A risk organization dynamic identification method and device based on insurance data

Abstract

This invention provides a method and apparatus for dynamic identification of risk organizations based on insurance data. The method includes: constructing a dynamic heterogeneous graph carrying edge timestamps based on insured entity data, medical institution entity data, and claims case entity data; using the dynamic heterogeneous graph as input, obtaining dynamic node embedding vectors that integrate local topology and attribute semantics; constructing a cross-case association strength matrix based on the dynamic node embedding vectors, and retrieving multi-hop paths under the constraint of monotonically increasing edge timestamps to obtain a set of candidate risk propagation paths; extracting connected subgraphs from the candidate risk propagation path set and splicing graph structure statistical features with embedded vector pooling representations to obtain a set of candidate risk subgraphs; inputting the candidate risk subgraph set into a joint scoring model to obtain a comprehensive anomaly score, performing community partitioning on high-risk subgraphs, and outputting early warning results. This invention can effectively identify cross-case collaborative risk organizations and supports real-time detection of dynamically evolving risk structures.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of insurance risk control and artificial intelligence, specifically relating to a method and device for dynamic identification of risk organizations based on insurance data. Background Technology

[0002] Insurance risk detection is a core technical issue in the field of financial risk control. With the continuous expansion of insurance business and the increasing level of digitalization, risk behavior has evolved from an individual, single-case model to an organized, cross-case collaborative model. In high-frequency insurance types such as auto insurance and health insurance, risk organizations cause substantial claims losses through premeditated division of labor, repeated implementation of risky behaviors, and information concealment, posing a serious challenge to traditional detection technologies.

[0003] Current mainstream risk detection solutions can be categorized into two types: one is expert systems based on rule engines, which trigger risk alerts through preset threshold rules; the other is classification models based on machine learning, using algorithms such as logistic regression, random forest, and XGBoost to perform binary classification predictions on claim feature vectors. Taking the widely used XGBoost classification scheme as an example, its core principle is to concatenate structured features such as policyholder attributes, historical claim records, and medical institution credit ratings into a fixed-dimensional feature vector, and then use gradient boosting tree ensemble learning to fit the nonlinear decision boundary of the risk label. These solutions possess a certain recall capability for known risk patterns with sufficient training set distribution coverage, and the models have strong interpretability.

[0004] However, the above-mentioned approach has two key limitations: First, the existing methods use independent cases as the unit of analysis, which cannot model the co-occurrence relationships of entities such as policyholders, medical institutions, and vehicles between different cases. This results in cross-case collaborative risk organizations appearing normal in terms of single-case dimension features and being difficult to detect. Second, the existing methods rely on static feature snapshots, which cannot perceive the organizational structure changes of risk organizations over time. When faced with dynamic risk strategies such as the addition of new members and role rotation, the generalization ability is significantly limited, making it difficult to support the business needs of real-time early warning scenarios. Summary of the Invention

[0005] The technical problem to be solved by this invention is that existing cross-case collaborative risk organizations have long been prone to missed detections, and their generalization ability is significantly limited when facing dynamic risk strategies.

[0006] To address the aforementioned technical problems, this invention provides a method for dynamic identification of risk organizations based on insurance data, comprising: Based on the entity data of policyholders, entity data of medical institutions, and entity data of claims cases, a dynamic heterogeneous graph carrying edge timestamps is constructed through heterogeneous node modeling and dynamic access of temporal edges. Using the dynamic heterogeneous graph as input, the neighborhood of each target node is sampled in groups according to edge type, and inductive representation learning is performed through a type-aware neighborhood aggregation operator to obtain a dynamic node embedding vector that integrates local topology and attribute semantics. Based on the dynamic node embedding vector, the number and type of shared entities among case nodes are counted to construct a cross-case association strength matrix. For case pairs with association strength exceeding a set threshold, multi-hop paths connecting the cases are retrieved under the constraint of monotonically increasing edge timestamps to obtain a set of candidate risk propagation paths. The nodes and edges in the candidate risk propagation path set are merged to extract connected subgraphs, and the graph structure statistical features are spliced ​​with the vector pooling representation embedded in the subgraph to obtain a candidate risk subgraph set; The candidate risk subgraph set is input into the joint scoring model of fusion graph structure features and statistical anomaly detection to obtain a comprehensive anomaly score. For high-risk subgraphs with comprehensive anomaly scores exceeding the warning threshold, community division is performed to identify high-risk organizations and output warning results and risk score reports.

[0007] Optionally, the construction of a dynamic heterogeneous graph carrying edge timestamps based on policyholder entity data, medical institution entity data, and claims case entity data, through heterogeneous node modeling and dynamic access of temporal edges, includes: The participating entities are divided into policyholder nodes, medical institution nodes, claims case nodes, and vehicle nodes. Missing value imputation, numerical normalization, and categorical feature embedding encoding are performed on the original attribute fields of each node to generate the initial feature vector of each node. Define the semantic association edge types between nodes. The semantic association edge types include the claim initiation edge from the policyholder to the claim case, the medical treatment association edge from the claim case to the medical institution, the joint accident edge from the policyholder to the policyholder, and the historical affiliation edge from the vehicle to the policyholder. By appending a timestamp of the associated event to each edge, the dynamic heterogeneous graph is obtained.

[0008] Optionally, the step of performing inductive representation learning through a type-aware neighborhood aggregation operator to obtain a dynamic node embedding vector that integrates local topology and attribute semantics includes: For each associated edge type of the target node, the number of samples is set a priori based on the importance of that edge type, and a fixed number of neighboring nodes are sampled independently to form a neighborhood subset of that edge type. For each edge type, the neighborhood representation of the neighborhood subset is calculated using an aggregation function that is independently parameterized for that edge type; The neighborhood representations of all edge types are concatenated with the target node's own representation. The current layer node representation is obtained through linear transformation and nonlinear activation. After multi-layer stacking, the dynamic node embedding vector of the target node is output.

[0009] Optionally, the step of calculating the neighborhood representation of the neighborhood subset using an aggregation function independently parameterized for each edge type includes: The target node features are mapped to a query vector using a query projection matrix specific to this edge type, and the neighbor node features are mapped to a key vector using a key projection matrix specific to this edge type. The attention score is obtained by taking the dot product of the query vector and the key vector, scaling it by the square root of the single-head dimension, and then superimposing the learnable relation type bias of the edge type. The attention score is normalized within the neighborhood subset to obtain the attention weight; The single-head neighborhood representation is obtained by weighting and summing the value vectors of neighboring nodes using the attention weights. The single-head neighborhood representations of multiple attention heads are concatenated, and the concatenation results of all edge types are weighted and summed using relation-level fusion weights obtained by normalizing the representation of the target node itself, to obtain the fused neighborhood representation.

