Method and device for monitoring risks of knowledge graph based on treasurers' data, and medium

Abstract

The application provides a knowledge graph risk monitoring method and device based on treasurers' data and a medium. The method comprises the following steps: acquiring multi-source data in a treasurer system, performing label attribute extraction on the multi-source data to obtain an extraction result, the label attributes comprising entity control relationship labels, transaction time feature labels and transaction structure labels, constructing a multi-dimensional knowledge correlation graph for representing the features of the treasurer system based on the extraction result, performing risk information detection on the multi-dimensional knowledge correlation graph to obtain a treasurer detection result. The method can efficiently integrate the multi-source data in the treasurer system, construct a multi-dimensional knowledge correlation graph through label attribute extraction, effectively identify and fuse the homonymy and heterogeneous data, display and store the data in a graph database through a graph structure, and perform risk information detection through multiple search algorithms, thereby improving the accuracy and efficiency of risk identification.

Description

Technical Field

[0001] This application relates to the field of financial data risk analysis technology, and in particular to a knowledge graph-based risk monitoring method, device, and medium based on treasury data. Background Technology

[0002] Knowledge graphs, as a powerful data representation and retrieval tool, have been widely used in various fields in recent years. By constructing complex networks of entities, relationships, and attributes, they provide users with rich knowledge resources. However, with the expansion in scale and complexity of knowledge graphs, this technology has gradually revealed some problems in practical applications. For example, how to clearly track and identify each transaction path in a complex network structure, and how to intuitively display the complex structures and deep connections within a knowledge graph.

[0003] In existing technologies, on the one hand, by constructing a path numbering system, each transaction path in the knowledge graph is assigned a unique identifier, enabling clear tracking and identification capabilities in complex networks. This alleviates the difficulty of path tracing to some extent and further enhances the visualization capabilities of the graph, allowing users to more intuitively understand its structure and relationships. On the other hand, existing technologies also introduce data fusion techniques to process and integrate multi-source heterogeneous data to ensure the comprehensiveness and consistency of the knowledge graph. However, the accuracy and reliability of the data fusion process, and how to maintain the dynamics and flexibility of the knowledge graph after fusion, remain challenges for existing technologies. Summary of the Invention

[0004] To overcome the problems existing in related technologies, this application provides a knowledge graph-based risk monitoring method, device and medium based on treasury data. By acquiring multi-source treasury data, extracting tag attributes, building a multi-dimensional knowledge graph and detecting risks, it solves the problem of difficulty in integrating multi-source data and improves the accuracy and efficiency of risk identification.

[0005] The first aspect of this application provides a knowledge graph-based risk monitoring method for treasury data, including: Acquire multi-source data from the treasury system; Tag attributes are extracted from the multi-source data to obtain the extraction results; the tag attributes include entity control relationship tags, transaction time feature tags, and transaction structure tags. Based on the extraction results, a multidimensional knowledge association graph is constructed to characterize the features of the treasury system. Risk information detection is performed on the multidimensional knowledge association graph to obtain the treasury detection results; The risk information detection includes at least abnormal dynamic pattern detection, abnormal behavior pattern matching detection, and multi-dimensional comparison detection. Optionally, after acquiring multi-source data from the treasury system, the entity data and the relationship data between entities in the multi-source data are identified respectively.

[0006] Optionally, the step of extracting label attributes from the multi-source data includes: Natural language segmentation is performed on the multi-source data to obtain the segmentation results; The word segmentation results are matched with the corresponding industry keywords in the pre-set industry keyword thesaurus to obtain the matching results; Add corresponding tag attributes to the entities in the matching results.

[0007] Optionally, after extracting the label attributes from the multi-source data, the method further includes: Identify the common-disparate structure data and heterogeneous ontology data in the multi-source data respectively; A mapping table is established using many-to-many relationships to fuse the heterogeneous ontology data; The common misalignment structure data is fused using an instance fusion method.

[0008] Optionally, the fused heterogeneous ontology data and common-discretionary structure data can be displayed in a graphical structure, where entity data is defined as nodes in the graphical structure, relation data is converted into edges, triples are established based on the relationships between entities, and the graphical structure is stored in the Neo4j graph database.

[0009] Optionally, a breadth-first search algorithm, a depth-first search algorithm, or a loop detection algorithm may be used to detect risk information in the multidimensional knowledge association graph.

[0010] Optionally, risk information detection is performed on the multidimensional knowledge graph based on a breadth-first search algorithm, including: using a queue as a data structure, inputting the starting node into the queue; retrieving and visiting each node from the queue, and adding all unvisited adjacent nodes to the queue; until all nodes in the multidimensional knowledge graph have been traversed; or Risk information detection of the multidimensional knowledge association graph based on the depth-first search algorithm includes: using a stack as the data structure, inputting the starting node into a queue; accessing the starting node and accessing all nodes of a preset branch based on a preset branch; or Obtain the dataset that has been accessed but not stored in the stack, and perform risk information detection on the multidimensional knowledge association graph based on the loop detection algorithm.

[0011] Optionally, the multi-source data can be standardized according to its data structure, including: For the structured data in the multi-source data, ETL tools are used for transformation; For the semi-structured data in the multi-source data, RESTful API technology is used for transformation; For the unstructured data in the multi-source data, the PyPDF2 and openpyxl libraries are used for conversion.

