An intelligent recognition method and system based on graph analysis

Abstract

The application discloses an intelligent identification method and system based on graph analysis. The method comprises the following steps: collecting multi-modal data (such as call records and vehicle damage images) in real time; constructing a dynamic graph structure and extracting a time-decay community influence feature; screening the feature by fusing mutual information and KL divergence; training a GBDT-GAT integrated model; deploying the model to an Apache Flink engine for real-time scoring after parameter adjustment by Bayesian optimization; and triggering an early warning based on a dynamic threshold. The system comprises multi-source collection and graph calculation modules. Through the application, the technical problems of multi-modal data fragmentation and high dynamic detection delay are solved, the detection rate is increased by 35%, and the reasoning delay is less than 100 ms.

Description

Technical Field

[0001] This invention belongs to the field of computer systems engineering, and in particular relates to an intelligent recognition method and system based on graph analysis. Background Technology

[0002] Risk identification technology has gone through three stages of development: Rule-driven stage (before 2010): Relying on manually set static rules (such as claim amount thresholds and medical visit frequency), but the dynamic evolution of the model caused the rules to lag, and the false alarm rate exceeded 30%.

[0003] Machine learning phase (2010-2020): Models such as logistic regression and decision trees were used to analyze structured data. While this improved accuracy, it failed to capture cross-entity relationships. Evidence shows that single data models had a recall rate of less than 50% for negative cases.

[0004] In the early stages of graph analytics (2020 to present): graph neural networks were introduced to identify associations, but three major technical bottlenecks still exist: Data fragmentation: Multi-source heterogeneous data (call logs, images, etc.) are not effectively integrated, and evidence suggests that cross-modal information silos lead to more than 30% of missed detections; Insufficient dynamic modeling: Traditional graph structures ignore temporal evolution, and community partitioning algorithms (such as Louvain) cannot capture their dynamic recombination characteristics; Real-time limitations: Batch processing architectures (such as Spark) have latency exceeding minutes, which cannot meet the requirements for in-process interception. Summary of the Invention

[0005] To address the shortcomings of the existing technology, this invention provides an intelligent recognition method based on graph analysis, comprising the following steps: Step S101: Collect structured data and multimodal data in real time from multiple heterogeneous data sources. The data sources include call records, geographic location information, device identification information, user identity information, application usage logs, high-resolution image data of vehicle damage, and three-dimensional deformation data. The image data is acquired through an on-board multi-source sensor system. Step S103: Construct the dynamic graph structure G; Step S105: Extract node features based on the dynamic graph structure G; Step S107: Fuse the node features with the original structured features, and use a feature filtering function based on mutual information to output an enhanced feature vector; Step S109: Construct an ensemble model based on the enhanced feature vectors; Step S1011: Load the trained ensemble model into the Apache Flink stream processing engine, persist the model state through Flink's Checkpoint mechanism, and calculate the risk score for new data in real time.

[0006] The dynamic graph structure mentioned in step S103, , where V is the set of nodes, which includes mobile phone numbers, ID card numbers, device numbers and geographical locations, E is the set of edges, which includes call relationships, attribution relationships, device binding relationships and permanent location relationships, and t is the time dimension, used to capture the temporal evolution characteristics of entity associations.

[0007] The node features mentioned in step S105 include node degree, proximity centrality, community identifier, and community influence features.

[0008] Specifically, step S109 includes: The dataset constructed based on the timestamp is divided into a training set and a test set; The ensemble model is trained using the training set.

[0009] The ensemble model is an ensemble model of Gradient Boosting Decision Tree (GBDT) and Graph Attention Network (GAT).

[0010] In step S1011, the ensemble model is evaluated using the test set, and Bayesian optimization is used to adjust the hyperparameters to maximize the F1 score in order to obtain a trained ensemble model.

[0011] The Bayesian optimization method uses the Optuna framework, models the hyperparameter space through a Gaussian process, and employs the Expected Improvement criterion for the acquisition function.

[0012] The deployment of the Apache Flink stream processing framework in step S1011 includes: configuring Flink jobs using the StreamPark development scaffold to achieve parallel data pipeline processing.

[0013] The method further includes determining the risk level based on the risk score output and triggering a graded early warning mechanism, generating a risk report when the score exceeds a dynamic threshold.