[0010] Optionally, the method further includes: Taking the new node access or new edge insertion triggered by the new business event as input, local aggregation update is only performed on the affected nodes in the multi-hop neighborhood of the access location; The message contribution of historical edges is introduced with an exponentially decaying weight that decreases as the time interval increases, so that recent business behavior occupies a higher weight in node representation. Each node maintains an embedded version number and a recent update timestamp. When a downstream module reads an embedded version, it verifies the version number. If the embedded version lags behind by more than the set maximum tolerable delay, it triggers a synchronous blocking update; otherwise, it allows reading outdated embedded versions.

[0011] Optionally, the step of retrieving multi-hop paths connecting cases under the constraint of monotonically increasing edge timestamps to obtain a set of candidate risk propagation paths includes: Using the dynamic node embedding vector of the target case node as the heuristic target, the cosine similarity between the dynamic node embedding vector of the candidate next-hop node and the heuristic target is calculated as the heuristic function value. During the path retrieval process, the path direction extending to each candidate next-hop node is defined as a search branch. Candidate nodes are expanded in order of heuristic function value from high to low, and the branch is pruned when the heuristic function value is lower than the set heuristic threshold. In path expansion, maintain the end timestamp of the current path and only allow the expansion of edges whose timestamps are not less than the end timestamp; For nodes in the current search task that have been accessed more than the set access frequency limit, subsequent paths should be prevented from passing through that node; The graph is divided into multiple partitions based on the embedding clustering results of dynamic node embedding vectors. Path retrieval tasks within each partition are assigned to independent computing threads for concurrent execution, and cross-partition path segments are coordinated through shared memory message passing.

[0012] Optionally, the step of inputting the candidate risk subgraph set into a joint scoring model of fused graph structural features and statistical anomaly detection to obtain a comprehensive anomaly score includes: The isolation forest method is used to evaluate the degree of isolation of the feature vectors of the subgraph in the feature space and output the structural anomaly score. The local density deviation between the feature vector of the subgraph and its neighboring samples is evaluated by the local outlier factor, and the density anomaly score is output. The degree of anomaly is determined by the reconstruction error of the candidate subgraph features by the autoencoder, and a semantic anomaly score is output. The structural anomaly score, the density anomaly score, and the semantic anomaly score are weighted and summed according to the fusion weights to obtain the comprehensive anomaly score.

[0013] Optionally, the fusion weights are determined by a dynamic adaptive mechanism, which includes: Every set calibration period, a validation set is constructed using cases that have recently completed manual claims verification. The area under the precision and recall curves is calculated for isolated forests, local outliers, and autoencoders, respectively. Using the ratio of the area under the precision and recall curves to the sum of the three as the target, the historical fusion weights are smoothly updated according to the set update learning rate; When the area under the precision-recall curve of any anomaly detector is lower than the random baseline for multiple consecutive calibration periods, the fusion weight of that anomaly detector is forcibly reduced to a set lower limit, and the fusion weight of the other two anomaly detectors is increased proportionally.

[0014] Optionally, the step of performing community segmentation on high-risk subgraphs whose comprehensive anomaly scores exceed the early warning threshold, identifying high-risk organizations, and outputting early warning results and risk score reports includes: The normalized value of the comprehensive anomaly score is used as the edge weight of the high-risk subgraph; Introduce a type compatibility indicator function into the modularity function to allow nodes within the compliant type set to be assigned to the same community; Calculate the modularity gain for each node by moving it to each neighboring community, and move the node to the community with the largest modularity gain while satisfying type compatibility constraints. The resulting communities are compressed into supernodes and node movement is repeatedly performed on the supernode graph until the modularity gain is lower than the set convergence threshold. The list of member nodes of each organization, its size, and the core organizer node with the highest betweenness centrality are then output. The list of member nodes, their size, and the core organizer nodes are integrated into a structured early warning result. A risk score report is generated and output by combining the comprehensive anomaly scores of each member node.

[0015] Secondly, embodiments of this disclosure also provide a risk organization dynamic identification device based on insurance data, comprising: The dynamic graph construction module is used to construct a dynamic heterogeneous graph with edge timestamps based on the entity data of the insured, the entity data of the medical institution, and the entity data of the claims case, through heterogeneous node modeling and dynamic access of temporal edges. The node representation module is used to take the dynamic heterogeneous graph as input, sample the neighborhood of each target node in groups according to edge type, and perform inductive representation learning through a type-aware neighborhood aggregation operator to obtain a dynamic node embedding vector that integrates local topology and attribute semantics. The path mining module is used to count the number and type of shared entities between case nodes based on the dynamic node embedding vector to construct a cross-case association strength matrix, and for case pairs with association strength exceeding a set threshold, to retrieve multi-hop paths connecting the cases under the constraint of monotonically increasing edge timestamps, thereby obtaining a set of candidate risk propagation paths. The subgraph extraction module is used to extract connected subgraphs by merging nodes and edges in the candidate risk propagation path set, and to splice the graph structure statistical features with the vector pooling representation embedded in the subgraph to obtain a candidate risk subgraph set. The early warning module is used to input the candidate risk subgraph set into a joint scoring model of fusion graph structure features and statistical anomaly detection to obtain a comprehensive anomaly score. For high-risk subgraphs whose comprehensive anomaly scores exceed the early warning threshold, community division is performed to identify high-risk organizations and output early warning results and risk score reports.

[0016] The technical effects of this invention are as follows: By adopting dynamic heterogeneous graph modeling and temporal edge dynamic access mechanism, the system can perceive the evolution structure of risk relationships in real time, thereby solving the problem that existing methods rely on static feature snapshots and have insufficient generalization ability in the face of dynamic risk strategies, and achieving continuous and effective real-time detection in dynamic risk scenarios; By adopting cross-case association strength matrix and temporal constraint multi-hop path retrieval mechanism, it can discover hidden collaborative patterns across multiple independent cases, thereby solving the problem of long-term missed detection of cross-case collaborative risk organizations by existing methods with independent cases as units, and significantly improving the risk detection capability.