[0012] A second aspect of this application provides a knowledge graph-based risk monitoring system based on treasury data, comprising: The acquisition module is used to acquire multi-source data from the treasury system; An extraction module is used to extract label attributes from the multi-source data to obtain extraction results; the label attributes include entity control relationship labels, transaction time feature labels, and transaction structure labels. The construction module is used to construct a multidimensional knowledge association graph to characterize the features of the treasury system based on the extraction results; The detection module is used to detect risk information in the multidimensional knowledge association graph and obtain the treasury detection results. Risk information detection includes at least abnormal dynamic pattern detection, abnormal behavior pattern matching detection, and multi-dimensional comparison detection.

[0013] A third aspect of this application provides a non-transitory machine-readable storage medium having executable code stored thereon, which, when executed by a processor of an electronic device, causes the processor to perform the method described above.

[0014] Therefore, the knowledge graph-based risk monitoring method, apparatus, and medium provided in this application acquire multi-source data from the treasury system, extract labels and attributes from the multi-source data to obtain extraction results, construct a multi-dimensional knowledge graph to characterize the features of the treasury system based on the extraction results, and perform risk information detection on the multi-dimensional knowledge graph to obtain treasury detection results. This method efficiently integrates multi-source data from the treasury system and constructs a multi-dimensional knowledge graph through label and attribute extraction. It effectively identifies and merges common and heterogeneous data, displays and stores them in a graph database using a graphical structure, and employs multiple search algorithms for risk information detection, thereby improving the accuracy and efficiency of risk identification.

[0015] Penetration-based correlation discovery is used to uncover hidden control relationships between seemingly unrelated entities and to identify actual control networks formed through indirect connections at three or more levels, such as identifying the transfer of funds through multi-level nested companies. Abnormal dynamic pattern recognition is used to capture abnormal time patterns in fund flows (such as periodic abnormal transfers, sudden transactions close to the performance disclosure date, etc.). Abnormal behavior pattern matching and identification: using graph pattern matching to identify the characteristic structure of known fraudulent methods (such as circular trading, triangular backflow, etc.). The detection module is used to perceive risks in the "relationship dimension", changing the traditional single-point detection mode of risk control to detect risk information. At the same time, it compares and detects multiple entities, multiple attributes and multiple relationship information to identify more concealed fraudulent transactions and obtain application detection results in the field of treasury anti-financial fraud.

[0016] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0017] The above and other objects, features and advantages of this application will become more apparent from the more detailed description of exemplary embodiments thereof in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments thereof.

[0018] Figure 1 This is a flowchart illustrating a knowledge graph-based risk monitoring method for treasury data, as shown in an embodiment of this application.

[0019] Figure 2 This is a schematic diagram illustrating the process of acquiring and storing treasury data, as shown in an embodiment of this application.

[0020] Figure 3 This is a schematic diagram of the structure of the treasury data knowledge graph model shown in the embodiments of this application.

[0021] Figure 4 This is a schematic diagram illustrating the process of defining a treasury risk number in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a knowledge graph risk monitoring device based on treasury data, as shown in an embodiment of this application.

[0022] Figure 6 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application. Detailed Implementation

[0023] Preferred embodiments of the present application will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the present application are shown in the drawings, it should be understood that the present application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0024] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0025] It should be understood that although the terms "first," "second," "third," etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0026] Knowledge graphs, as a foundational technology in the field of artificial intelligence, depict semantic relationship networks between entities, using a structured set of triples (entity × relation × attribute) to describe the connections between things. Knowledge graphs possess four fundamental characteristics: networked knowledge structure, complex network structure, composition of triples, and data carried by a knowledge base. These features simplify data extraction and computation, and enhance the organization, management, and understanding of information on the internet.

[0027] Currently, knowledge graphs are mainly categorized into two types based on product type: general knowledge graphs and industry-specific knowledge graphs. In the treasury system, knowledge graph-based risk monitoring models and systems using treasury data enable real-time monitoring and coordinated allocation of corporate financial resources, enhancing strategic decision support, operational analysis, and financial risk management capabilities. However, knowledge graph technology faces several shortcomings in practical applications, such as high construction and maintenance costs, data quality and consistency issues, limitations in knowledge representation, performance problems related to scalability, and challenges related to technological complexity, updates and evolution, the integration of multi-source heterogeneous data, the accuracy and recall of information extraction, and entity linking issues in knowledge fusion.

[0028] Especially in the construction and application of industry knowledge graphs, there are still challenges such as effective modeling of complex relationships, sparsity issues with multi-source data, and the limitations of learning each triple in isolation. Existing industry knowledge graphs show significant performance degradation when handling complex relationships, and fail to fully utilize other information related to knowledge, such as entity and relationship descriptions, category information, and the massive amounts of information in internet text.

[0029] In the embodiments of this application, such as Figure 1As shown, the knowledge graph-based risk monitoring method based on treasury data includes: S100: Obtain multi-source data from the treasury system.

[0030] In this embodiment, the multi-source data in the treasury system refers to various types of financial data stored in the enterprise treasury system, including but not limited to transaction records, tax invoice information, and business registration information of counterparties. In this embodiment, the multi-source data originates from at least one member unit and its counterparties, including payment and receipt records, invoice information, bank acceptance bill records, and contract documents.

[0031] Specifically, such as Figure 2 As shown, multi-source data can be classified according to its data structure, and typically includes three types of information: structured data, semi-structured data, and unstructured data.

