Knowledge graph-based risk management method, device and equipment

Abstract

The application provides a knowledge graph-based risk management method, device and equipment, and relates to the field of financial technology or other related fields. The method comprises the following steps: in response to a query operation of a user, generating a graph query statement based on the query operation, wherein the graph query statement comprises an iteration condition; performing conditional iteration on a pre-constructed knowledge graph, screening nodes and / or edges satisfying the iteration condition, and generating a target iteration result according to the nodes and / or edges; and generating a risk analysis result according to business objects corresponding to the nodes involved in the target iteration result and / or association relationships corresponding to the edges involved in the target iteration result. The method of the application improves the accuracy and result usability of complex association risk identification.

Description

Technical Field

[0001] This application relates to the field of financial technology or other related fields, and in particular to a risk management method, apparatus and equipment based on knowledge graph. Background Technology

[0002] In banking lending scenarios, risk management is a core element in ensuring fund security and compliance. Existing risk management typically employs rule engines and statistical analysis models to identify and assess transaction and business data.

[0003] However, such solutions mostly focus on analyzing single transactions or partial historical data, lacking a unified characterization of multi-entity and multi-dimensional relationships. This leads to insufficient identification of complex risk chains, which can easily cause delayed early warnings, increased false alarms and missed reports, and increased burden on manual verification.

[0004] Therefore, how to achieve risk management in complex scenarios involving multiple stakeholders in order to achieve more effective risk management has become an urgent technical problem to be solved. Summary of the Invention

[0005] This application provides a risk management method, apparatus, and equipment based on knowledge graphs to address the technical problems in existing risk management technologies, such as the lack of a unified characterization of multi-subject, multi-dimensional relationships, insufficient global modeling capabilities, and inadequate identification capabilities for associated risks.

[0006] Firstly, this application provides a risk management method based on knowledge graphs, including:

[0007] In response to a user's query operation, a graph query statement is generated based on the query operation, the graph query statement including: traversal conditions;

[0008] A conditional traversal is performed on the pre-constructed knowledge graph to filter nodes and / or edges that satisfy the traversal conditions, and a target traversal result is generated based on the nodes and / or edges.

[0009] Based on the business objects corresponding to the nodes involved in the target traversal result, and / or the association relationships corresponding to the edges involved in the target traversal result, a risk analysis result is generated.

[0010] Secondly, this application provides a knowledge graph-based risk management device, comprising:

[0011] The generation module is used to respond to a user's query operation and generate a graph query statement based on the query operation. The graph query statement includes: traversal conditions.

[0012] The processing module is used to perform conditional traversal on the pre-built knowledge graph, filter nodes and / or edges that satisfy the traversal conditions, and generate the target traversal result based on the nodes and / or edges.

[0013] The management module is used to generate risk analysis results based on the business objects corresponding to the nodes involved in the target traversal results and / or the association relationships corresponding to the edges involved in the target traversal results.

[0014] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0015] The memory stores computer-executed instructions;

[0016] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0017] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0018] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0019] The knowledge graph-based risk management method, apparatus, and equipment provided in this application transform user query requests into executable graph query statements, unify multi-source data within a knowledge graph, output target traversal results based on traversal conditions, and generate risk analysis results by combining business objects and relationships. This enables complex risk relationships to be identified and presented in a traceable, interconnected form. Compared to rule-matching methods based on single transactions or partial records, this embodiment can reconstruct risk relationships in scenarios involving business objects and their multiple relationships, providing business personnel with risk analysis results that can be directly used for verification, labeling, and handling, thus improving the accuracy and usability of complex risk identification. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] Figure 1 This application provides a schematic diagram of a risk management scenario as an embodiment of the present application.

[0022] Figure 2A flowchart illustrating a knowledge graph-based risk management method provided in this application embodiment. Figure 1 ;

[0023] Figure 3 A flowchart illustrating a knowledge graph-based risk management method provided in this application embodiment. Figure 2 ;

[0024] Figure 4 This application provides an illustration of a target traversal result. Figure 1 ;

[0025] Figure 5 This application provides an illustration of a target traversal result. Figure 2 ;

[0026] Figure 6 A schematic diagram of a knowledge graph-based risk management device provided in this application embodiment;

[0027] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0028] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0030] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0031] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0032] It should be noted that the knowledge graph-based risk management method, apparatus, and equipment provided in this application can be used in the fintech field, or in any field other than fintech. The application fields of the knowledge graph-based risk management method, apparatus, and equipment in this application are not limited.