[0017] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the overall process of the risk organization dynamic identification method based on insurance data provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the dynamic heterogeneous graph construction process provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the multi-head type perception graph attention neighborhood aggregation process provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the neighborhood representation process for calculating neighborhood subsets provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of a multi-level pruning time-constrained multi-hop path retrieval process provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the process for obtaining a comprehensive anomaly score provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the dynamic adaptive calibration process for fusion weights provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of the community division process provided in an embodiment of the present invention; Figure 9 This is a schematic diagram of the module structure of a risk organization dynamic identification device based on insurance data provided in an embodiment of the present invention. Detailed Implementation

[0020] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0021] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0022] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0023] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0024] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0025] like Figure 1 As shown, a method for dynamic identification of risk organizations based on insurance data is provided, including the following steps: S1. Based on the entity data of the insured, the entity data of the medical institution, and the entity data of the claims case, a dynamic heterogeneous graph carrying edge timestamps is constructed through heterogeneous node modeling and dynamic access of time-series edges.

[0026] The insurance claims database involves multiple entities: policyholders (individuals holding policies and submitting claims), medical institutions (institutional entities providing medical services and issuing medical invoices), claims cases (claims transaction entities uniquely identified by case numbers), and vehicles (vehicle assets that are the insured objects in auto insurance claims). By treating these entities as graph nodes, and using business event-driven entity relationships as graph edges, and recording the timestamp of the associated event for each edge, the true relationship network of risk organizations collaboratively implementing risk behaviors across cases can be structurally reconstructed.

[0027] For the specific sub-steps of this step, please refer to [link / details]. Figure 2 As shown.

[0028] S2. Using a dynamic heterogeneous graph as input, sample the neighborhood of each target node in groups according to edge type, and perform inductive representation learning through a type-aware neighborhood aggregation operator to obtain a dynamic node embedding vector that integrates local topology and attribute semantics.

[0029] Traditional graph neural networks employ type-indiscriminate uniform aggregation, failing to distinguish the different semantics carried by heterogeneous edges. This step introduces a type-aware inductive aggregation framework, enabling each edge type to have an independently parameterized aggregation function. This allows node embedding vectors to simultaneously encode local topological connectivity patterns and multi-type attribute semantic information.

[0030] For the specific sub-steps of this step, please refer to [link / details]. Figure 3 As shown.

[0031] S3. Based on dynamic node embedding vectors, the number and type of shared entities among case nodes are counted to construct a cross-case association strength matrix. For case pairs with association strength exceeding a set threshold, multi-hop paths connecting the cases are retrieved under the constraint of monotonically increasing edge timestamps to obtain a set of candidate risk propagation paths.

[0032] Based on dynamic node embedding vectors, the number and type of shared entities among case nodes are counted to construct a cross-case association strength matrix. Specifically, for any pair of claim case nodes, the number of policyholder, medical institution, and vehicle nodes they are commonly associated with are counted. Preset weight coefficients are assigned to different types of entities (e.g., a weight of 1.0 for shared policyholders and 0.5 for shared vehicles). The number of shared entities of each type is multiplied by its corresponding weight and then summed to obtain the association strength value for the case pair. Finally, a symmetric matrix is ​​constructed with case nodes as indices and association strength values ​​as elements.

[0033] Single-hop direct association can only capture directly shared entities between cases; the real collaborative path of risk organizations often involves multi-hop transmission through multiple intermediate entity nodes. This step first quantifies the association strength between case pairs, initiates multi-hop path retrieval with temporal constraints for strongly associated case pairs, and keeps the edge timestamps in the path monotonically increasing to filter out pseudo-paths with reverse temporal order, ensuring that the candidate paths are consistent with the risk behavior propagation logic in terms of temporal semantics.

[0034] S4. Merge the nodes and edges in the candidate risk propagation path set to extract connected subgraphs, and then combine the statistical features of the graph structure with the vector pooling representation embedded in the subgraph to obtain the candidate risk subgraph set.

[0035] The process involves merging nodes and edges in the candidate risk propagation path set to extract a connected subgraph. Specifically, a shared node threshold is set. When multiple paths intersect at a specific node (such as an intermediary node), these paths and their covered nodes are merged into a connected subgraph. The graph structure statistical features are then combined with the vector pooling representation embedded within the subgraph to obtain the candidate risk subgraph set. This step integrates multiple linear propagation paths into a mesh-connected structure, reconstructing the collaborative pattern of multiple interwoven paths when risk organizations actually implement risk behaviors, and providing a complete organizational structure representation for subsequent anomaly scoring and community segmentation.

[0036] A single path represents only a linear risk propagation link, while the actual risk behavior structure implemented by a risk organization typically presents as a connected subgraph with interwoven multiple paths. This step merges paths with shared nodes or edges, extracts connected subgraphs as candidate risk subgraphs, and calculates structural statistical features such as graph density, average path length, and degree distribution entropy for the subgraphs. These features are then concatenated with the mean / maximum pooling representation of the vectors embedded within the subgraph to form a subgraph feature vector that balances structure and semantics.

[0037] S5. Input the candidate risk subgraph set into the joint scoring model of fusion graph structure features and statistical anomaly detection to obtain a comprehensive anomaly score. Perform community division on high-risk subgraphs whose comprehensive anomaly scores exceed the warning threshold, identify high-risk organizations, and output warning results and risk score reports.

[0038] A single anomaly detector has limitations in dealing with complex and ever-changing risk patterns. This step integrates the scores from three complementary detectors—isolated forest (structural anomaly score), local outlier factor (density anomaly score), and autoencoder (semantic anomaly score)—to obtain a comprehensive anomaly score. The high-risk subgraph is then subjected to type-constrained weighted modularity optimization for community partitioning, outputting a list of organizational members and core organizer nodes to form a risk scoring report that can be directly used by claims adjusters.

[0039] Optionally, such as Figure 2 As shown, the step S1, "based on the entity data of the insured, the entity data of the medical institution, and the entity data of the claims case, a dynamic heterogeneous graph carrying edge timestamps is constructed through heterogeneous node modeling and dynamic access of temporal edges," is further refined into the following sub-steps: S1.1. Divide the participating entities into policyholder nodes, medical institution nodes, claims case nodes, and vehicle nodes, and perform missing value filling, numerical normalization, and categorical feature embedding encoding on the original attribute fields of each node to generate the initial feature vector of each node.