[0014] This invention also proposes an intelligent recognition system based on graph analysis, which includes: The multi-source data acquisition module is used to extract data in real time from call logs, geographic location, device information, user identity, and vehicle damage image data sources; The graph construction and storage module uses the Neo4j graph database to build and maintain dynamic graph structures, supporting time-series queries. The graph feature extraction module is used to calculate node degree, proximity centrality, community identifier, and time decay community influence features. The feature fusion module is used to filter and merge features based on mutual information and KL divergence; The model training and optimization module is used to train the GBDT and GAT ensemble model and tune hyperparameters. The real-time inference and early warning module uses the Apache Flink engine for transaction processing and outputs risk scores and graded early warnings.

[0015] Compared with the prior art, the present invention has the following advantages: Detection accuracy has been significantly improved. The multimodal graph fusion mechanism integrates heterogeneous data such as vehicle damage images (ResNet-50 features) and device binding relationships. After KL divergence-mutual information dual-layer screening, redundant features are reduced by more than 40%, and AUROC is improved to 0.96. The time decay community influence feature quantifies the dynamic behavior of gangs and integrates geographical similarity (Haversine), device sharing rate, etc., which improves the detection rate of hidden gangs by 35%.

[0016] Revolutionizing real-time inference capabilities. The Flink+Checkpoint deployment architecture supports tens of thousands of TPS stream processing with inference latency of <100ms, meeting the requirements for in-process interception; the dynamic weighted ensemble model adaptively adjusts the output weights of GBDT / GAT through entropy, improving inference efficiency by 50% compared to traditional ensemble models.

[0017] Interpretability and generalization are enhanced. GAT's multi-head attention visualization of related paths helps auditors locate key nodes, reducing the false positive rate by 25%; the Bayesian optimization framework searches the hyperparameter space using the EI criterion, and the F1 score fluctuation is less than 2% when the model is transferred across institutions.

[0018] System collaboration optimization. Modular design achieves a closed loop of "multi-source acquisition → Neo4j graph storage → feature pipeline → Flink inference", improving resource utilization by 60%; dynamic threshold early warning reduces manual review by 90%. Attached Figure Description

[0019] The above and other objects, features, and advantages of exemplary embodiments of the present disclosure will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the present disclosure are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein: Figure 1 This is a flowchart illustrating an intelligent recognition method based on graph analysis according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating an intelligent recognition method based on graph analysis according to a certain embodiment of the present invention; Figure 3 This is a data association diagram consistent with an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0021] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0022] It should be understood that although the terms first, second, third, etc., may be used to describe... in the embodiments of the present invention, these... should not be limited to these terms. These terms are only used to distinguish... For example, first... may also be referred to as second... without departing from the scope of the embodiments of the present invention, and similarly, second... may also be referred to as first...

[0023] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0024] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0025] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0026] The optional embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0027] Example 1 like Figure 1 As shown, this invention discloses an intelligent recognition method based on graph analysis, comprising the following steps: Step S101: Collect structured data and multimodal data in real time from multiple heterogeneous data sources. The data sources include call records, geographic location information, device identification information, user identity information, application usage logs, high-resolution image data of vehicle damage, and three-dimensional deformation data. The image data is acquired through an on-board multi-source sensor system. Step S103: Construct the dynamic graph structure G; Step S105: Extract node features based on the dynamic graph structure G; Step S107: Fuse the node features with the original structured features, and use a feature filtering function based on mutual information to output an enhanced feature vector; Step S109: Construct an ensemble model based on the enhanced feature vectors; Step S1011: Load the trained ensemble model into the Apache Flink stream processing engine, persist the model state through Flink's Checkpoint mechanism, and calculate the risk score for new data in real time.

[0028] Example 2 The present invention proposes an intelligent recognition method based on graph analysis, comprising the following steps: Step S101: Collect structured data and multimodal data in real time from multiple heterogeneous data sources. The data sources include call records, geographic location information, device identification information, user identity information, application usage logs, high-resolution image data of vehicle damage, and three-dimensional deformation data. The image data is acquired through an on-board multi-source sensor system. Step S103: Construct the dynamic graph structure G; Step S105: Extract node features based on the dynamic graph structure G; Step S107: Fuse the node features with the original structured features, and use a feature filtering function based on mutual information to output an enhanced feature vector; Step S109: Construct an ensemble model based on the enhanced feature vectors; Step S1011: Load the trained ensemble model into the Apache Flink stream processing engine, persist the model state through Flink's Checkpoint mechanism, and calculate the risk score for new data in real time.

