, have the meanings commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the specification, and should not be interpreted in an idealized or overly formal manner.

[0024] In the case of using expressions similar to "at least one of A, B, and C, etc.", in general, it should be interpreted as having the meaning of including at least one of the elements, but not limited to the meaning of including all of the elements. For example, "a system having at least one of A, B, and C" should be interpreted as including a system having only A, a system having only B, a system having only C, a system having both A and B, a system having both A and C, a system having both B and C, and / or a system having A, B, and C, etc.

[0025] In the technical solutions of the present application, the user information (including but not limited to user personal information, user image information, user equipment information, such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal.

[0026] In the scenario of making automated decisions by using personal information, the method, device and system provided by the embodiments of the present application all provide corresponding operation entrances for the user to select to agree or reject the automated decision result; if the user selects to reject, the expert decision process is entered. The expression "automated decision" here refers to the activity of automatically analyzing, evaluating the personal behavior habits, interests and hobbies, or economic, health, credit status, etc. by a computer program, and making decisions. The expression "expert decision" here refers to the activity of making decisions by personnel who are engaged in a certain field of work, have special experience, knowledge and skills, and reach a certain professional level.

[0027] Figure 1 An application scenario diagram of the account risk identification method, apparatus, device, medium and program product according to the embodiments of the present application is schematically shown.

[0028] As shown in Figure 1 The application scenario 100 according to the embodiments can include the financial technology field. The network 104 is a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0029] The user can use the first terminal device 101, the second terminal device 102, the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0030] The first terminal device 101, the second terminal device 102, the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0031] The server 105 can be a server providing various services, such as a background management server supporting the website browsed by the user using the first terminal device 101, the second terminal device 102, the third terminal device 103 (only as an example). The background management server can analyze and process the received user request data, etc., and feed back the processing result (such as a web page, information, or data, etc. obtained or generated according to the user request) to the terminal device.

[0032] It should be noted that the account risk identification method provided in the embodiments of the present application can be generally executed by the server 105. Accordingly, the account risk identification apparatus provided in the embodiments of the present application can be generally arranged in the server 105. The account risk identification method provided in the embodiments of the present application can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the account risk identification apparatus provided in the embodiments of the present application can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0033] It should be understood that Figure 1 The number of terminal devices, networks and servers in the above-mentioned scenario is only illustrative. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0034] The account risk identification method according to the embodiments of the present application will be described in detail below based on the scenario described above. Figure 1 Figures 2-5 The account risk identification method according to the embodiments of the present application will be described in detail below based on the scenario described above.

[0035] Figure 2 An illustrative flowchart of the account risk identification method according to the embodiments of the present application is shown.

[0036] As shown in Figure 2 The account risk identification method of this embodiment includes operations S210-S250, which can be executed by a server.

[0037] In operation S210, the customer identity information, the account attribute information and the account transaction information of each of the plurality of to-be-identified accounts are acquired.

[0038] In the embodiments of the present application, the to-be-identified account refers to a bank account that needs to be subjected to risk identification, and the plurality of to-be-identified accounts are the basic objects processed by the account risk identification method of the present embodiment. For example, a certain bank needs to perform account risk identification on all of its personal savings accounts, and these accounts are the to-be-identified accounts.

[0039] In the embodiments of the present application, the customer identity information, the account attribute information and the account transaction information of each to-be-identified account are acquired. The customer identity information refers to data used to identify the real identity of the account holder. For example, the customer identity information can include the customer's name, ID number, mobile phone number, permanent address, etc.

[0040] ​The account attribute information refers to data describing the static characteristics of the account. For example, the account attribute information can include the account type (e.g., a corporate account, a private account), the opening date, the account status (e.g., normal, frozen, closed), and the like.

[0041] The account transaction information refers to the dynamic behavior data generated by the account in the historical operation. For example, the account transaction information can include the transaction time, the transaction amount, the transaction counterpart account, the transaction type (e.g., transfer, consumption, deposit), the transaction channel (counter, online banking), and the like.

[0042] In the embodiments of the present application, the customer identity information, the account attribute information, and the account transaction information of each of the plurality of to-be-identified accounts are obtained. This step is a data preparation phase, and the system can collect multi-dimensional data related to the to-be-identified account from the internal system of the bank and external data sources (e.g., a credit investigation agency, a judicial platform).

[0043] In operation S220, the customer identity information of each of the plurality of to-be-identified accounts is verified, and a plurality of suspicious accounts are selected from the plurality of to-be-identified accounts according to the verification result.