[0040] The original attribute fields of each entity type differ in semantics and dimensions: Policyholder node attributes include age, number of historical claims, and policy type; medical institution node attributes include qualification level and number of historical related cases; claim case node attributes include claim amount, case occurrence time, and insurance type; and vehicle node attributes include vehicle model, year of manufacture, and accident history. Numerical fields are standardized using z-scores, while categorical fields (such as insurance type and institution level) are encoded using trainable embeddings. Missing fields are filled with the field mean (numerical) or high-frequency categories (categorical). Finally, all types of fields are concatenated into a fixed-dimensional initial feature vector.

[0041] S1.2. Define the semantic association edge types between nodes. The semantic association edge types include the claim initiation edge from the policyholder to the claim case, the medical treatment association edge from the claim case to the medical institution, the joint accident edge from the policyholder to the policyholder, and the historical affiliation edge from the vehicle to the policyholder.

[0042] The four edge types characterize the collaborative relationships of risk organizations from different semantic dimensions: the claim initiation edge records the application attribution relationship between the policyholder and the claim case they submit; the medical treatment association edge records the medical institutions involved in the claim case, which is used to discover abnormal concentration patterns where multiple cases share the same institution; the joint loss edge connects policyholders who jointly lost in the same accident, which is used to identify suspected members of a premeditated collective loss organization, that is, when two or more policyholders are the applicants or related persons of the same claim case, a joint loss edge is established between the policyholder nodes; the historical attribution edge records the historical association between the vehicle and the policyholder, which helps to identify risky behaviors such as borrowing a vehicle and risky patterns of vehicle transfer.

[0043] S1.3. Add a timestamp of the time when the associated event occurred to each edge to obtain a dynamic heterogeneous graph.

[0044] Each edge is appended with a Unix timestamp field, accurate to the second, taken from the actual recorded time of the event in the business system (such as the time of claim submission, medical record time, accident time, etc.). For historical batch-imported existing data, the earliest recorded time of the corresponding event in the business system is used. The existence of the timestamp field enables the graph structure to carry temporal semantics, providing a foundation for subsequent temporal constraint path retrieval and incremental updates.

[0045] Optionally, such as Figure 3 As shown, the step S2, "performing inductive representation learning through type-aware neighborhood aggregation operators to obtain dynamic node embedding vectors that integrate local topology and attribute semantics," is refined into the following sub-steps: S2.1. For each associated edge type of the target node, the sampling quantity is set a priori based on the importance of the edge type, and a fixed number of neighboring nodes are sampled independently to form a neighborhood subset of the edge type.

[0046] Suppose that the target node v is associated with R types of edges (such as claims initiation edges, medical treatment association edges, joint accident edges, and historical attribution edges). For the r-th edge type, the sampling quantity is set based on the prior importance of that edge type to the risk detection task. (If the importance of jointly escaping danger is higher, then...) Historical attribution is of lower importance, therefore... From the set of neighbor nodes connected to v through the r-th type of edge, samples are drawn using uniform random sampling (with replacement sampling if the number of neighbors is insufficient). Nodes form a neighborhood subset of the r-th edge type. .

[0047] S2.2. For each edge type, use an aggregation function that is independently parameterized for that edge type to compute the neighborhood representation of the neighborhood subset.

[0048] The specific implementation of this sub-step adopts a multi-head type perception graph attention mechanism, as detailed in sub-step S2.2. Figure 3 Sub-steps).

[0049] S2.3. Concatenate the neighborhood representations of all edge types with the target node's own representation, and obtain the current layer node representation through linear transformation and nonlinear activation. After multi-layer stacking, output the dynamic node embedding vector of the target node.

[0050] set up Let v be the initial feature vector of the target node. Let r be the fusion neighborhood representation of the r-th edge type (obtained from S2.2), then the current layer (the r-th edge type) The layer node representation is updated as follows: in, For the first The learnable weight matrix of the layer, For bias vectors, It is a ReLU nonlinear activation function. This represents vector concatenation. Indicates the first The fused neighborhood representation of the r-th edge type in the layer network. After stacking L layers (default L=3), the dynamic node embedding vector of the target node v is output. Its receptive field covers the L-hop neighborhood of v, integrating the local topological structure and attribute semantic information of multiple edge types.

[0051] Optionally, such as Figure 4As shown, the step "compile the neighborhood representation of the neighborhood subset using an aggregation function that is independently parameterized by the edge type" in S2.2 is refined by adopting a multi-head type-aware graph attention mechanism, including the following sub-steps: S2.2.1. Map the target node features to a query vector using the query projection matrix specific to this edge type, and map the neighbor node features to a key vector using the key projection matrix specific to this edge type.

[0052] Given edge type r, attention head k, and query projection matrix as follows: The key projection matrix is Where d is the node feature dimension, For single-head dimension, Number of attention heads (default) =4). Then the query vector of the target node v at the k-th head is Neighbor nodes The key vector at the k-th head is The query matrix and key matrix are completely independent for different edge types, ensuring that attention calculations for different semantic relationships do not interfere with each other.

[0053] S2.2.2. Perform a dot product on the query vector and the key vector, scale it by the square root of the single-head dimension, and then superimpose the learnable relation type bias of the edge type to obtain the attention score.

[0054] In the k-th head, the attention score of the target node v to its neighbor node u is: in The learnable scalar bias for the r-th edge type at the k-th head is used to compensate for the systematic attention baseline differences between different edge types, preventing edge types with lower prior importance from being suppressed as a whole in aggregation due to their inherently lower scores.

[0055] S2.2.3. Normalize the attention scores within the neighborhood subset to obtain the attention weights.

[0056] For the neighborhood subset of the k-th head with edge type r Internal softmax normalization is performed: Normalization is performed independently within the neighborhood subsets of each edge type, ensuring that the sum of attention weights for the same edge type is 1, thus making the aggregation results between neighborhoods of different sizes comparable.

[0057] S2.2.4. The value vectors of neighboring nodes are weighted and summed using attention weights to obtain a single-head neighborhood representation.

[0058] The value vector of neighbor node u at the k-th head is ,in Let be the projection matrix of the value of the k-th head of this edge type. The single-head neighborhood of the k-th head is represented as: S2.2.5. Concatenate the single-head neighborhood representations of multiple attention heads, and sum the concatenation results of all edge types using the relation-level fusion weights obtained by normalizing the representation of the target node itself to obtain the fused neighborhood representation.