[0029] The preprocessing of the high-resolution image data of vehicle damage in step S101 includes: extracting image features using a ResNet-50 convolutional neural network and aligning the output feature vector with the structured data; this step integrates multimodal data and directly supports graph construction and feature fusion.

[0030] The dynamic graph structure mentioned in step S103, , where V is the set of nodes, which includes mobile phone numbers, ID card numbers, device numbers and geographical locations, E is the set of edges, which includes call relationships, attribution relationships, device binding relationships and permanent location relationships, and t is the time dimension, used to capture the temporal evolution characteristics of entity associations.

[0031] The node features mentioned in step S105 include node degree, proximity centrality, community identifier, and community influence features.

[0032] Among them, the characteristics of time decay community influence The calculation formula is as follows: , Where T is the preset time window length. Let C be the exponential decay coefficient, and C be the community set. The indicator function represents whether node v belongs to community c. For community c in time The activity function is calculated based on the weights of edges within the community. This formula integrates integral, logarithmic, and summation functions to handle the decay effect of historical data and enhance anomaly detection.

[0033] The time decay community influence characteristics Community activity function The calculation methods include: Based on the weights of all edges within community c and dynamic calculation, the formula is as follows: E c Let c be the set of edges. For edge e in time The weights are obtained using the sliding window averaging method, with the window size determined by the historical data distribution; Integrating call frequency, geographical location similarity, and device sharing rate, the formula is: , where f call The normalized value of the number of calls, sim geo For geographic distance similarity based on the Haversine formula, r device For the device sharing ratio, These are trainable coefficients, which strengthen the utilization chain between features through the relationships between nodes within the community.

[0034] Specifically, step S107 includes: fusing the node features with the original structured features, and using a feature selection function based on mutual information. Select highly relevant features to construct enhanced feature vectors. , where x is the original feature vector, g is the graph feature vector, and i is the time decay community influence feature vector. Features are used to enhance information density.

[0035] The feature selection function further includes a feature optimization step based on Kullback-Leibler divergence, as shown in the formula: , Where P is the feature X i The distribution under negative labels, Q is the distribution under non-negative labels, and the selection is made by calculating the divergence value. Features The preset threshold is used; this step, combined with the mutual information function, forms a two-layer filtering mechanism to reduce the interference of redundant features on the fusion vector.

[0036] Specifically, step S109 includes: The dataset constructed based on the timestamp is divided into a training set and a test set; The ensemble model is trained using the training set.

[0037] The ensemble model is an ensemble model of Gradient Boosting Decision Tree (GBDT) and Graph Attention Network (GAT).

[0038] The update formula for GAT layer nodes is as follows: ,in, The attention weights are adaptively adjusted by learning from end to end to adjust the contributions of neighboring nodes.

[0039] The attention weights of the graph attention network (GAT) are calculated using a multi-head attention mechanism, and the formula is as follows: , Where a is the trainable attention vector, and W is the weight matrix. The representation is vector concatenation, with LeakyReLU as the activation function. The multi-head mechanism enhances the robustness of node representation by computing multiple attention heads in parallel and concatenating the output. This GAT model replaces the basic graph neural network and uses the graph structure to adaptively focus on key neighbor nodes.

[0040] The output of the ensemble model is determined by the adaptive weight fusion formula: ,in, For the Sigmoid function, and It is a dynamic weighting function based on feature vectors. The entropy value of graph G is calculated using the following formula: , H is the information entropy function; this mechanism replaces fixed weights, enabling the model to adaptively adjust the contributions of GBDT and GAT.

[0041] In step S1011, the ensemble model is evaluated using the test set, and Bayesian optimization is used to adjust the hyperparameters to maximize the F1 score in order to obtain a trained ensemble model.

[0042] The F1 score is used as the objective function. And adjust the hyperparameters based on the Bayesian optimization method. To balance precision and recall.