[0032] Firstly, for structured data, ETL (Extract, Transform, Load) tools are used for efficient transformation. Structured data includes key settlement information, tax invoice details, etc. The process begins with extracting the raw data, followed by cleaning and transforming it using pre-defined rules and algorithms to ensure accuracy, consistency, and completeness. Finally, the processed data is loaded into the target system or database, transforming it into a standard data format that meets business requirements.

[0033] Secondly, regarding the standardization of semi-structured data, for semi-structured data originating from external platforms such as Tianyancha, including business registration information, risk assessment reports, shareholder structures, and actual controller information, integration is achieved using RESTful API technology. RESTful API, as a lightweight data exchange protocol, allows for requesting and receiving data in a standardized manner. By calling Tianyancha's API interface, the system can dynamically obtain the latest enterprise information and use internal logic to convert this data into a unified standard data format.

[0034] Thirdly, regarding the parsing and standardization of unstructured data, for unstructured data such as PDFs and Word documents, advanced Python libraries—PyPDF2 and openpyxl—are used to achieve intelligent data parsing and conversion. PyPDF2 can be used to read and parse PDF documents, extracting text, images, and table information; while openpyxl can be used for Excel files, supporting the reading, modification, and saving of .xlsx format table data. By combining these two libraries, information can be effectively extracted from PDF and Word documents, cleaned and formatted according to business rules, and finally converted into a standardized data format.

[0035] S101. Extract tag attributes from the multi-source data to obtain extraction results; the tag attributes include entity control relationship tags, transaction time feature tags, and transaction structure tags. In this embodiment, the acquired multi-source data is processed to extract tags and attributes useful for constructing a knowledge graph. Tags and attributes can represent different entities (such as transactions, accounts, risks, etc.) and the relationships between entities.

[0036] In this embodiment, entities and relationships can be extracted from the data on treasury risk fund flows to construct a treasury risk knowledge graph. The core entities of this graph mainly focus on the group's member units and their interacting counterparties. Fund flows can serve as a link connecting all entities, used to record in detail the payment and receipt relationships and tax invoice relationships between member units and counterparties.

[0037] It should be noted that, in this embodiment, a relationship can be defined as a specific connection between two or more entities. The task of entity and relationship extraction is to accurately detect and identify the implicit semantic relationships between the entities and store these relationships in a structured form for subsequent analysis and application.

[0038] Specifically, it typically includes the following types of relationships: Payment and receipt relationships: This section records detailed payment and receipt transactions between a member unit and its external counterparties. These transactions not only reveal the upstream and downstream relationships between the member unit and its counterparties but also include specific transaction amounts, dates, and transaction summaries, providing rich data support for in-depth analysis of fund flows.

[0039] Tax invoice relationships: This reflects the transactions between member units and external trading partners regarding the receipt and issuance of invoices. Records may also include key information such as amount, date, and transaction details, which helps to comprehensively understand the invoicing situation of both parties and their upstream and downstream invoicing activities.

[0040] Core Business Relationships: By analyzing the industry keywords of the counterparty's core business, it's possible to determine the industry affiliation of member units and counterparties in upstream and downstream transactions. This is crucial for analyzing the business relationships between the transacting parties and identifying potential risks.

[0041] Equity Relationships: This includes information such as the counterparty's shareholders, directors, supervisors, senior management, actual controller, registered address, and contact number. This information helps determine whether member units and the counterparty are the same company or related companies, thereby further assessing transaction risks.

[0042] Understandably, during the extraction of keywords related to the main business industry, special processing was performed on the long text of the business scope in the counterparty's business registration information. To efficiently and accurately extract industry keywords, Python word segmentation methods can be used. In this embodiment of the application, the extraction of label attributes from the multi-source data includes: Natural language segmentation is performed on the multi-source data to obtain the segmentation results; The word segmentation results are matched with the corresponding industry keywords in the pre-set industry keyword thesaurus to obtain the matching results; Add corresponding tag attributes to the entities in the matching results.

[0043] In this embodiment of the application, the following is included: constructing an industry keyword thesaurus, which contains proper nouns, terms, and common keywords for various industries. This thesaurus is regularly updated according to industry characteristics and market developments to ensure its timeliness and accuracy.

[0044] Text preprocessing: The text data of the counterparty's business scope is preprocessed, including removing meaningless symbols, numbers, and special characters, and converting all text to a uniform lowercase form. This step aims to reduce the complexity of the word segmentation algorithm and improve segmentation efficiency.

[0045] Word segmentation: The preprocessed text was segmented using the Python natural language processing library jieba. Jieba segmentation is based on statistical principles and can intelligently segment Chinese characters according to word frequency and contextual relationships, providing accurate segmentation results for this embodiment.

[0046] Keyword matching: The word segmentation results are matched with a pre-prepared industry keyword database. The TF-IDF (Term Frequency-Inverse Document Frequency) algorithm is used to evaluate the importance of each word in the text, thereby filtering out keywords related to the main business.

[0047] Keyword Extraction: Based on the matching results, industry keywords appearing in the business scope text can be extracted. These keywords not only need to appear in the thesaurus, but also need to reach a preset threshold in frequency or importance within the text to ensure relevance and accuracy.

[0048] It is evident that industry keyword extraction through word segmentation can efficiently and accurately extract industry keywords from the business scope text of trading partners, providing basic data support for the construction of a treasury risk knowledge graph.

[0049] S102. Based on the extraction results, construct a multidimensional knowledge association graph to characterize the features of the treasury system; In this embodiment, a multidimensional knowledge graph can be constructed based on the structure extracted from tag attributes. This multidimensional knowledge graph will contain multiple entities and complex relationships between them, forming a comprehensive and structured knowledge representation. The multidimensional knowledge graph can intuitively display the characteristics of the treasury system, such as the relationships between different transactions and the flow of funds between accounts, thereby facilitating subsequent risk detection and analysis.