[0059] The multi-head splicing neighborhood representation of the r-th edge type is: The relation-level fusion weight is represented by the target node itself. After layer normalization, and with the learnable weight vector Dot product and softmax normalization yield: The final fused neighborhood is represented as follows: Because of the relation-level fusion weighting mechanism, different nodes can adaptively adjust their attention to the neighborhood of each edge type based on their own representation, so that the node embedding vector can reflect the actual role characteristics of the node in the heterogeneous relation network, thereby providing a more discriminative node representation for subsequent cross-case path retrieval.

[0060] Optionally, the risk organization dynamic identification method based on insurance data also includes: Taking the new node access or new edge insertion triggered by the new business event as input, local aggregation update is only performed on the affected nodes in the multi-hop neighborhood of the access location.

[0061] When a new claim event occurs, the corresponding new node or edge is added to the dynamic graph incrementally. The computational cost of recalculating the entire graph increases twice with the node size, which is unacceptable in high-frequency event scenarios. This embodiment adopts a local aggregation strategy: taking the endpoint of the newly added node or edge as the center, it expands outward by L hops (consistent with the number of model layers, 3 hops by default) to determine the affected neighborhood set; only the nodes within this neighborhood set are re-sampled and aggregated forward propagated to update their embedding vectors; the embeddings of nodes outside the neighborhood remain unchanged and do not need to be recalculated.

[0062] The contribution of historical edge messages is introduced with an exponentially decaying weight that decreases as the time interval increases, so that recent business behavior occupies a higher weight in node representation.

[0063] Let the current time be The timestamp of historical edge e is Then the message contribution decay weight of that side is: in Attenuation coefficient (default) (Time unit is days), during aggregation Multiplying the value vector contribution of the corresponding neighboring nodes makes the weight of recent related events in the node representation higher than that of distant historical events.

[0064] Each node maintains an embedded version number and a recent update timestamp. When a downstream module reads an embedded version, it verifies the version number. If the embedded version lags behind by more than the set maximum tolerable delay, it triggers a synchronous blocking update; otherwise, it allows reading outdated embedded versions.

[0065] Each node maintains an embedded version number. (Auto-incrementing after each embedded update) and the most recent update timestamp Before reading the embedded node, the downstream path mining module verifies the current time and... Does the difference exceed the maximum tolerable delay? (Default 60 seconds): If this timeframe is exceeded, a synchronous blocking update is triggered before reading; otherwise, reading the current version of the embedding is allowed to tolerate slight staleness within the latency range. This mechanism ensures a lower bound on real-time performance while reducing the costly full recalculation triggered for each read, thus improving system throughput.

[0066] Optionally, such as Figure 5 As shown, the step S3, "retrieving multi-hop paths connecting cases under the constraint of monotonically increasing edge timestamps to obtain a set of candidate risk propagation paths," is refined using multi-level pruning, including the following sub-steps: S3.1. Using the dynamic node embedding vector of the target case node as the heuristic target, calculate the cosine similarity between the dynamic node embedding vector of the candidate next-hop node and the heuristic target as the heuristic function value. During the path retrieval process, the path direction extending to each candidate next-hop node is defined as a search branch. The candidate nodes are expanded in order of heuristic function value from high to low, and the branch is pruned when the heuristic function value is lower than the set heuristic threshold.

[0067] Since the dynamic node embedding vector obtained in step S2 integrates the local topology and attribute semantics of the nodes, nodes with similar business characteristics or similar network positions (such as core members and peripheral participants of the same organization, or cases with highly similar risk-taking methods) will have significantly close vector distances in the embedding space. Therefore, using cosine similarity as a heuristic function is reasonable: high similarity indicates that candidate nodes and target cases are highly correlated in semantic features, potentially belonging to the same potential organizational modality or risk propagation chain, and thus have a higher probability of being on the correct propagation path.

[0068] Let the embedding vector of the target case node in the path retrieval be... If the current path's end node is v and the candidate next-hop node is u, then the heuristic function value is: In the formula, This represents the dynamic node embedding vector of the candidate next-hop node u.

[0069] The search queue is maintained in descending order of h(u) (maximum priority queue), and candidate nodes with the most similar embedding to the target node are expanded first. When the heuristic threshold is set to 0.3 (default), prune extended branches with u as the next hop to avoid invalid searches in directions that deviate from the target semantics.

[0070] In risky organizational scenarios, heuristic functions suggest that nodes within the same organization or along a propagation path often share similar risk-implementing behaviors, resource characteristics, or association patterns. These shared attributes are reflected in the node embedding vectors learned through a type-aware graph attention mechanism, thus exhibiting high similarity in the latent semantic space. This pruning strategy, assuming similar organizational node features, improves search efficiency by prioritizing the exploration of semantically similar nodes, avoiding ineffective expansion in semantically divergent directions.

[0071] S3.2. Maintain the end timestamp of the current path during path expansion, and only allow the expansion of edges whose timestamps are not less than the end timestamp.

[0072] Each path maintains an end timestamp variable. Initialize it to the earliest relevant edge timestamp of the source case node. During each expansion, only the edge timestamp is updated. The edges are included in the candidate expansion set; after successful expansion, the settings are updated. This constraint ensures that the occurrence time of events in the path is monotonically constant along the path direction, filtering out paths that do not satisfy the temporal causal logic, and guaranteeing that the candidate paths are consistent with the causal propagation logic of risky behaviors in terms of temporal semantics.

[0073] S3.3. For nodes in the current search task that have been visited more than the set access frequency limit, subsequent paths are prohibited from passing through that node.

[0074] Maintain a global node access counter The counter for each visited node is incremented during path expansion. (default When v is added to the global forbidden set for this search task, all subsequent extended paths will no longer pass through v, preventing path explosion near the height number hub node.

[0075] S3.4. Based on the embedding clustering results of the dynamic node embedding vectors, the graph is divided into multiple partitions. The path retrieval tasks within each partition are assigned to independent computing threads for concurrent execution, and cross-partition path segments are coordinated through shared memory message passing.

[0076] During the offline preprocessing stage, k-means clustering (default k=16 partitions) is performed on the node embeddings of the entire graph, grouping semantically similar nodes into the same partition. During online retrieval, path retrieval tasks within the same partition are scheduled to an independent thread pool for that partition. When path expansion crosses the partition boundary, a cross-partition path segment message (including the current path context and end timestamp) is sent to the thread pool of the target partition. After receiving the message, the target thread continues to execute subsequent expansions. Each partition thread writes independently to the shared memory of its partition without the need for locking, significantly reducing the latency of large-scale graph path retrieval.