[0044] In the embodiments of the present application, the suspicious account refers to a to-be-identified account that is preliminarily determined to have abnormalities or risks after the verification of the customer identity information. For example, the account whose identity information verification is inconsistent, whose name and ID number do not match, or whose mobile phone number does not pass the real-name verification.

[0045] In the embodiments of the present application, the customer identity information of each of the plurality of to-be-identified accounts is verified, and a plurality of suspicious accounts are selected from the plurality of to-be-identified accounts according to the verification result. The step of this embodiment is a preliminary screening phase, and through the verification of the authenticity and compliance of the basic identity information, the account with obvious abnormalities or high risks can be quickly filtered out.

[0046] In operation S230, a relationship graph is constructed by using a graph processing framework according to the customer identity information, the account attribute information, and the account transaction information of each of the plurality of suspicious accounts, wherein the relationship graph is composed of a plurality of nodes, the plurality of nodes are connected to each other through edges, the node represents the customer identity or the account attribute corresponding to the suspicious account, and the edge represents the association between different nodes.

[0047] In the embodiments of the present application, the graph processing framework refers to a software tool or platform for constructing, storing, calculating, and analyzing the relationship graph. The graph processing framework can include a graph database and a graph computing engine.

[0048] In the embodiments of the present application, the relationship graph is a data structure for representing entities and the relationships therebetween. In the embodiments, the relationship graph is composed of nodes and edges. A node represents an entity, and the node specifically represents a customer identity or an account attribute corresponding to a suspicious account, such as a specific bank account. An edge represents an association relationship between different nodes, for example, two account nodes are connected by an edge because a transfer transaction has occurred between the two accounts, and two customer identity nodes are connected by an edge because they share a same mobile phone number or address.

[0049] In the embodiments of the present application, a graph processing framework is used to construct a relationship graph according to the customer identity information, account attribute information and account transaction information of each suspicious account in a plurality of suspicious accounts. The steps of the embodiments describe the graph construction phase, and the system converts the suspicious accounts screened out and their associated data into a graph model. Each suspicious account and its associated entities become nodes, and various relationships therebetween become edges, thereby forming an interconnected network.

[0050] For example, accounts A, B and C are taken as nodes. Because A has transferred money to B, B has transferred money to C, and A and C share a same registered mobile phone number, the system establishes an edge between A-B and B-C to represent a transaction relationship, and an edge between A-C to represent a “shared mobile phone number” relationship.

[0051] For example, customer A, accounts B and C are taken as nodes. Because B has transferred money to C, and customer A is the holder of account B and the holder of account C, the system establishes an edge between B-C to represent a transaction relationship, and edges between A-B and A-C to represent “account holder” relationships.

[0052] In operation S240, a preset graph algorithm is used to process the relationship graph to obtain a processing result, wherein the preset graph algorithm is used to identify abnormal nodes in the relationship graph.

[0053] In the embodiments of the present application, the preset graph algorithm refers to an algorithm that is preset in the graph processing framework and is used to analyze the structural features of the relationship graph. The purpose of the preset graph algorithm is to identify nodes that exhibit abnormalities in connection patterns, i.e., abnormal nodes.

[0054] In the embodiments of the present application, the relationship graph is processed by using the preset graph algorithm to obtain a processing result. The processing result refers to the output obtained after the relationship graph is analyzed by using the preset graph algorithm. The system runs the preset graph algorithm to analyze the relationship graph from the perspective of the global network structure, and the algorithm can quantify the structural features (such as centrality and connectivity) of each node, and thus find nodes that are difficult to detect in an isolated perspective but exhibit abnormalities in network relationships.

[0055] For example, in the relationship graph constructed by accounts A, B, C, etc., the preset graph algorithm analysis finds that account B, although its own transaction amount is not large, is at the key connection point of multiple transaction paths, and therefore node B is identified as an abnormal node.

[0056] In operation S250, the risk information of the plurality of to-be-identified accounts is determined according to the processing result.

[0057] In the embodiments of the present application, the risk information of the plurality of to-be-identified accounts is determined according to the processing result. The system maps the processing result obtained by graph analysis into specific risk information. The risk level of the account identified as an abnormal node will be significantly improved. The risk information refers to the final output risk assessment conclusion about the plurality of to-be-identified accounts. For example, the risk information can include a risk score, a risk level (such as high risk, medium risk, and low risk), or a risk label list.

[0058] For example, based on the processing result, the system finally outputs a risk report, account B is marked as “high risk”, and accounts A and C directly associated with B are marked as “medium risk”. Other suspicious accounts in the relationship graph that are not identified as abnormal by the algorithm are marked as “low risk”.