[0033] This application applies to multi-entity risk management scenarios, such as risk management in banking lending, and is particularly suitable for complex businesses involving customers, intermediaries, partner institutions, and transaction relationships, such as second-hand housing loans and business loans. Related systems typically access multi-source data such as transaction logs, approval records, and business ledgers to identify and issue early warnings for risk clues.

[0034] Figure 1 This application provides a schematic diagram of a risk management scenario, as shown in the embodiments. Figure 1 As shown, existing risk monitoring solutions are typically based on rule engines or statistical analysis models to identify abnormal indicators in single transactions or local historical records. For example, they output early warning results based on rules such as short-term cash flow after loan disbursement, abnormal account receipts and payments, and deviations of entity behavior from historical characteristics. Their working principle mainly involves conditional matching, threshold comparison, or batch anomaly screening of business data.

[0035] However, most existing technologies revolve around isolated data points, lacking the ability to provide a unified characterization of customers, accounts, institutions, and their relationships, making it difficult to identify complex risk chains involving multiple entities as a whole. When risky behaviors are transmitted through multiple levels of accounts, various relationships, or across different stages, existing solutions often can only detect local anomalies and struggle to accurately reconstruct the associated paths.

[0036] In view of this, how to more accurately identify complex risk relationships based on existing related data and output results that can be used for management decisions has become an urgent technical problem to be solved.

[0037] To address the aforementioned issues, a knowledge graph-based risk management method is provided. In response to user queries, a graph query statement containing traversal conditions is generated based on the query operation. This method performs conditional traversal on a pre-constructed knowledge graph, filtering nodes and / or edges that meet the traversal conditions. Based on the obtained target traversal results, combined with the business objects corresponding to the involved nodes and the associations corresponding to the involved edges, a risk analysis result is generated. This technical approach relies on the knowledge graph to form a unified organizational foundation for business objects and associations, and performs conditional traversal through graph query statements, thereby improving the targeting and effectiveness of risk identification in complex association scenarios.

[0038] Figure 2 A flowchart illustrating a knowledge graph-based risk management method provided in this application embodiment. Figure 1 ,like Figure 2 As shown, the method includes:

[0039] S201. In response to the user's query operation, generate a graph query statement based on the query operation. The graph query statement includes traversal conditions.

[0040] In this embodiment of the application, the executing entity can be a risk management server deployed in a bank's risk control platform, or a processing system composed of a graph computing engine and a business application server.

[0041] Graph query statements are used to carry the user's query intent and drive subsequent traversal processing of the knowledge graph. Examples of graph query statements include Gremlin traversal statements and Cypher query statements.

[0042] Traversal conditions are used to limit query parameters. The specific implementation of traversal conditions can be based on nodes, edges, or combinations of other query constraints, thereby filtering nodes and / or edges that meet the conditions and forming the subsequent traversal results. Traversal conditions can be, for example, query object identifiers, object types, relation types, and filtering conditions.

[0043] User query operations indicate the user's query purpose and can originate from risk control review terminals, business management workbench, or early warning verification interfaces. Specifically, it can be a query request formed by the user selecting the query object, entering query keywords, checking the relationship type, or setting relevant constraints in a graphical interface.

[0044] In one possible embodiment, a user query operation can be initiated against a business object in the knowledge graph, against the relationship between business objects, or directly against a specific risk association scenario.

[0045] In this step, after receiving a query operation, the query purpose carried in the query operation is used to generate a graph query statement including traversal conditions.

[0046] Specifically, after receiving the query operation input by the user, the query operation is parsed to obtain the traversal conditions, and then a graph query statement is generated based on the traversal conditions. This transforms the user's query purpose into computable traversal conditions, providing a unified input for the conditional traversal in the subsequent knowledge graph.

[0047] For example, a scenario where a loan from an intermediary returns the loan to the original intermediary (simultaneously, the customer's down payment originates from the intermediary's account and the loan proceeds to the same intermediary account within three days of disbursement).