[0077] Optionally, refer to Figure 6 The step S5, "inputting the candidate risk subgraph set into the joint scoring model of fusion graph structure features and statistical anomaly detection to obtain a comprehensive anomaly score," is further refined, including the following sub-steps: S5.1. Use isolated forest to evaluate the degree of isolation of the subgraph feature vectors in the feature space and output the structure anomaly score.

[0078] Isolation Forest calculates the average split depth required to isolate the feature vectors of a target subgraph by performing random recursive splits on the subgraph's feature vector space. Risky subgraphs, due to structural anomalies (high density, high node sharing rate, short average path), are located in sparse edge regions of the feature space and require only a few splits to isolate; short isolation depths correspond to high anomaly scores. Let the normalized isolation score output by Isolation Forest be... The larger the value, the more abnormal it is.

[0079] S5.2. Use the local outlier factor to evaluate the local density deviation between the feature vector of the subgraph and its neighboring samples, and output the density anomaly score.

[0080] The Local Outlier Factor (LOF) is calculated as the ratio of the local reachability density of a target subgraph's feature vector to its k nearest neighbors (k=10 by default). When the density of the local region containing the target subgraph is significantly lower than that of its neighboring regions, the LOF value is greater than 1, indicating that the subgraph is an outlier in terms of density. After normalizing the LOF score to the [0, 1] interval, the density anomaly score is output. : in The cutoff limit is set (default 10) to prevent extreme outliers from dominating the score.

[0081] S5.3. The degree of anomaly is determined by the reconstruction error of the candidate subgraph features by the autoencoder, and a semantic anomaly score is output.

[0082] The autoencoder is pre-trained on a large number of normal subgraph features to learn a low-dimensional manifold representation of the normal subgraph. For a candidate subgraph feature vector f, the autoencoder outputs a reconstructed vector. Calculate the mean square reconstruction error: in The feature dimension of the subgraph is denoted by the 95th percentile of the reconstruction error on the training set. To truncate and normalize, the semantic anomaly score is obtained: S5.4. The structural anomaly score, density anomaly score, and semantic anomaly score are weighted and summed according to the fusion weight to obtain the comprehensive anomaly score.

[0083] The overall abnormality score is: Among them, the fusion weight and The initial default values ​​are 0.35, 0.35, and 0.30, respectively, and are continuously updated by a dynamic adaptive mechanism.

[0084] Optionally, such as Figure 7 As shown, the statement "the fusion weights are determined by a dynamic adaptive mechanism" is further elaborated. The dynamic adaptive mechanism includes the following sub-steps: S5.4.1. At each set calibration period, a validation set is constructed using cases that have recently completed manual claims verification. The area under the precision and recall curves is calculated for isolated forests, local outliers, and autoencoders, respectively.

[0085] A 7-day default calibration cycle is used. During each calibration, cases that have completed manual claims processing (including risk confirmation and normal case closure markings) within the last 7 days are collected as the validation set (the sample size must be at least 100 cases; otherwise, the set is accumulated until the condition is met before triggering calibration). For the outlier scores of the single detectors output by the Isolation Forest, Local Outlier Factor, and Autoencoder, the corresponding Area Under the Precision and Recall (AUPRC) curves are calculated using the validation set annotations, and denoted as follows: .

[0086] S5.4.2. Using the ratio of the area under each precision and recall curve to the sum of the three as the target, perform a smooth update on the historical fusion weights according to the set update learning rate.

[0087] The target weights are: To update the learning rate Exponential smoothing is applied to historical weights: Smooth updates avoid drastic weight fluctuations caused by noise in single calibration data, thus improving the system's stability in small-sample calibration scenarios.

[0088] S5.4.3. When the area under the precision-recall curve of any anomaly detector is lower than the random baseline for multiple consecutive calibration periods, the fusion weight of that anomaly detector is forcibly reduced to a set lower limit and the fusion weight of the other two anomaly detectors is increased proportionally.

[0089] The random baseline is defined as the proportion of high-risk cases in the validation set (i.e., the positive class prior probability). Each of the three detectors maintains a counter that is continuously lower than the random baseline. ;like If it is below the random baseline, then ,otherwise .when (During 3 consecutive calibration cycles) force to Reduced to the lower limit This will reduce the amount The weights are allocated to the other two detectors in proportion to their current weights, ensuring that the sum of the weights is always 1.

[0090] Optionally, refer to Figure 8 The step in S5, "performing community partitioning on high-risk subgraphs with comprehensive anomaly scores exceeding the warning threshold to identify high-risk organizations," is refined using type-constrained weighted modularity optimization, including the following sub-steps: S5.5. Use the normalized value of the comprehensive anomaly score as the edge weight of the high-risk subgraph.

[0091] For each edge (i, j) in the high-risk subgraph, the weight of the edge is obtained by normalizing the arithmetic mean of the comprehensive anomaly scores of the nodes at both ends: Edges with high weights indicate that both nodes are highly suspicious and are preferentially assigned to the same community, thus focusing the community assignment results on the core organizations with the most dense risk associations.

[0092] S5.6. Introduce a type compatibility indicator function in the modularity function to allow nodes within the compliant type set to be assigned to the same community.

[0093] The standard modularity function is extended to a form with type constraints. A type compatibility indicator function is defined. If and only if the type combination of node i and node j belongs to the set of compliant types (e.g., {policyholder, policyholder} and {policyholder, claim case} are both compliant; {medical institution, vehicle} is a non-compliant combination); otherwise The modularity function with type constraints is: Where m is the sum of edge weights. Let be the weighted degree of node i. This is a community-specific indicator function.

[0094] S5.7. Calculate the modularity gain for each node by moving it to each neighboring community, and move the node to the community with the largest modularity gain while satisfying the type compatibility constraint.

[0095] For node v, try moving it from the current community to each neighboring community in turn, and calculate the modularity gain. The standard gain formula of the Louvain algorithm is used, replacing the original function with a modularity function with type constraints; only for functions that satisfy... The move computation gain (where u is the target community member) is calculated; the compliant move with the largest gain is selected for execution; if the gain of all compliant moves is not greater than 0, the node remains in its current community.