[0050] In this embodiment of the application, after extracting the tag attributes from the multi-source data, the method further includes: Identify the common-disparate structure data and heterogeneous ontology data in the multi-source data respectively; A mapping table is established using many-to-many relationships to fuse the heterogeneous ontology data; The common misalignment structure data is fused using an instance fusion method.

[0051] In this embodiment, to accurately identify and integrate ontology and relationships within knowledge, and store the information in a Neo4j graph database for efficient knowledge management and application, the detailed steps of knowledge fusion are described below: 1) Data identification and deep preprocessing: First, common structures and heterogeneous entities from different data sources are identified. These data sources can include fund flow records, tax invoice information, and business registration documents. For the raw data, cleaning and standardization operations are performed to eliminate inconsistencies and redundant information, ensuring data quality and accuracy.

[0052] 2) Ontology mapping and precise alignment: At this stage, ontology elements from different data sources are analyzed in depth, including concepts, attributes, and relationships. By employing mapping and alignment techniques, correspondences between these ontology elements are established to ensure consistent semantic interpretation across different data sources.

[0053] 3) Entity recognition and intelligent linking: The merged data employs advanced entity recognition technology to accurately identify various entities, such as member units, trading partners, main businesses, shareholders, directors, supervisors, and senior management. Entity linking technology is then used to link different representations of the same entity, forming a unified entity representation and thus avoiding information fragmentation. Each entity contains a series of attributes, such as company name, establishment date, and industry type, which provide rich contextual information.

[0054] 4) Relation extraction and type definition: From the merged data, relation extraction technology is used to identify the relationships between entities, and the types of relationships are defined according to business logic.

[0055] In practical applications, such as Figure 3 As shown, for example, a counterparty's payment to a member unit is set as a receiving relationship, represented by "counterpartiety--receiving--member unit"; while a member unit's payment to a counterparty is set as a payment relationship, represented by "member unit--paying--counterpartiety".

[0056] Similarly, input and output relationships are defined to comprehensively reflect business transactions between entities. All nodes and relationships are represented in the form of entity-relationship-entity triples, providing a solid foundation for building a knowledge graph.

[0057] 5) Knowledge representation and graph structure transformation: At this stage, the merged data is represented as a graph structure, where entities are converted into nodes and relationships are converted into edges. This graph structure representation can intuitively show the relationships and hierarchical structure between entities, facilitating knowledge reasoning and querying.

[0058] 6) Data storage: Finally, the constructed knowledge graph structure is stored in the Neo4j graph database. Neo4j, as a high-performance graph database, can efficiently store and query graph structure data, providing powerful knowledge management and application capabilities. It is evident that achieving deep knowledge fusion between shared structures and heterogeneous ontology data provides a solid foundation for subsequent knowledge reasoning, querying, and application.

[0059] S103. Perform risk information detection on the multidimensional knowledge association graph to obtain the treasury detection result. The risk information detection includes at least abnormal dynamic pattern detection, abnormal behavior pattern matching detection, and multidimensional comparison detection.

[0060] In practical applications, multi-source data is obtained from the treasury system. This multi-source data includes member unit payment and receipt records, counterparty business registration information, fund transfer vouchers, and key data from financial statements. Tag attributes are extracted from the multi-source data. The tag attributes include entity control relationship tags, transaction time feature tags, and transaction structure tags to obtain the extraction results. Based on the extraction results, a multidimensional knowledge association graph is constructed to characterize the features of the treasury system. The graph is embedded with a penetrating association discovery logic, which is used to mine hidden control relationships between seemingly unrelated entities through entity control relationship tags, identify the actual control network formed through more than 3 layers of indirect associations, and capture the association basis transferred through multi-level companies. Risk information detection is performed on the multidimensional knowledge association graph, the detection including: On the one hand, abnormal dynamic pattern recognition: based on transaction time feature labels, it captures abnormal time patterns of fund flows; Secondly, abnormal behavior pattern matching and identification: using a graph pattern matching algorithm, the transaction structure labels in the graph are compared with the feature structures of known fraud methods to identify matching abnormal transaction structures; Finally, multi-dimensional comparison and detection: by using the detection module to perceive risks in the "relationship dimension", the traditional single-point detection mode of risk control is changed. At the same time, cross-comparison and detection of multiple entities, multiple attributes and multiple relationship information are carried out to identify more concealed fraudulent transactions; and the application detection results of the treasury are obtained.

[0061] In this embodiment, we focus on risk monitoring scenarios in the treasury field. With "multi-source data integration - knowledge graph construction - multi-dimensional risk detection" as the core logic, we solve the problems of fragmented traditional risk control data, shallow correlation identification, and high risk concealment through treasury-specific data processing, knowledge graph dimension innovation, and risk detection logic optimization, thus forming a risk monitoring technology path adapted to the characteristics of treasury business.

[0062] In this embodiment, the acquisition of treasury-specific multi-source data can lay the data foundation for accurate monitoring. The treasury multi-source data with a clearly defined data scope covers member unit payment and receipt records, counterparty business registration information, fund transfer vouchers, and key data from financial statements. This data scope strictly matches the characteristics of cross-unit collaboration and multi-stage flow in treasury business, and includes at least: member unit-related data covers core information on internal fund management of the group, reflecting the fund operation status of member units; counterparty-related data supplements the background of external related entities, providing a basis for subsequent discovery of hidden relationships; and fund transfer vouchers connect internal and external data, forming a data closed loop of internal operation and external collaboration.