[0048] The Gremlin traversal statement is as follows:

[0049] gV().hasLabel('Mediator').as('a')

[0050] .outE('Customer's down payment comes from intermediary's account').as('e1') .inV().hasLabel('Customer').as('c')

[0051] .outE('Customer loan disbursement flows to the same intermediary account within three days').as('e2') .inV().where(eq('a'))

[0052] .path()

[0053] Optionally, if the user's query is in natural language, the natural language is converted into structured traversal conditions through lexical segmentation, entity recognition, and intent recognition, thereby generating a graph query statement.

[0054] By standardizing user queries into graph query statements that include traversal conditions, targeted searches can be performed based on the user's query objectives.

[0055] In one possible implementation, the method further includes: extracting multiple business objects from multi-source risk monitoring data, and combining the business objects and their relationships according to preset graph structure rules to generate a knowledge graph.

[0056] The related relationships include at least one of the following: fund transfer relationships and subordinate relationships, wherein the fund transfer relationships are used to indicate historical transactions;

[0057] Multi-source risk monitoring data is used to carry risk-related information from different business systems.

[0058] Knowledge graphs serve as the data carrier and foundation for risk management and correlation analysis, storing entity objects and their relationships and supporting conditional traversal.

[0059] Business objects are used to abstract customers, accounts, intermediaries, institutions and their managed objects as vertices in the diagram. Relationships are used to describe the business connections between business objects. Fund transfer relationships are used to represent the flow of funds formed in the transaction flow. Subordination relationships are used to represent the subordinate relationships in organization, cooperation or management.

[0060] Specifically, after acquiring multi-source risk monitoring data such as transaction records, approval records, business ledgers, and external investigation data, entity identification and relationship extraction are performed on structured fields, while unstructured text is parsed and entity disambiguation is used to determine the corresponding business objects, and the identifiers of the same entity in different sources are uniformly mapped.

[0061] For fund transfer relationships, the system establishes edges based on the payer, payee, transaction time, amount, and summary information, and writes historical transactions as edge attributes into the graph; for subordinate relationships, the system establishes edges based on organizational structure, cooperation agreement, management affiliation, or business affiliation information, and records the relationship type, source data, and effective time.

[0062] The node type, edge type and connection direction are verified according to the preset graph structure rules. Business objects and related relationships that meet the constraints are combined into a knowledge graph. The graph structure rules can correspond to standardized entity templates such as customers, accounts, institutions and transactions, as well as the connectable range of edges, to ensure that the relationship expression in the graph is consistent.

[0063] When a query is received, traversal and filtering can be performed directly based on this knowledge graph. Since the business objects and their financial relationships and hierarchical relationships have been organized in a unified graph structure, historical transaction links and entity attribution links can be directly associated during the query, thus forming a traversable and traceable relationship network.

[0064] For example, multi-source risk monitoring data includes down payments for second-hand homes originating from the accounts of real estate agency personnel, second-hand home loans flowing to the same account within three days of disbursement, and batch defaults on individual loans handled by the same investigator.

[0065] Entity tables and relationship tables are created based on multi-source risk monitoring data. The entity tables include: Customer, Partner, Intermediary, First Investigator, First-Tier Branch, and Second Investigator.

[0066] The relationship table includes financial transaction relationships and subordinate relationships. The financial transaction relationships include the following:

[0067] 1) Side 1: Customer --> Intermediary (the customer's loan funds flow to the same intermediary account within three days of disbursement);

[0068] 2) Side 2: Intermediary --> Client (Client's down payment comes from the intermediary's account);

[0069] Subordination includes the following:

[0070] 1) Intermediary --> Partner: This relationship indicates the affiliation between the intermediary and the partner.

[0071] 2) Customer --> First Investigator (The customer is the one who handled the batch defaults on individual loans)

[0072] 3) Side 5: Customer --> First-tier branch (the institution where the customer applied for the loan)

[0073] The entity table and the relationship table are combined according to the preset graph structure rules to generate a knowledge graph.

[0074] By mapping discrete information in multi-source risk monitoring data into graph structure data, subsequent graph queries can locate risk objects based on complete association links, thereby improving query consistency and association identification capabilities in complex relationship scenarios.