[0059] Through the embodiments of the present application, the suspicious accounts preliminarily screened out and their associated data are constructed into a relationship graph, and a preset graph algorithm is used to process the relationship graph to obtain a processing result, and the risk information of the plurality of to-be-identified accounts is determined based on the processing result. The method of the present embodiment can break through the limitation of a single account data dimension, deeply mine the hidden and complex gang risk characteristics between accounts, and thus effectively improve the accuracy of risk identification.

[0060] Figure 3 A flowchart of an account risk identification method according to another embodiment of the present application is schematically shown.

[0061] As shown in FIG. 3, in some embodiments, the processing of the relationship graph by the preset graph algorithm to obtain the processing result includes operations S310-S330. Figure 3

[0062] In operation S310, the relationship graph is analyzed by the preset graph algorithm for associated transactions to obtain at least one abnormal node.

[0063] In the embodiments of the present application, the associated transaction analysis refers to the process of using a preset graph algorithm to mine the relationship graph to find the business association mode with potential risks between nodes. The purpose is to identify abnormal nodes that deviate from the normal connection mode.

[0064] ​In embodiments of the present application, the preset graph algorithm is used to analyze the correlation transaction of the relationship graph, and at least one abnormal node is obtained. The abnormal node refers to a node that is identified by the preset graph algorithm through correlation transaction analysis and exhibits significant abnormal characteristics in the graph structure. For example, an account node that has short-term intensive transaction connection with thousands of other nodes may be determined as an abnormal node.

[0065] In embodiments of the present application, the system applies the preset graph algorithm to the global relationship graph, for example, the abnormal degree of each node can be quantified by calculating the centrality of the node, detecting community structure or identifying specific patterns, so as to locate the abnormal node.

[0066] For example, in a huge relationship graph constructed by thousands of suspicious accounts, the preset graph algorithm can calculate the weight of each node. It is found that the weight value of account X is abnormally high, much higher than that of other nodes in the graph, indicating that it is the central hub of the network, and therefore the node corresponding to account X can be determined as an abnormal node.

[0067] In operation S320, a relationship sub-graph is determined based on the relationship graph according to the edges connected to the at least one abnormal node, wherein the relationship sub-graph at least includes the at least one abnormal node.

[0068] In embodiments of the present application, the relationship sub-graph is determined based on the relationship graph according to the edges connected to the at least one abnormal node. The system takes the discovered abnormal node as the starting point, traces all edges directly connected to it, and finds other nodes connected by these edges (i.e. neighbor nodes), thereby extracting a local network with the abnormal node as the core, i.e. a relationship sub-graph. The relationship sub-graph refers to a local graph selected from the complete relationship graph according to specific conditions. The relationship sub-graph contains the abnormal node and its closely related nodes and edges.

[0069] For example, after locking the abnormal node X, the system traverses all edges starting from X and pointing to X, finds account nodes A directly associated with X, and B and C indirectly associated with X (B and C are connected to A), as well as the mutual association between these nodes. Thus, nodes X, A, B, C and all edges between them together constitute a relationship sub-graph.

[0070] In operation S330, a processing result is determined according to the account transaction information between the nodes in the relationship sub-graph, wherein the processing result represents the account type of the accounts corresponding to the nodes in the relationship sub-graph.

[0071] In embodiments of the present application, the system focuses on analyzing the specific account transaction information between the nodes in the narrowed relationship sub-graph, thereby qualitatively analyzing the behavior pattern of the gang, and classifying the nodes in the graph into different account types.

[0072] For example, in a relationship sub-graph containing nodes X, A, B, C, the system analyzes the transaction flow and finds that A, B, and C frequently make small transfers to X, and X makes large transfers to an overseas account at irregular intervals. Based on this pattern, the system can determine the processing result as: marking X as a “money pooling account” and marking A, B, and C as “dispersed transfer accounts”.

[0073] Through the embodiments of the present application, by accurately positioning the abnormal nodes from the global relationship graph and extracting the relationship sub-graph for targeted analysis, the high-risk core group can be effectively focused on, and the accuracy and efficiency of risk identification are significantly improved, and the waste of global computing resources is avoided.

[0074] In some embodiments, the relationship graph is analyzed for associated transactions using a plurality of preset graph algorithms to obtain at least one abnormal node, including: the relationship graph is analyzed for associated transactions using a plurality of preset graph algorithms to obtain at least one abnormal node, wherein the plurality of preset graph algorithms at least include a community discovery algorithm, a centrality analysis algorithm, a betweenness centrality algorithm, and a path analysis algorithm.