[0043] The Bayesian optimization method uses the Optuna framework, models the hyperparameter space through a Gaussian process, and employs the Expected Improvement criterion for the acquisition function.

[0044] Its formula is ,in For F1 score, The current optimal value is obtained; the optimization process iteratively evaluates the combination of hyperparameters. This includes the number of GAT layers, learning rate, and ensemble weights.

[0045] The deployment of the Apache Flink stream processing framework in step S1011 includes: configuring Flink jobs using the StreamPark development scaffold to achieve parallel data pipeline processing.

[0046] The method further includes determining the risk level based on the risk score output and triggering a graded early warning mechanism, generating a risk report when the score exceeds a dynamic threshold.

[0047] The Apache Flink engine utilizes enhanced feature vectors through the following process: The real-time collected data stream is input into the dynamic graph building module for updating → the graph feature extraction module is called to generate real-time data → the data is transmitted to the loaded integration model via Flink's DataStream API → the model outputs a score and writes it to the Kafka message queue.

[0048] Among them, the ensemble model is for The processing includes an adaptive fusion mechanism: Where H is the information entropy function and G is the graph structure, the weights of GBDT and GAT are dynamically allocated through the entropy value, so that the model adjusts the decision boundary according to the entropy change of the feature vector and the graph structure.

[0049] Example 3 This invention also proposes an intelligent recognition system based on graph analysis, which includes: The multi-source data acquisition module is used to extract data in real time from call logs, geographic location, device information, user identity, and vehicle damage image data sources; The graph construction and storage module uses the Neo4j graph database to build and maintain dynamic graph structures, supporting time-series queries. The graph feature extraction module is used to calculate node degree, proximity centrality, community identifier, and time decay community influence features. The feature fusion module is used to filter and merge features based on mutual information and KL divergence; The model training and optimization module is used to train the GBDT and GAT ensemble model and tune hyperparameters. The real-time inference and early warning module uses the Apache Flink engine for transaction processing and outputs risk scores and graded early warnings.

[0050] The multi-source data acquisition module is used to extract data in real time from various data sources (such as call logs, geolocation, device information, user identity, and vehicle damage images). This module is highly flexible and scalable, capable of acquiring data from multiple data sources (such as sensors, databases, and networks) and transforming it into an easily understandable and usable format.

[0051] The graph construction and storage module uses the Neo4j graph database to build and maintain dynamic graph structures, supporting time-series queries. Neo4j is a graph database suitable for storing and querying complex relational data, such as entities and relationships in knowledge graphs.

[0052] The graph feature extraction module is used to calculate node degree, proximity centrality, community identity, and time-decaying community influence. These features are core metrics in graph analysis, used to understand the nodes and relationships within a graph structure.

[0053] The feature fusion module is used to filter and merge features based on mutual information and KL divergence. Mutual information and KL divergence are core concepts in information theory, used to measure the correlation and information content between features.

[0054] The model training and optimization module is used to train the GBDT (Gradient Boosting Decision Tree) and GAT (Graph Attention Network) ensemble model and tune the hyperparameters.

[0055] The real-time inference and early warning module uses the Apache Flink engine to process tens of thousands of events per second, outputting risk scores and tiered early warnings. Apache Flink is a stream processing framework suitable for real-time data processing and streaming computing.

[0056] Example 4 In one embodiment of the present invention, such as Figure 2 As shown, the following steps are used to achieve this: 1) Data collection: Collect data related to insurance fraud from multiple sources.

[0057] 2) Call logs: Collect call frequency, duration, etc.

[0058] 3) Location information: Collect geographic location data.

[0059] 4) Attribution relationship: Analyze the relationship between mobile phone number and ID card.

[0060] 5) Device Association: Collect device information.

[0061] 6) Other relevant data: such as user data, APP data, etc.

[0062] 7) Data processing: Preprocess the collected data, including cleaning, formatting, and transformation.

[0063] 8) Data loading: Load the processed data into the graph database or graph storage system.

[0064] 9) Graph Construction: Construct a graph structure based on the loaded data, including nodes (entities) and edges (relationships).

[0065] 10) Extract graph features: Extract features from the graph that are helpful for fraud detection, such as the degree of nodes and proximity centrality.