[0075] S202. Perform conditional traversal on the pre-constructed knowledge graph, filter nodes and / or edges that meet the traversal conditions, and generate the target traversal result based on the nodes and / or edges.

[0076] Among them, nodes are used to store business objects extracted from risk monitoring data, and are the basic objects for conditional traversal and risk analysis.

[0077] Edges are used to represent the relationships between business objects stored in the connected nodes of a knowledge graph.

[0078] The target traversal result is used to represent the output result obtained after conditional traversal of the knowledge graph, and serves as the basis for generating risk analysis results. Its specific implementation can be nodes and / or edges that meet the conditions, or their corresponding association result representation.

[0079] In this embodiment of the application, the knowledge graph has been constructed and stored in a graph database or graph computing platform before the method is executed. The knowledge graph can be pre-constructed from multi-source risk monitoring data.

[0080] In this step, after receiving the graph query statement generated in step S201, conditional traversal is performed based on the traversal conditions in the graph query statement.

[0081] Specifically, the system traverses and filters relevant nodes and / or edges in the knowledge graph based on traversal conditions. The filtering process can check node conditions, edge conditions, and other constraints. Edges or nodes that do not meet the conditions are directly eliminated by the system; edges and nodes that meet the conditions are recorded as candidate results by the system, and the corresponding target traversal results are generated based on the filtering results.

[0082] Optionally, multiple target traversal results obtained from the same query can be sorted according to a preset method for later use when generating result information.

[0083] For example, if the query objective is to identify abnormal associations between business objects, the relevant nodes and edges in the knowledge graph are traversed and filtered according to the graph query statement, and finally the target traversal result that can reflect the association situation is obtained, thereby reflecting the local association characteristics between relevant business objects.

[0084] S203. Generate risk analysis results based on the business objects corresponding to the nodes involved in the target traversal results and / or the association relationships corresponding to the edges involved in the target traversal results.

[0085] Risk analysis results are used to assist in risk identification, risk labeling, and subsequent handling decisions, providing business personnel with a basis for risk assessment. Risk analysis results may include, for example, risk tags, anomaly markers, and handling recommendations.

[0086] In this step, after obtaining the target traversal result, the business objects stored in the nodes and / or the relationships stored in the edge storage in the target traversal result are analyzed and summarized to form the risk analysis result.

[0087] For example, if the traversal condition is to filter business objects as intermediaries, and the intermediary's fund transfers exceed a preset number of times within three days, then the target traversal result is the node whose fund transfers exceed the preset number of times within three days. Based on the intermediary information stored in the node, the corresponding intermediary list is generated, which is the risk analysis result.

[0088] Specifically, information is extracted based on the target traversal results, and risk analysis results are generated for display to users based on the extracted information.

[0089] In one possible implementation, for situations requiring subsequent approval or verification processes, risk marker fields and disposal flow fields can also be generated simultaneously. For example, the query results can be written into the risk control case table, associated risk markers can be added to loan business records, or the target traversal results can be pushed as attachment data to the manual review queue.

[0090] By transforming the graph structure elements in the target traversal results into business-understandable and manageable result expressions, risk judgment no longer stops at abstract nodes and edges, but falls on specific business objects and their relationships, thus forming a closed loop between the knowledge graph traversal output and risk management decisions.

[0091] This application provides a knowledge graph-based risk management method. By transforming user query requests into executable graph query statements, it unifies multi-source data within the knowledge graph, outputs target traversal results based on traversal conditions, and then generates risk analysis results by combining business objects and relationships. This allows complex risk relationships to be identified and presented in a traceable, interconnected form. Compared to rule-matching methods focused on single transactions or partial records, this embodiment can reconstruct risk relationships in scenarios involving business objects and their various relationships, providing business personnel with risk analysis results that can be directly used for verification, labeling, and handling, thus improving the accuracy and usability of complex risk identification.