[0075] In the embodiments of the present application, the relationship graph is analyzed for associated transactions using a plurality of preset graph algorithms to obtain at least one abnormal node. Unlike using a single algorithm, the method of the present embodiment uses a tool set composed of multiple algorithms to analyze the relationship graph from multiple angles and in a three-dimensional manner. Each algorithm reveals different aspects of abnormal patterns, and the analysis results can be verified with each other, so that the abnormal nodes can be located more comprehensively and reliably.

[0076] In the embodiments of the present application, the plurality of preset graph algorithms at least include a community discovery algorithm, a centrality analysis algorithm, a betweenness centrality algorithm, and a path analysis algorithm. The community discovery algorithm is a preset graph algorithm for automatically detecting tightly connected groups in a network. The community discovery algorithm can divide a large relationship graph into several “communities” with dense internal connections and sparse external connections, thereby preliminarily outlining the boundaries of potential gangs.

[0077] The centrality analysis algorithm is a class of preset graph algorithms for quantifying the importance and influence of nodes in a network. The centrality analysis algorithm identifies key accounts located at the core of the network by calculating indicators such as degree centrality and eigenvector centrality.

[0078] The betweenness centrality algorithm is a specific centrality analysis algorithm for measuring the degree to which a node serves as a “shortest path bridge” between other nodes. The higher the value, the stronger the control of the node over the flow of information in the network.

[0079] Path analysis algorithm is a kind of preset graph algorithm for exploring and evaluating the connection path between nodes. Path analysis algorithm can find the shortest path, all possible paths or paths of a specific mode between nodes, which is used to track the chain of fund flow or verify the association.

[0080] Through the embodiments of the present application, by adopting multiple graph algorithms for collaborative analysis, the abnormal nodes can be cross-verified from multiple dimensions such as relationship graph structure, node importance and path association, which significantly improves the accuracy, comprehensiveness and anti-interference ability of risk identification, and effectively reduces false positives and false negatives.

[0081] In some embodiments, the relationship subgraph is determined based on the relationship graph according to the edges connected to the at least one abnormal node, comprising: filtering at least one associated node from the relationship graph according to the edges connected to the at least one abnormal node, wherein the associated node is connected to the abnormal node through at least one edge; determining the relationship subgraph according to the at least one abnormal node and the at least one associated node.

[0082] In the embodiments of the present application, at least one associated node is filtered from the relationship graph according to the edges connected to the at least one abnormal node. The associated node refers to other nodes directly connected to the abnormal node through at least one edge in the relationship graph. These nodes have direct or indirect business or attribute association with the abnormal node, and are an important part of the direct relationship network. The system takes one or more identified abnormal nodes as the starting point of exploration, traverses all edges directly connected to the abnormal node, and the nodes at the other end of the edges, i.e. the associated nodes. The associated nodes can also include nodes indirectly connected to the abnormal node, for example, node A is connected to node B, and node B is connected to node C. If node A is an abnormal node, then node B and node C are associated nodes of node A.

[0083] In the embodiments of the present application, the relationship subgraph is determined according to the at least one abnormal node and the at least one associated node. The system takes all abnormal nodes and associated nodes filtered in the previous step as the basis, and extracts all associated edges between these nodes in the original relationship graph to form a complete and internally connected relationship subgraph.

[0084] Through the embodiments of the present application, by using the two-step method of first filtering the directly associated nodes and then constructing the subgraph, the direct relationship network centered on the abnormal node can be accurately locked, and the interference of irrelevant data can be effectively excluded.

[0085] In some embodiments, the processing result is determined according to the account transaction information between the nodes in the relationship sub-graph, including: determining the transaction characteristics of each node in the relationship sub-graph according to the account transaction information between the nodes in the relationship sub-graph; and determining the account type of the account corresponding to each node in the relationship sub-graph according to the transaction characteristics of each node in the relationship sub-graph by using a preset rule library, to obtain the processing result, wherein the preset rule library represents the mapping relationship between different transaction characteristics and account types.

[0086] In the embodiments of the present application, the transaction characteristics of each node in the relationship sub-graph are determined according to the account transaction information between the nodes in the relationship sub-graph. The transaction characteristics refer to indexes that can quantitatively describe the transaction behavior mode extracted from the account transaction information between the nodes in the relationship sub-graph. These characteristics are the quantitative basis for risk classification. The system performs quantitative analysis on the screened relationship sub-graph, and calculates the specific and measurable transaction characteristics of each node in the system from the account transaction information connected thereto.