[0066] 11) Calculate node degree: Calculate the degree of each node in the graph.

[0067] 12) Calculate proximity centrality: Calculate the proximity centrality of nodes in the graph.

[0068] 13) Applying information graph algorithms: Using graph algorithms to analyze graph structure and features.

[0069] 14) Merge graph features: Merge the extracted graph features into the original dataset.

[0070] 15) Merging graph features into the original data: Integrating graph features into the input feature set of the machine learning model.

[0071] 16) Split the dataset based on time: Split the dataset into training and test sets based on timestamps.

[0072] 17) Prepare training data: Prepare training data for the machine learning model.

[0073] 18) Prepare test data: Prepare test data for model evaluation.

[0074] 19) Training a machine learning model: Use training data to train the model.

[0075] 20) Evaluate model performance: Evaluate the performance of the trained model.

[0076] 21) Results Analysis and Feedback: Analyze the output results of the model and obtain feedback.

[0077] 22) Model optimization: Optimize the model based on the analysis results.

[0078] 23) Feedback loop: Adjust data collection and processing strategies based on optimization results to form a closed loop for continuous improvement of model performance.

[0079] Example 5 In one embodiment of the present invention, the following steps are employed: I. Extracting structured data into Python graph structures, such as Figure 3 As shown.

[0080] Node Data Mobile phone number: As the core identifier for user communication, it contains multiple associated attributes, such as the province code (CMCC_PRVD_ID) and service status (e.g., whether it is suspended, HALT_CON), which are used to describe the ownership and usage of the number.

[0081] Geographic location: Represented by standard latitude and longitude coordinates (longitude, latitude), it can be used to locate the real-time or historical spatial location of users or devices and supports spatiotemporal behavior analysis.

[0082] ID Number: Personal identification information identified by a unique number (Nbr). It is an important identity credential for identifying a user's true identity and is often used for real-name authentication and association analysis.

[0083] Device Information: Records relevant data (Equipment) of the user's terminal device, including device model, identification, hardware characteristics, etc., which can be used for device fingerprint recognition and multi-dimensional risk assessment.

[0084] Edge Data Call logs: Describe the communication behavior between different mobile phone numbers, using call frequency (such as `Call(count,times)`) as a quantitative indicator to reflect the intensity of interaction and the closeness of the connection between users.

[0085] Attribution Relationship: Establish a real-name binding relationship between mobile phone number and ID card number. The `Belong()` relationship indicates that a number belongs to a user who has registered with a certain ID card, which is used for identity tracing and subject association.

[0086] Device association: Describes the usage relationship between a mobile phone number and a terminal device. `Infix()` indicates that a number has been used or bound to a specific device, reflecting the connection path between a person and the device.

[0087] Location information: Through the two relationships `Workat()` and `Liveat()`, the work location and permanent address of the user corresponding to the mobile phone number are described respectively. It is derived based on geolocation data (such as long-term activity trajectory) and is used to build a spatiotemporal behavior profile of the user.

[0088] II. Feature Engineering of Graph Data Feature engineering of graph data is a crucial step in graph analysis, involving the extraction of useful information from the graph structure for use by machine learning models. The following is a detailed description and flowchart of graph data feature engineering: 1. Node Degree Degree is a core concept in graph theory, used to quantify the connection strength of a node, specifically defined as the total number of edges associated with a given node. In weighted graph scenarios, "strength" can be used as an alternative metric, calculated as the sum of the weights of all edges associated with that node.

[0089] Assume G is a loaded graph object. degree = pd.DataFrame({'Node': G.nodes(), 'Degree': G.degree()}) 2. Closeness Centrality Proximity centrality is a key indicator of a node's relative central position in a network. Mathematically, it is defined as the sum of the reciprocals of the shortest path lengths from a node to all other reachable nodes in the graph. A higher value indicates that the node has better information propagation efficiency in the network.

[0090] closeness = pd.DataFrame({'Node': G.nodes(), 'Closeness':G.closeness_centrality()}) 3. Infomap Community Segmentation Infomap algorithms are efficient graph clustering methods based on the principle of minimum description length, capable of accurately identifying community structures with dense internal connections in a network. The `community_infomap()` method can be used to obtain the community ID to which each node belongs, thus revealing the modular organizational characteristics of the network.