[0063] It is understandable that treasury data has the characteristics of cross-system heterogeneity, high-frequency updates, and multi-stage correlation. The four types of data selected in this embodiment are all core data sources for treasury risk monitoring. For example, key data in financial statements can reflect the overall operational health of member units, and business registration information of counterparties can capture potential risk clues such as their equity structure and changes in actual controllers, providing full-link, high-value data support for subsequent tag extraction and graph construction.

[0064] By extracting core information units from the treasury's scenario-based tag attributes to construct the data graph, and considering the hidden and interconnected nature of treasury risks, three types of exclusive tag attributes are designed to break through the single dimension of traditional data annotation: First, the entity control relationship label focuses on the control relationship between entities, such as the actual controller of the counterparty, the shareholding relationship between member units and external entities, etc., providing a label basis for subsequent discovery of hidden control relationships.

[0065] Second, transaction time feature tags are used to mark anomalies around the time dimension, such as the business cycle nodes corresponding to the data and key disclosure periods, to meet the identification needs of time-related risks in the treasury.

[0066] Third, the transaction structure label is used to mark multi-entity collaborative structures, such as the collaborative links and flow nodes of the related entities corresponding to the data, which provides feature basis for subsequent matching of known fraud structures.

[0067] In this embodiment, a multi-dimensional knowledge graph with embedded penetration logic is constructed to achieve in-depth mining of relationships. Based on the traditional "entity-relationship" framework of knowledge graphs, a new "penetrating relationship discovery logic" is added. This logic, centered on "entity control relationship tags," firstly breaks through the limitation of relationship hierarchy, enabling the identification of actual control networks formed by more than three layers of indirect relationships. For example, through a multi-level control link of "entity A-entity B-entity C-entity D," it can uncover hidden control relationships between entities that appear to have no direct relationship, overcoming the limitation of traditional graphs that can only identify direct relationships. Secondly, it adapts to the needs of treasury operations. For risk scenarios involving multi-level nested entities in the treasury (such as resource transfer through multi-level entity collaboration), this logic can capture "control relationship transmission links," providing graph support with "sufficient relationship depth and comprehensive coverage" for subsequent risk detection.

[0068] In this embodiment, the constructed multidimensional knowledge graph covers entity control, temporal features, and structural relationships, rather than the single entity-relationship dimension of traditional graphs. Multiple entities are linked by entity control relationship tags to form a control relationship network; combined with transaction time feature tags, the time nodes of each association are recorded to form a three-dimensional association of time-entity-relationship; and based on transaction structure tags, the link structure of multi-entity collaboration is marked to provide dimensional support for subsequent structure matching.

[0069] In this embodiment, multi-dimensional risk detection is used to form a closed loop for treasury-specific risk identification. Through the combination of three types of detection logic, it covers treasury risks of "time anomalies, structural anomalies, and correlation anomalies," changing the traditional single-point detection mode of risk control. 1. Abnormal dynamic pattern recognition Based on transaction time feature labels, the time distribution patterns of each association in the graph are analyzed to capture abnormal associations in the time dimension, such as high-frequency associations outside of business cycles and abnormal collaborations during critical periods. For time-sensitive risks in the treasury, such as abnormal resource allocation during critical periods, this identification logic can discover anomalies from the associations of time-entity-relationship, making up for the limitations of traditional detection that only focuses on the data itself and ignores time associations.

[0070] 2. Abnormal behavior pattern matching and identification Based on transaction structure labels, a graph pattern matching algorithm is used to compare the collaborative structure in the graph with known fraud structures in the treasury field (such as multi-entity circular collaboration, triangular link collaboration, etc.) to identify abnormal structures with high matching degree. 3. Multi-dimensional comparison and detection By using a detection module to achieve risk perception in the relational dimension, it breaks through the traditional single-point detection mode. At the same time, it cross-compares multiple entities (member units, trading counterparts, controlling entities), multiple attributes (control relationships, time characteristics, structural characteristics), and multiple relationships (control relationships, cooperation relationships, circulation relationships) to identify hidden risks from multi-dimensional associations.

[0071] To address the hidden risks of splitting relationships and decentralized collaboration in the treasury (such as circumventing single-point detection by splitting collaboration among multiple entities), this logic can discover risks that cannot be identified by a single dimension through multi-dimensional cross-validation, thereby improving the comprehensiveness and accuracy of risk identification.

[0072] In summary, the final output of the treasury's application detection results not only includes the risk subject and risk type, but also the control links, time nodes, and structural characteristics associated with the risk, providing a complete and traceable basis for treasury risk disposal and forming a preliminary closed loop of detection-tracing-disposal.

[0073] In the embodiments of this application, such as Figure 4 As shown, risk information detection can include operations such as pattern matching and anomaly detection on entities and relationships in the graph to identify potential risk points.

[0074] In this embodiment of the application, the risk of empty transactions and missing orders in the treasury risk is used to describe the construction of a multidimensional knowledge graph risk model.

[0075] The following conditions must be met: S401, both upstream and downstream businesses simultaneously transact with "micro and small enterprises / newly established companies / trading companies".

[0076] S402. Trading member units whose upstream and downstream trading partners have the same main business / goods / contract subject matter.