[0087] In the embodiments of the present application, the account type of the account corresponding to each node in the relationship sub-graph is determined according to the transaction characteristics of each node in the relationship sub-graph by using a preset rule library, to obtain the processing result. The system compares the transaction characteristics of each node with the rules in the preset rule library. Each rule defines that when certain characteristics meet certain conditions, the account should be assigned to what kind of account type. By performing matching, the system automatically assigns one or more type labels to each node to obtain the final processing result.

[0088] For example, the preset rule library can include the rule: “IF (transaction number > 30 times / day) AND (transfer-out amount ratio > 80%) AND (transaction time concentration > 70%) THEN account type = ‘dispersed transfer device’”. The system compares the transaction characteristics of the account M with this rule, and the conditions are completely met, so the account type of the account M is determined as “dispersed transfer device”.

[0089] Through the embodiments of the present application, by converting the graph structure analysis into quantifiable transaction characteristics and using the preset rule library for automatic mapping, the standardized and automated determination of the risk account type is realized, and the objectivity, consistency and processing efficiency of the classification result are significantly improved.

[0090] In some embodiments, according to the processing result, the risk information of the plurality of to-be-identified accounts is determined, including: determining a first risk level corresponding to each account type of the accounts corresponding to each node in the relationship sub-graph represented according to the processing result; determining a second risk level of accounts corresponding to normal nodes in the relationship graph but not in the relationship sub-graph according to the relationship graph and the relationship sub-graph, wherein the account risk represented by the first risk level is higher than the account risk represented by the second risk level.

[0091] In the embodiments of the present application, according to the account types of the accounts corresponding to each node in the relationship sub-graph represented according to the processing result, a first risk level corresponding to each account type is determined. The first risk level refers to the risk level allocated to the accounts corresponding to the nodes in the relationship sub-graph based on the processing result. The first risk level is used to identify high-risk accounts confirmed after depth analysis by the graph algorithm.

[0092] In the embodiments of the present application, according to the relationship graph and the relationship sub-graph, normal nodes in the relationship graph but not in the relationship sub-graph are determined, and a second risk level of accounts corresponding to the normal nodes is determined. The normal node refers to a node in the relationship graph that does not belong to the relationship sub-graph. The normal node is included in the graph due to preliminary screening, but does not participate in the subsequent discovery of high-risk association patterns.

[0093] In the embodiments of the present application, the second risk level refers to the risk level allocated to the accounts corresponding to the normal nodes. The account risk represented by the second risk level is lower than the account risk represented by the first risk level.

[0094] Through the embodiments of the present application, by distinguishing the accounts in the graph into high-risk relationship sub-graph members and ordinary nodes, and implementing differentiated risk level management, the risk is finely classified. The method of the present embodiment can focus the monitoring resources on the core high-risk groups, greatly improving the efficiency and pertinence of risk control.

[0095] In some embodiments, the customer identity information of each to-be-identified account in the plurality of to-be-identified accounts is verified, and a plurality of suspicious accounts are selected from the plurality of to-be-identified accounts according to the obtained verification result, including: verifying the customer identity information of each to-be-identified account in the plurality of to-be-identified accounts to obtain a verification result; in the case that the verification result represents that the customer identity verification is inconsistent, or the mobile phone number real name verification fails, or there is a judicial risk in the customer identity information, determining the to-be-identified account corresponding to the verification result as a suspicious account.

[0096] In the embodiments of the present application, the customer identity information of each to-be-identified account in the plurality of to-be-identified accounts is verified to obtain a verification result. The system can automatically call internal and external interfaces to perform a preset multi-dimensional verification on the customer identity information of the to-be-identified account, and the conclusions of each verification are summarized as a complete verification result.

[0097] For example, the system verifies the customer identity information of account A, verifies whether the name and the ID number are matched, verifies whether the real-name information of the mobile phone number is matched, and verifies whether the customer has a case record. Finally, the verification result of account A is obtained.

[0098] In the embodiments of the present application, in the case that the verification result represents that the customer identity verification is inconsistent, or the mobile phone number real-name verification fails, or the customer identity information has a judicial risk, the to-be-identified account corresponding to the verification result is determined as a suspicious account. The method of the present embodiment sets a logical "or" determination rule, that is, as long as any one of the verification results appears a preset negative conclusion (inconsistent identity, non-real-name mobile phone number, or judicial risk), the determination condition is triggered, and the account is included in the suspicious account set.