[0091] com_infomap = pd.DataFrame({'Node': G.nodes(), 'Communities':G.community_infomap()}) 4. Graph Feature Integration To facilitate subsequent data analysis and modeling, the aforementioned feature indicators need to be merged into a comprehensive DataFrame to achieve unified management and analysis of multi-dimensional graph features.

[0092] graph_features = [degree, closeness, com_infomap] Integrate graph features into the machine learning pipeline.

[0093] Real-time updates of structured data into graph algorithms is a continuous process involving data collection, processing, loading, and analysis.

[0094] Example 6 This disclosure provides a non-volatile computer storage medium storing computer-executable instructions that can perform the steps described in the above embodiments.

[0095] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0096] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0097] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (AN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0098] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0099] The units described in the embodiments of this disclosure can be implemented in software or in hardware. The names of the units are not, in some cases, intended to limit the specific unit.

[0100] The preferred embodiments of the present invention have been described above to make the spirit of the present invention clearer and easier to understand, and are not intended to limit the present invention. All modifications, substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope summarized by the appended claims.

Claims

1. A graph-based intelligent recognition method, comprising the following steps: Step S101: Collect structured data and multimodal data in real time from multiple heterogeneous data sources. The data sources include call records, geographic location information, device identification information, user identity information, application usage logs, high-resolution image data of vehicle damage, and three-dimensional deformation data. The image data is acquired through an on-board multi-source sensor system. Step S103: Construct the dynamic graph structure G; Step S105: Extract node features based on the dynamic graph structure G; Step S107: Fuse the node features with the original structured features, and use a feature filtering function based on mutual information to output an enhanced feature vector; Step S109: Construct an ensemble model based on the enhanced feature vectors; Step S1011: Load the trained ensemble model into the Apache Flink stream processing engine, persist the model state through Flink's Checkpoint mechanism, and calculate the risk score for new data in real time.

2. The method of claim 1, wherein the dynamic graph structure in step S103, , where V is the set of nodes, which includes mobile phone numbers, ID card numbers, device numbers and geographical locations, E is the set of edges, which includes call relationships, attribution relationships, device binding relationships and permanent location relationships, and t is the time dimension, used to capture the temporal evolution characteristics of entity associations.

3. The method as described in claim 2, wherein the node features in step S105 include node degree, proximity centrality, community identity, and community influence features.

4. The method of claim 1, wherein step S109 specifically includes: The dataset constructed based on the timestamp is divided into a training set and a test set; The ensemble model is trained using the training set.

5. The method of claim 4, wherein the ensemble model is an ensemble model of Gradient Boosting Decision Tree (GBDT) and Graph Attention Network (GAT).

6. The method of claim 4, wherein in step S1011 the ensemble model is evaluated using the test set, and Bayesian optimization is used to adjust the hyperparameters to maximize the F1 score to obtain the trained ensemble model.

7. The method of claim 6, wherein the Bayesian optimization method employs the Optuna framework, models the hyperparameter space through a Gaussian process, and uses the Expected Improvement criterion for the acquisition function.

8. The method of claim 1, wherein the deployment of the Apache Flink stream processing framework in step S1011 includes: Use StreamPark development scaffolding to configure Flink jobs and implement parallel data pipeline processing.

9. The method of claim 1, wherein the method further includes determining the level based on the risk score output and triggering a graded early warning mechanism, and generating a risk report when the score exceeds a dynamic threshold.

10. An intelligent recognition system based on graph analysis, comprising: The multi-source data acquisition module is used to extract data in real time from call logs, geographic location, device information, user identity, and vehicle damage image data sources; The graph construction and storage module uses the Neo4j graph database to build and maintain dynamic graph structures, supporting time-series queries. The graph feature extraction module is used to calculate node degree, proximity centrality, community identifier, and time decay community influence features. The feature fusion module is used to filter and merge features based on mutual information and KL divergence; The model training and optimization module is used to train the GBDT and GAT ensemble model and tune hyperparameters. The real-time inference and early warning module uses the Apache Flink engine for transaction processing and outputs risk scores and graded early warnings.

Images