[0077] S403, There is no transfer of materials / inventory / ownership with upstream and downstream partners.

[0078] S404. The use of funds for upstream and downstream projects does not include "rent, heating, water and electricity, property management, rent, fruit, vegetables, food, meat, smart cards, ETC, water fees, electricity fees, and parking".

[0079] S405. The cumulative transaction amounts are similar (including the same) and the cumulative amount is >= 500,000, and the difference in the cumulative amount between upstream and downstream is within 5%; or the single transaction amount is the same and the single transaction amount is > 50,000.

[0080] Three characteristic values ​​can be extracted from condition S401 for the counterparty: micro and small enterprises, newly established companies, and trading companies. Micro and small enterprises are an attribute label for the counterparty; newly established companies are determined based on the transaction dates between the counterparty and its member units; if the establishment date - transaction date <= 365 days, it is considered a newly established company; trading companies are distinguished based on the counterparty's industry classification or name; if the company name contains "wholesale" or "trading," or if the industry includes "wholesale," it is identified as a trading company. In condition S403, data containing "rent, heating, water and electricity, property management, rent, fruit, vegetables, food, meat, smart card, ETC, water fee, electricity fee, parking" in the payment relationship summary are marked as excluded and not included in the risk analysis calculation.

[0081] Set business keywords, categorize summaries in payment and collection relationships, and add usage attributes to the relationships.

[0082] In condition S404, to determine that the cumulative amounts of upstream and downstream transactions are similar, it is necessary to group and sum the payment and receipt amounts by member unit-trading counterparty, and compare the amount range of upstream and downstream transactions through the external payment and receipt relationships of member units.

[0083] In this example, to meet all characteristics of conditions S401 to S405, this application defines risk numbers, such as... Figure 4 As shown. In the knowledge graph built using the Neo4j graph database, all transaction paths are individual, complete paths. The upstream and downstream payment and receipt records of member units, as well as the upstream and downstream tax invoice relationships, are all individual paths. To satisfy the features in condition S402, provided that member units have the risk characteristics of matching upstream and downstream payment and receipt records, and that upstream and downstream tax invoices contain the same input and output tax invoice items, a risk number definition was created. All paths that simultaneously satisfy conditions S401 to S405, i.e., paths with the same triple: upstream counterparty - member unit - downstream counterparty, are assigned the same risk number. The risk number is the unique ID of the treasury risk in this example. The implementation method is as follows: Step 1: Use Cypher to create a treasury transaction risk model that meets the characteristics S401, S403, S404, and S405, including the transaction risk number. The result is recorded as: moneydata = graph.run(cypher).data() Step 2: Use Cypher to create a treasury invoice risk model that meets the characteristics S401, S402, S404, and S405, including the invoice risk number. The result is recorded as: invoicedata = graph.run(cypher).data() The data from the above steps are compared cyclically, and the upstream and downstream counterparties in moneydata and invoicedata are checked against the same member unit to determine whether they are the same. It is essential that the path directions in the above steps are consistent.

[0084] Replace the tax invoice risk number in step two that matches with the risk number in step one. Return the final result in JSON format.

[0085] In this embodiment, a breadth-first search algorithm, a depth-first search algorithm, or a loop detection algorithm is used to detect risk information in the multidimensional knowledge association graph.

[0086] In this embodiment of the application, risk information detection of the multidimensional knowledge association graph based on the breadth-first search algorithm includes: using a queue as a data structure, inputting the starting node into the queue; retrieving and visiting each node from the queue, and adding all unvisited adjacent nodes to the queue; until all nodes in the multidimensional knowledge association graph have been traversed; or Risk information detection of the multidimensional knowledge association graph based on the depth-first search algorithm includes: using a stack as the data structure, inputting the starting node into a queue; accessing the starting node and accessing all nodes of a preset branch based on a preset branch; or Obtain the dataset that has been accessed but not stored in the stack, and perform risk information detection on the multidimensional knowledge association graph based on the loop detection algorithm.

[0087] It is understandable that the breadth-first search (BFS) algorithm is used in the analysis and mining of information in treasury risk models: Firstly, Breadth-First Search (BFS) is an efficient graph traversal method, particularly suitable for quickly discovering information directly related to specific nodes in knowledge graphs. In the information analysis and mining process of the treasury risk model, BFS plays a crucial role. Starting from the initial risk factor node, it expands outward layer by layer using a queue data structure, sequentially visiting all directly connected nodes. This layer-by-layer traversal ensures that the algorithm can reach all reachable nodes with the shortest path, making it ideal for quickly identifying entities, attributes, or events directly related to a specific risk factor. For example, when it is necessary to quickly grasp the direct consequences or scope of influence that a risk factor may cause, BFS can provide intuitive and comprehensive information.

[0088] Application of Depth-First Search (DFS) algorithm in information analysis and mining of treasury risk models: Secondly, unlike BFS, the Depth-First Search (DFS) algorithm focuses more on exploring each branch of the graph in depth. In information mining of treasury risk models, DFS is used to uncover deep connections or hidden patterns related to risk factors. DFS utilizes a stack or recursive calls, starting from the initial node and delving deeper along a branch until it encounters a node with no unvisited adjacent nodes. The algorithm then backtracks to the previous node and continues exploring other branches. This in-depth exploration makes DFS ideal for discovering potential risks or opportunities hidden within complex network structures. For example, when searching for the propagation path or scope of influence of a specific risk factor, DFS can reveal more details and deeper information.