[0099] Through the embodiments of the present application, by setting clear and automatically executable verification standards and determination logic, the standardization and automation of suspicious account preliminary screening are realized, and the screening efficiency and objectivity are improved.

[0100] Based on the above account risk identification method, the present application further provides an account risk identification device. The following will be described in detail Figure 4 The device.

[0101] Figure 4 The structure block diagram of the account risk identification device according to the embodiments of the present application is schematically shown.

[0102] As Figure 4 shown, the account risk identification device 400 of the present embodiment includes an acquisition module 410, a verification module 420, a construction module 430, a processing module 440, and a determination module 450.

[0103] The acquisition module 410 is configured to acquire the customer identity information, the account attribute information, and the account transaction information of each to-be-identified account in the plurality of to-be-identified accounts. In an embodiment, the acquisition module 410 can be configured to perform the operation S210 described above, and details are not repeated here.

[0104] The verification module 420 is configured to verify the customer identity information of each to-be-identified account in the plurality of to-be-identified accounts, and to filter a plurality of suspicious accounts from the plurality of to-be-identified accounts according to the obtained verification result. In an embodiment, the verification module 420 can be configured to perform the operation S220 described above, and details are not repeated here.

[0105] The constructing module 430 is configured to construct a relationship graph based on the customer identity information, the account attribute information and the account transaction information of each suspicious account in the plurality of suspicious accounts by using a graph processing framework, where the relationship graph is composed of a plurality of nodes connected to each other by edges, the nodes represent the customer identity or the account attribute corresponding to the suspicious accounts, and the edges represent the association between different nodes. In an embodiment, the constructing module 430 can be configured to perform the operation S230 described above, and details are not described herein again.

[0106] The processing module 440 is configured to process the relationship graph by using a preset graph algorithm to obtain a processing result, where the preset graph algorithm is used to identify an abnormal node in the relationship graph. In an embodiment, the processing module 440 can be configured to perform the operation S240 described above, and details are not described herein again.

[0107] The determining module 450 is configured to determine the risk information of the plurality of to-be-identified accounts based on the processing result. In an embodiment, the determining module 450 can be configured to perform the operation S250 described above, and details are not described herein again.

[0108] According to the embodiments of the present application, the suspicious accounts and the associated data preliminarily screened out are constructed into a relationship graph, the relationship graph is processed by using a preset graph algorithm to obtain a processing result, and the risk information of the plurality of to-be-identified accounts is determined based on the processing result. The device of the present embodiment can break through the limitation of a single account data dimension, deeply mine the hidden and complex gang risk features between accounts, and thus effectively improve the accuracy of risk identification.

[0109] According to an embodiment of the present application, any of the modules of the obtaining module 410, the checking module 420, the constructing module 430, the processing module 440 and the determining module 450 can be combined in one module, or any of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of the modules can be combined with at least part of the functions of the other modules, and implemented in one module. According to an embodiment of the present application, at least one of the obtaining module 410, the checking module 420, the constructing module 430, the processing module 440 and the determining module 450 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc. in hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of the above. Alternatively, at least one of the obtaining module 410, the checking module 420, the constructing module 430, the processing module 440 and the determining module 450 can be at least partially implemented as a computer program module which can perform the corresponding functions when the computer program module is run.

[0110] In some embodiments, the processing module comprises: an analyzing submodule configured to perform correlation transaction analysis on the relationship graph by using a preset graph algorithm to obtain at least one abnormal node; a first determining submodule configured to determine a relationship subgraph based on the relationship graph according to edges connected to the at least one abnormal node, wherein the relationship subgraph comprises at least the at least one abnormal node; and a second determining submodule configured to determine a processing result according to account transaction information between nodes in the relationship subgraph, wherein the processing result represents an account type of an account corresponding to each node in the relationship subgraph.

[0111] In some embodiments, the analyzing submodule comprises: an analyzing unit configured to perform correlation transaction analysis on the relationship graph by using a plurality of preset graph algorithms to obtain at least one abnormal node, wherein the plurality of preset graph algorithms comprise at least a community discovery algorithm, a centrality analysis algorithm, a betweenness centrality algorithm and a path analysis algorithm.

[0112] In some embodiments, the first determining submodule comprises: a screening unit configured to screen at least one associated node from the relationship graph according to edges connected to the at least one abnormal node, wherein the associated node is connected to the abnormal node by at least one edge; and a first determining unit configured to determine the relationship subgraph according to the at least one abnormal node and the at least one associated node.