[0096] S5.8. Compress the resulting communities into supernodes and repeatedly perform node movement on the supernode graph until the modularity gain is lower than the set convergence threshold. Output the list of member nodes of each organization, the organization size, and the core organizer node with the highest betweenness centrality.

[0097] S5.9. Integrate the member node list, organization size, and core organizer nodes into a structured early warning result, and generate a risk score report by combining the comprehensive anomaly score of each member node and output it.

[0098] For S5.8 and S5.9, after each round of node movement, each community is compressed into a single supernode, whose weight is equal to the sum of the edge weights within the original community, and the edge weights between supernodes are the sum of the edge weights between the original communities, forming the input graph for the next iteration. This process of node movement and supernode compression is repeated until the maximum modularity gain from any node movement is lower than the convergence threshold. In the output phase, for each final community partition, the list of member nodes and the organization size (number of member nodes) are enumerated, and the betweenness centrality of each member node is calculated. The node with the highest betweenness centrality is marked as the core organizer node and included in the early warning results and risk scoring report.

[0099] like Figure 9 As shown, a risk organization dynamic identification device based on insurance data is provided, comprising: The dynamic graph construction module 101 is used to construct a dynamic heterogeneous graph with edge timestamps based on the entity data of the insured, the entity data of the medical institution, and the entity data of the claims case, through heterogeneous node modeling and dynamic access of temporal edges. The node representation module 102 is used to take a dynamic heterogeneous graph as input, sample the neighborhood of each target node in groups according to edge type, and perform inductive representation learning through a type-aware neighborhood aggregation operator to obtain a dynamic node embedding vector that integrates local topology and attribute semantics. The path mining module 103 is used to count the number and type of shared entities between case nodes based on dynamic node embedding vectors to construct a cross-case association strength matrix, and for case pairs whose association strength exceeds a set threshold, to retrieve multi-hop paths connecting the cases under the constraint of monotonically increasing edge timestamps, thereby obtaining a set of candidate risk propagation paths. The subgraph extraction module 104 is used to extract connected subgraphs by merging nodes and edges in the candidate risk propagation path set, and to splice the graph structure statistical features with the vector pooling representation embedded in the subgraph to obtain a candidate risk subgraph set. The organization early warning module 105 is used to input the candidate risk subgraph set into the joint scoring model of fusion graph structure features and statistical anomaly detection to obtain a comprehensive anomaly score. For high-risk subgraphs with comprehensive anomaly scores exceeding the early warning threshold, community division is performed to identify high-risk organizations and output early warning results and risk score reports.

[0100] The dynamic graph construction module transforms multi-source entity data into a heterogeneous graph structure carrying temporal information, providing a unified graph data foundation for the entire system. The node representation module performs type-aware inductive learning based on this graph structure, outputting high-quality node embeddings that balance topology and semantics, driving the accuracy of downstream path retrieval. The path mining module utilizes semantic guidance and temporal monotonic constraints of node embedding vectors to efficiently locate cross-case collaborative risk propagation paths. The subgraph extraction module integrates discrete paths into a complete organizational structure representation, providing information-rich feature inputs for the scoring model. The organization early warning module outputs actionable risk warning results through multi-detector joint scoring and community segmentation. These five modules collaborate sequentially to achieve real-time identification and early warning of dynamic risk organizations.

[0101] The various variations and specific examples of the risk organization dynamic identification method based on insurance data provided above are also applicable to the risk organization dynamic identification device based on insurance data provided in this disclosure. Through the foregoing detailed description of the risk organization dynamic identification method based on insurance data, those skilled in the art can clearly understand the implementation method of the risk organization dynamic identification device based on insurance data. For the sake of brevity, it will not be described in detail here.

[0102] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0103] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0104] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0105] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0106] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0107] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0108] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for dynamic identification of risk organizations based on insurance data, characterized in that, include: Based on the entity data of policyholders, entity data of medical institutions, and entity data of claims cases, a dynamic heterogeneous graph carrying edge timestamps is constructed through heterogeneous node modeling and dynamic access of temporal edges. Using the dynamic heterogeneous graph as input, the neighborhood of each target node is sampled in groups according to edge type, and inductive representation learning is performed through a type-aware neighborhood aggregation operator to obtain a dynamic node embedding vector that integrates local topology and attribute semantics. Based on the dynamic node embedding vector, the number and type of shared entities among case nodes are counted to construct a cross-case association strength matrix. For case pairs with association strength exceeding a set threshold, multi-hop paths connecting the cases are retrieved under the constraint of monotonically increasing edge timestamps to obtain a set of candidate risk propagation paths. The nodes and edges in the candidate risk propagation path set are merged to extract connected subgraphs, and the graph structure statistical features are spliced ​​with the vector pooling representation embedded in the subgraph to obtain a candidate risk subgraph set; The candidate risk subgraph set is input into the joint scoring model of fusion graph structure features and statistical anomaly detection to obtain a comprehensive anomaly score. For high-risk subgraphs with comprehensive anomaly scores exceeding the warning threshold, community division is performed to identify high-risk organizations and output warning results and risk score reports.

2. The method according to claim 1, characterized in that, The process involves constructing a dynamic heterogeneous graph with edge timestamps based on policyholder entity data, medical institution entity data, and claims case entity data, through heterogeneous node modeling and dynamic access of temporal edges. The participating entities are divided into policyholder nodes, medical institution nodes, claims case nodes, and vehicle nodes. Missing value imputation, numerical normalization, and categorical feature embedding encoding are performed on the original attribute fields of each node to generate the initial feature vector of each node. Define the semantic association edge types between nodes. The semantic association edge types include the claim initiation edge from the policyholder to the claim case, the medical treatment association edge from the claim case to the medical institution, the joint accident edge from the policyholder to the policyholder, and the historical affiliation edge from the vehicle to the policyholder. By appending a timestamp of the associated event to each edge, the dynamic heterogeneous graph is obtained.

3. The method according to claim 1, characterized in that, The process of performing inductive representation learning through type-aware neighborhood aggregation operators to obtain dynamic node embedding vectors that fuse local topology and attribute semantics includes: For each associated edge type of the target node, the number of samples is set a priori based on the importance of that edge type, and a fixed number of neighboring nodes are sampled independently to form a neighborhood subset of that edge type. For each edge type, the neighborhood representation of the neighborhood subset is calculated using an aggregation function that is independently parameterized for that edge type; The neighborhood representations of all edge types are concatenated with the target node's own representation. The current layer node representation is obtained through linear transformation and nonlinear activation. After multi-layer stacking, the dynamic node embedding vector of the target node is output.