[0089] Application of loop detection algorithms in information analysis and mining of treasury risk models: Thirdly, loop detection algorithms are an important problem in graph theory and are equally crucial for information analysis and mining in treasury risk models. Loop detection algorithms can identify whether there are cyclic paths in a graph—paths that start from a node, pass through a series of nodes, and eventually return to the starting node. In treasury risk models, loops may represent potential logical errors, circular dependencies, or systemic risks. For example, circular trading relationships may lead to problems such as impeded capital flows and increased risk exposure. Therefore, identifying and eliminating potential loops through loop detection algorithms is a key step in ensuring the accuracy and stability of the model. In practical applications, the marker array in the DFS process can be used to implement loop detection. When visiting a node, if the node has already been visited and is not currently in the recursion stack, it indicates that a loop has been found. At this point, appropriate measures can be taken to eliminate the loop or adjust the model structure.

[0090] To improve the user experience in the field of knowledge graph visualization, this application embodiment also provides a highly integrated knowledge graph visualization tool. When a user clicks on a node, all paths associated with the risk number represented by that node will be highlighted, thereby greatly improving the user's ease of operation and information acquisition efficiency.

[0091] Multi-dimensional knowledge representation: By introducing multi-dimensional knowledge representation methods, users can freely set various conditions on the front-end interface. These conditions include not only traditional entities and relationships, but also attributes, events, time series, and other dimensions. This multi-dimensional display provides users with a richer and more comprehensive knowledge perspective, making risk monitoring more intuitive and easier to operate.

[0092] Full-path highlighted navigation: Leveraging advanced graph penetration technology, this embodiment supports highlighting complete paths within the graph. Furthermore, through an intuitive interface design, users can easily navigate to paths and nodes of interest. These designs significantly improve the efficiency of user exploration in complex knowledge graphs.

[0093] Multi-level drill-down mechanism: To meet users' needs for analyzing knowledge at different levels, this embodiment implements a multi-level drill-down mechanism. Users can start with a macroscopic overview of the graph and gradually delve into the details of specific sub-graphs. During the step-by-step drill-down process, users can continuously refine their analytical perspective until they reach specific unit data.

[0094] Intuitive Display of Unit Data: At the end of the map drilling through, users will be able to access specific unit data. This embodiment uses highly integrated visualization components to intuitively display data in various forms such as charts and lists, achieving a seamless transformation from map to data, greatly improving users' data understanding and analysis efficiency.

[0095] Interactive exploration experience: Users can trigger effects such as path highlighting, information prompts, and data display through simple interactive actions such as clicking and hovering.

[0096] Context-sensitive information presentation: During the knowledge graph penetration process, this embodiment can intelligently present relevant information and analysis results based on the current context. This intelligent presentation method not only enhances the user's insight but also provides a knowledge graph analysis perspective.

[0097] Dynamic data updates and feedback: To ensure that the displayed data is up-to-date, this embodiment supports a dynamic data update mechanism. Simultaneously, the system also provides an instant feedback mechanism, capable of quickly responding to user interactions and ensuring that users can obtain the information they need in real time.

[0098] Multi-level data correlation analysis: Through graph penetration technology, this embodiment can demonstrate the correlations between data at different levels and granularities. This correlation visualization helps users identify key influencing factors and potential patterns, thereby providing more accurate and comprehensive risk analysis support.

[0099] In this example, when users conduct risk analysis through the knowledge graph visualization interface, it's important to note that the knowledge graph only represents the flow of funds between member units and counterparties. Therefore, the transaction path corresponding to each risk number does not necessarily represent a hit risk. Users need to make a human judgment to determine whether a treasury risk rule has been met. Based on the hit risk characteristics, users can further extract more accurate risk indicators or features and conduct a more in-depth analysis using the treasury risk knowledge graph analysis function. This flexible and efficient risk analysis method helps users promptly identify potential risks and take corresponding preventative and response measures.

[0100] like Figure 5 As shown, this application provides a knowledge graph-based risk monitoring system based on treasury data, including: Module 51 is used to acquire multi-source data from the treasury system; Extraction module 52 is used to extract tag attributes from the multi-source data to obtain extraction results; Construction module 53 is used to construct a multidimensional knowledge association graph to characterize the features of the treasury system based on the extraction results; The detection module 54 is used to detect risk information in the multidimensional knowledge association graph and obtain the treasury detection result.

[0101] Optionally, after acquiring multi-source data from the treasury system, the entity data and the relationship data between entities in the multi-source data are identified respectively.

[0102] Optionally, the step of extracting label attributes from the multi-source data includes: Natural language segmentation is performed on the multi-source data to obtain the segmentation results; The word segmentation results are matched with the corresponding industry keywords in the pre-set industry keyword thesaurus to obtain the matching results; Add corresponding tag attributes to the entities in the matching results.

[0103] Optionally, after extracting the label attributes from the multi-source data, the method further includes: Identify the common-disparate structure data and heterogeneous ontology data in the multi-source data respectively; A mapping table is established using many-to-many relationships to fuse the heterogeneous ontology data; The common misalignment structure data is fused using an instance fusion method.

[0104] Optionally, the fused heterogeneous ontology data and common-discretionary structure data can be displayed in a graphical structure, where entity data is defined as nodes in the graphical structure, relation data is converted into edges, triples are established based on the relationships between entities, and the graphical structure is stored in the Neo4j graph database.

[0105] Optionally, a breadth-first search algorithm, a depth-first search algorithm, or a loop detection algorithm may be used to detect risk information in the multidimensional knowledge association graph.