[0113] In some embodiments, the second determining sub-module comprises: a second determining unit, configured to determine transaction features of each node in the relationship sub-graph according to the account transaction information between each node in the relationship sub-graph; and a third determining unit, configured to determine account types of accounts corresponding to each node in the relationship sub-graph according to the transaction features of each node in the relationship sub-graph by using a preset rule base, to obtain a processing result, wherein the preset rule base represents a mapping relationship between different transaction features and account types.

[0114] In some embodiments, the determining module comprises: a third determining sub-module, configured to determine a first risk level corresponding to each account type according to the account types of accounts corresponding to each node in the relationship sub-graph represented by the processing result; and a fourth determining sub-module, configured to determine a normal node belonging to the relationship graph but not belonging to the relationship sub-graph from the relationship graph according to the relationship graph and the relationship sub-graph, and determine a second risk level of an account corresponding to the normal node, wherein the account risk represented by the first risk level is higher than the account risk represented by the second risk level.

[0115] In some embodiments, the verifying module comprises: a verifying sub-module, configured to verify customer identity information of each to-be-identified account in the plurality of to-be-identified accounts, to obtain a verification result; and a fifth determining sub-module, configured to determine a to-be-identified account corresponding to the verification result as a suspicious account in a case where the verification result represents that the customer identity verification is inconsistent, or the mobile phone number real-name verification fails, or there is a judicial risk in the customer identity information.

[0116] Figure 5 A block diagram of an electronic device suitable for implementing the account risk identification method according to an embodiment of the present application is schematically shown.

[0117] As shown in Figure 5 The electronic device 500 according to an embodiment of the present application comprises a processor 501, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or loaded from a storage portion 508 to a random access memory (RAM) 503. The processor 501 can comprise, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor, and / or a related chipset, and / or a special-purpose microprocessor (such as an application-specific integrated circuit (ASIC)), and the like. The processor 501 can also comprise an on-board memory for cache use. The processor 501 can comprise a single processing unit or a plurality of processing units for performing different actions of the method processes according to embodiments of the present application.

[0118] In the RAM 503, various programs and data required for the operation of the electronic device 500 are stored. The processor 501, the ROM 502, and the RAM 503 are connected to each other via the bus 504. The processor 501 performs various operations of the method flow according to the embodiments of the present application by executing the programs in the ROM 502 and / or the RAM 503. It should be noted that the programs can also be stored in one or more memories other than the ROM 502 and the RAM 503. The processor 501 can also perform various operations of the method flow according to the embodiments of the present application by executing the programs stored in the one or more memories.

[0119] According to the embodiments of the present application, the electronic device 500 can further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 can further include one or more of the following components connected to the input / output (I / O) interface 505: an input part 506 including a keyboard, a mouse, and the like; an output part 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage part 508 including a hard disk, and the like; and a communication part 509 including a network interface card such as a LAN card, a modem, and the like. The communication part 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 510 as necessary, so that a computer program read therefrom is installed in the storage part 508 as necessary.

[0120] The present application also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present application is implemented.

[0121] According to an embodiment of the present application, the computer readable storage medium can be a non-transitory computer readable storage medium, for example, can include but not limited to: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this application, a computer readable storage medium can be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, the computer readable storage medium can include one or more memories such as the ROM 502 and / or the RAM 503 described above and / or one or more memory other than the ROM 502 and the RAM 503.

[0122] Embodiments of the present application also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the account risk identification method provided by the embodiments of the present application.

[0123] The above functions defined in the system / device of the embodiments of the present application are performed when the computer program is executed by the processor 501. According to an embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by computer program modules.

[0124] In one embodiment, the computer program can rely on tangible storage media such as optical storage media, magnetic storage media, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of signals on a network medium, and be downloaded and installed through the communication part 509, and / or installed from the detachable medium 511. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

[0125] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the detachable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiments of the present application are performed. According to an embodiment of the present application, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0126] According to embodiments of the present application, program code for implementing the computer programs provided by embodiments of the present application can be written in any combination of one or more programming languages, and can be implemented in a high-level procedural and / or object-oriented programming language, and / or in assembly / machine language. Programming languages include, but are not limited to, Java, C++, python, "C", or the like. Program code can execute entirely on a user's computing device, partly on the user's device, as a stand-alone software package, partly on a remote computing device, or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider.

[0127] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0128] Those skilled in the art will understand that features recited in the various embodiments of the present application can be combined and / or integrated in various combinations and / or permutations, even if such combinations and / or permutations are not expressly noted in the present application. In particular, features recited in the various embodiments of the present application can be combined and / or integrated in various combinations and / or permutations without departing from the spirit and teachings of the present application. All such combinations and / or integrations are within the scope of the present application.