4. The method according to claim 3, characterized in that, For each edge type, the neighborhood representation of the neighborhood subset is calculated using an aggregation function independently parameterized for that edge type, including: The target node features are mapped to a query vector using a query projection matrix specific to this edge type, and the neighbor node features are mapped to a key vector using a key projection matrix specific to this edge type. The attention score is obtained by taking the dot product of the query vector and the key vector, scaling it by the square root of the single-head dimension, and then superimposing the learnable relation type bias of the edge type. The attention score is normalized within the neighborhood subset to obtain the attention weight; The single-head neighborhood representation is obtained by weighting and summing the value vectors of neighboring nodes using the attention weights. The single-head neighborhood representations of multiple attention heads are concatenated, and the concatenation results of all edge types are weighted and summed using relation-level fusion weights obtained by normalizing the representation of the target node itself, to obtain the fused neighborhood representation.

5. The method according to claim 1, characterized in that, The method further includes: Taking the new node access or new edge insertion triggered by the new business event as input, local aggregation update is only performed on the affected nodes in the multi-hop neighborhood of the access location; The message contribution of historical edges is introduced with an exponentially decaying weight that decreases as the time interval increases, so that recent business behavior occupies a higher weight in node representation. Each node maintains an embedded version number and a recent update timestamp. When a downstream module reads an embedded version, it verifies the version number. If the embedded version lags behind by more than the set maximum tolerable delay, it triggers a synchronous blocking update; otherwise, it allows reading outdated embedded versions.

6. The method according to claim 1, characterized in that, The process of retrieving multi-hop paths connecting cases under the constraint of monotonically increasing edge timestamps yields a set of candidate risk propagation paths, including: Using the dynamic node embedding vector of the target case node as the heuristic target, the cosine similarity between the dynamic node embedding vector of the candidate next-hop node and the heuristic target is calculated as the heuristic function value. During the path retrieval process, the path direction extending to each candidate next-hop node is defined as a search branch. Candidate nodes are expanded in order of heuristic function value from high to low, and the branch is pruned when the heuristic function value is lower than the set heuristic threshold. In path expansion, maintain the end timestamp of the current path and only allow the expansion of edges whose timestamps are not less than the end timestamp; For nodes in the current search task that have been accessed more than the set access frequency limit, subsequent paths should be prevented from passing through that node; The graph is divided into multiple partitions based on the embedding clustering results of dynamic node embedding vectors. Path retrieval tasks within each partition are assigned to independent computing threads for concurrent execution, and cross-partition path segments are coordinated through shared memory message passing.

7. The method according to claim 1, characterized in that, The step of inputting the candidate risk subgraph set into a joint scoring model that integrates graph structure features and statistical anomaly detection to obtain a comprehensive anomaly score includes: The isolation forest method is used to evaluate the degree of isolation of the feature vectors of the subgraph in the feature space and output the structural anomaly score. The local density deviation between the feature vector of the subgraph and its neighboring samples is evaluated by the local outlier factor, and the density anomaly score is output. The degree of anomaly is determined by the reconstruction error of the candidate subgraph features by the autoencoder, and a semantic anomaly score is output. The structural anomaly score, the density anomaly score, and the semantic anomaly score are weighted and summed according to the fusion weights to obtain the comprehensive anomaly score.

8. The method according to claim 7, characterized in that, The fusion weights are determined by a dynamic adaptive mechanism, which includes: Every set calibration period, a validation set is constructed using cases that have recently completed manual claims verification. The area under the precision and recall curves is calculated for isolated forests, local outliers, and autoencoders, respectively. Using the ratio of the area under the precision and recall curves to the sum of the three as the target, the historical fusion weights are smoothly updated according to the set update learning rate; When the area under the precision-recall curve of any anomaly detector is lower than the random baseline for multiple consecutive calibration periods, the fusion weight of that anomaly detector is forcibly reduced to a set lower limit, and the fusion weight of the other two anomaly detectors is increased proportionally.

9. The method according to claim 1, characterized in that, The process of performing community segmentation on high-risk subgraphs whose comprehensive anomaly scores exceed the warning threshold, identifying high-risk organizations, and outputting warning results and risk score reports includes: The normalized value of the comprehensive anomaly score is used as the edge weight of the high-risk subgraph; Introduce a type compatibility indicator function into the modularity function to allow nodes within the compliant type set to be assigned to the same community; Calculate the modularity gain for each node by moving it to each neighboring community, and move the node to the community with the largest modularity gain while satisfying type compatibility constraints. The resulting communities are compressed into supernodes and node movement is repeatedly performed on the supernode graph until the modularity gain is lower than the set convergence threshold. The list of member nodes of each organization, its size, and the core organizer node with the highest betweenness centrality are then output. The list of member nodes, their size, and the core organizer node are integrated into a structured early warning result. A risk score report is generated and output by combining the comprehensive anomaly scores of each member node.

10. A risk organization dynamic identification device based on insurance data, characterized in that, include: The dynamic graph construction module is used to construct a dynamic heterogeneous graph with edge timestamps based on the entity data of the insured, the entity data of the medical institution, and the entity data of the claims case, through heterogeneous node modeling and dynamic access of temporal edges. The node representation module is used to take the dynamic heterogeneous graph as input, sample the neighborhood of each target node in groups according to edge type, and perform inductive representation learning through a type-aware neighborhood aggregation operator to obtain a dynamic node embedding vector that integrates local topology and attribute semantics. The path mining module is used to count the number and type of shared entities between case nodes based on the dynamic node embedding vector to construct a cross-case association strength matrix, and for case pairs with association strength exceeding a set threshold, to retrieve multi-hop paths connecting the cases under the constraint of monotonically increasing edge timestamps, thereby obtaining a set of candidate risk propagation paths. The subgraph extraction module is used to extract connected subgraphs by merging nodes and edges in the candidate risk propagation path set, and to splice the graph structure statistical features with the vector pooling representation embedded in the subgraph to obtain a candidate risk subgraph set. The early warning module is used to input the candidate risk subgraph set into a joint scoring model of fusion graph structure features and statistical anomaly detection to obtain a comprehensive anomaly score. For high-risk subgraphs whose comprehensive anomaly scores exceed the early warning threshold, community division is performed to identify high-risk organizations and output early warning results and risk score reports.

Images