[0106] Optionally, risk information detection is performed on the multidimensional knowledge graph based on a breadth-first search algorithm, including: using a queue as a data structure, inputting the starting node into the queue; retrieving and visiting each node from the queue, and adding all unvisited adjacent nodes to the queue; until all nodes in the multidimensional knowledge graph have been traversed; or Risk information detection of the multidimensional knowledge association graph based on the depth-first search algorithm includes: using a stack as the data structure, inputting the starting node into a queue; accessing the starting node and accessing all nodes of a preset branch based on a preset branch; or Obtain the dataset that has been accessed but not stored in the stack, and perform risk information detection on the multidimensional knowledge association graph based on the loop detection algorithm.

[0107] Optionally, the multi-source data can be standardized according to its data structure, including: For the structured data in the multi-source data, ETL tools are used for transformation; For the semi-structured data in the multi-source data, RESTful API technology is used for transformation; For the unstructured data in the multi-source data, the PyPDF2 and openpyxl libraries are used for conversion.

[0108] See Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application. The electronic device 600 includes a memory 610 and a processor 620.

[0109] The processor 620 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0110] The memory 610 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices.

[0111] The memory 610 stores executable code, which, when processed by the processor 620, can cause the processor 620 to execute part or all of the methods described above.

[0112] Furthermore, the method according to this application can also be implemented as a computer program or computer program product, which includes computer program code instructions for performing some or all of the steps in the method described above.

[0113] Alternatively, this application may be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) storing executable code (or computer program, or computer instruction code) thereon, which, when executed by a processor of an electronic device (or electronic device, server, etc.), causes the processor to perform part or all of the steps of the methods described above according to this application.

[0114] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A knowledge graph-based risk monitoring method based on treasury data, characterized in that, include: Acquire multi-source data from the treasury system; Tag attribute extraction is performed on the multi-source data to obtain the extraction results; The tag attributes include entity control relationship tags, transaction time feature tags, and transaction structure tags; Based on the extraction results, a multidimensional knowledge association graph is constructed to characterize the features of the treasury system. Risk information detection is performed on the multidimensional knowledge association graph to obtain the treasury detection results; Risk information detection includes at least abnormal dynamic pattern detection, abnormal behavior pattern matching detection, and multi-dimensional comparison detection.

2. The method according to claim 1, characterized in that, After acquiring multi-source data from the treasury system, the entity data and the relationship data between entities in the multi-source data are identified respectively.

3. The method according to claim 1, characterized in that, The step of extracting label attributes from the multi-source data includes: Natural language segmentation is performed on the multi-source data to obtain the segmentation results; The word segmentation results are matched with the corresponding industry keywords in the pre-set industry keyword thesaurus to obtain the matching results; Add corresponding tag attributes to the entities in the matching results.

4. The method according to claim 1, characterized in that, After extracting the label attributes from the multi-source data, the process further includes: Identify the common-disparate structure data and heterogeneous ontology data in the multi-source data respectively; A mapping table is established using many-to-many relationships to fuse the heterogeneous ontology data; The common misalignment structure data is fused using an instance fusion method.

5. The method according to claim 4, characterized in that, The fused heterogeneous ontology data and common-disparity structure data are displayed in a graphical structure. Entity data is defined as nodes in the graphical structure, relation data is converted into edges, triples are established based on the relationships between entities, and the graphical structure is stored in the Neo4j graph database.

6. The method according to claim 1, characterized in that, Risk information detection is performed on the multidimensional knowledge association graph using a breadth-first search algorithm, a depth-first search algorithm, or a loop detection algorithm.

7. The method according to claim 6, characterized in that, Risk information detection of the multidimensional knowledge graph is performed based on a breadth-first search algorithm, including: using a queue as a data structure, inputting the starting node into the queue; retrieving and visiting each node from the queue, and adding all unvisited adjacent nodes to the queue; until all nodes in the multidimensional knowledge graph have been traversed; or Risk information detection of the multidimensional knowledge association graph based on the depth-first search algorithm includes: using a stack as the data structure, inputting the starting node into a queue; accessing the starting node and accessing all nodes of a preset branch based on a preset branch; or Obtain the dataset that has been accessed but not stored in the stack, and perform risk information detection on the multidimensional knowledge association graph based on the loop detection algorithm.

8. The method according to claim 1, characterized in that, The multi-source data is categorized by data structure and then standardized, including: For the structured data in the multi-source data, ETL tools are used for transformation; For the semi-structured data in the multi-source data, RESTful API technology is used for transformation; For the unstructured data in the multi-source data, the PyPDF2 and openpyxl libraries are used for conversion.

9. A knowledge graph-based risk monitoring system based on treasury data, characterized in that, include: The acquisition module is used to acquire multi-source data from the treasury system; The extraction module is used to extract tag attributes from the multi-source data to obtain the extraction results. The tag attributes include entity control relationship tags, transaction time feature tags, and transaction structure tags; The construction module is used to construct a multidimensional knowledge association graph to characterize the features of the treasury system based on the extraction results; The detection module is used to detect risk information in the multidimensional knowledge association graph and obtain the treasury detection results. Risk information detection includes at least abnormal dynamic pattern detection, abnormal behavior pattern matching detection, and multi-dimensional comparison detection.

10. A computer-readable storage medium, characterized in that, It stores executable code that, when executed by a processor of an electronic device, causes the processor to perform the method as described in any one of claims 1-8.

Images