Claims

1. A method for identifying account risks, characterized in that, The method includes: Obtain customer identity information, account attribute information, and account transaction information for each of the multiple accounts to be identified; The customer identity information of each of the multiple accounts to be identified is verified, and multiple suspicious accounts are selected from the multiple accounts to be identified based on the verification results. Using a graph processing framework, a relationship graph is constructed based on the customer identity information, account attribute information, and account transaction information of each of the multiple suspicious accounts. The relationship graph consists of multiple nodes, which are connected to each other by edges. Each node represents the customer identity or account attribute corresponding to the suspicious account, and each edge represents the association between different nodes. The relationship graph is processed using a preset graph algorithm to obtain a processing result, wherein the preset graph algorithm is used to identify abnormal nodes in the relationship graph; Based on the processing results, the risk information of the multiple accounts to be identified is determined.

2. The method according to claim 1, characterized in that, The process of processing the relationship graph using a preset graph algorithm to obtain the processing result includes: The relationship graph is analyzed using the preset graph algorithm to identify at least one abnormal node. Based on the edges connected to the at least one anomalous node, a relational subgraph is determined based on the relational graph, wherein the relational subgraph includes at least the at least one anomalous node; The processing result is determined based on the account transaction information between each node in the relational subgraph, wherein the processing result represents the account type of the account corresponding to each node in the relational subgraph.

3. The method according to claim 2, characterized in that, The step of using the preset graph algorithm to perform related transaction analysis on the relationship graph to obtain at least one abnormal node includes: The relationship graph is analyzed for related transactions using multiple preset graph algorithms to obtain at least one abnormal node. The multiple preset graph algorithms include at least a community detection algorithm, a centrality analysis algorithm, a betweenness centrality algorithm, and a path analysis algorithm.

4. The method according to claim 2, characterized in that, The step of determining a relation subgraph based on the relation graph according to the edges connected to the at least one abnormal node includes: Based on the edges connected to the at least one anomalous node, at least one associated node is selected from the relationship graph, wherein the associated node is connected to the anomalous node through at least one edge; The relationship subgraph is determined based on the at least one abnormal node and the at least one associated node.

5. The method according to claim 2, characterized in that, Determining the processing result based on the account transaction information between each node in the relational subgraph includes: Based on the account transaction information between each node in the relational subgraph, determine the transaction characteristics of each node in the relational subgraph; Using a preset rule base, the account type of each node in the relational subgraph is determined based on the transaction characteristics of each node, and the processing result is obtained. The preset rule base represents the mapping relationship between different transaction characteristics and account types.

6. The method according to claim 2, characterized in that, The step of determining the risk information of the multiple accounts to be identified based on the processing results includes: Based on the account type of each node in the relation subgraph characterized by the processing result, determine the first risk level corresponding to each account type; Based on the relationship graph and the relationship subgraph, normal nodes that belong to the relationship graph but do not belong to the relationship subgraph are determined from the relationship graph, and a second risk level is determined for the account corresponding to the normal node, wherein the account risk represented by the first risk level is higher than the account risk represented by the second risk level.

7. The method according to claim 1, characterized in that, The process involves verifying the customer identity information of each of the multiple accounts to be identified, and filtering out multiple suspicious accounts based on the verification results, including: The customer identity information of each of the multiple accounts to be identified is verified to obtain the verification result. If the verification result indicates that the customer's identity verification is inconsistent, or the real-name verification of the mobile phone number fails, or there is a legal risk in the customer's identity information, the account to be identified corresponding to the verification result will be identified as a suspicious account.

8. An account risk identification device, characterized in that, The device includes: The acquisition module is used to acquire customer identity information, account attribute information, and account transaction information for each of the multiple accounts to be identified. The verification module is used to verify the customer identity information of each of the multiple accounts to be identified, and to filter out multiple suspicious accounts from the multiple accounts to be identified based on the verification results. The construction module is used to construct a relationship graph based on the customer identity information, account attribute information and account transaction information of each of the multiple suspicious accounts using a graph processing framework. The relationship graph consists of multiple nodes, which are connected to each other by edges. The nodes represent the customer identity or account attribute corresponding to the suspicious account, and the edges represent the association between different nodes. The processing module is used to process the relationship graph using a preset graph algorithm to obtain a processing result, wherein the preset graph algorithm is used to identify abnormal nodes in the relationship graph; The determination module is used to determine the risk information of the multiple accounts to be identified based on the processing results.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images