[0092] Figure 3 A flowchart illustrating a knowledge graph-based risk management method provided in this application embodiment. Figure 2 In this embodiment Figure 1 Based on the previous embodiment, the traversal conditions further include: a starting node, a termination condition, and first node constraints and / or first edge constraints. The target traversal result includes: the target traversal path. The above-mentioned conditional traversal of the pre-constructed knowledge graph is performed to filter nodes and / or edges that satisfy the traversal conditions, and the target traversal result is generated based on the nodes and / or edges. A detailed explanation follows, such as... Figure 3 As shown, the method includes:

[0093] S301. In the knowledge graph, the starting node is taken as the current node. When the adjacent nodes of the current node satisfy the first node constraint condition and / or the first edge constraint condition, the adjacent nodes are updated to the current node. The traversal ends when the termination condition is met.

[0094] The termination condition is used to end the traversal.

[0095] The termination condition can be the number of traversal levels. For example, during traversal, if the number of traversal levels is reached, the traversal ends.

[0096] Termination conditions can also be limited by the attributes of the updated current node, such as the updated current node being the same as the starting node, or the current node determined after traversal being the same as the adjacent node of the starting node, thereby forming a closed loop or limiting the path.

[0097] The first node constraint can correspond to node attributes, labels, or type requirements. The first edge constraint can be filtered according to edge type, relationship attributes, or business meaning.

[0098] The current node refers to the node that is continuously updated during the traversal of the knowledge graph.

[0099] The starting node is the initial node determined during the query.

[0100] An adjacent node is a node that is connected to the current node by an edge.

[0101] In this step, the traversal of adjacent nodes begins with the starting node as the current node and proceeds layer by layer. During the traversal, the current node is replaced by adjacent nodes that satisfy the first node constraint and / or the first edge constraint to advance the path expansion until the termination condition is met, at which point the traversal ends.

[0102] In the specific implementation, after receiving the graph query statement generated by the query operation, the identification information corresponding to the starting node is read from the knowledge graph and written into the current node storage unit of the traversal engine.

[0103] When the traversal engine searches for the adjacent nodes of the current node, it first determines whether the adjacent node satisfies the first node constraint condition and / or whether the edge corresponding to the adjacency satisfies the first edge constraint condition. Only adjacent nodes that satisfy the constraints are used as the current node for the next round of traversal.

[0104] After determining that the adjacent nodes satisfy the constraints, the new current node continues to be used as the retrieval center for repeated adjacency expansion until the termination condition is met.

[0105] S302. Connect each current node in sequence to generate the target traversal path.

[0106] During the traversal, the sequence of current nodes before and after each update is recorded, and then connected sequentially according to the access order to form a target traversal path that can represent the relationship between nodes.

[0107] This application provides a risk management method based on a knowledge graph. In the knowledge graph, starting from a starting node, the method updates adjacent nodes to the current node when they satisfy a first node constraint and / or a first edge constraint. Traversal continues until a termination condition is met, and each current node is connected sequentially to generate a target traversal path. Node constraints and / or edge constraints jointly limit the expansion direction, ensuring the traversal process only proceeds along relationships that align with the query objective. The termination condition controls the path boundaries, thus obtaining a target traversal path corresponding to the risk relationship. This path fully reflects the relationship transmission chain between multiple entities in the knowledge graph and provides a clear structured basis for subsequent risk analysis results.

[0108] Based on the aforementioned embodiments, the termination conditions further include: the updated current node is the same as the starting node, or the current node determined after traversal is the same as the adjacent node of the starting node; correspondingly, the target traversal path includes: a risk closed-loop path; generating risk analysis results based on the business objects corresponding to the nodes involved in the target traversal results, and / or the association relationships corresponding to the edges involved in the target traversal results, including: further performing conditional traversal on the knowledge graph based on the business objects corresponding to the nodes involved in the target traversal results to determine the associated objects of the business objects; determining the historical transactions or subordinate relationships indicated by the association relationships corresponding to the edges involved in the target traversal results; generating risk analysis results based on the business objects, associated objects, and historical transactions or subordinate relationships.

[0109] In practice, upon receiving a query operation, the starting node is written into the traversal context, and the knowledge graph is expanded layer by layer based on the constraints of the first node and / or the constraints of the first edge. When the updated current node is the same as the starting node, or the current node is the same as the adjacent node of the starting node, it is determined that a closed-loop link has been formed, and this link is output as a risk closed-loop path.

[0110] Based on the business objects stored at the nodes in the risk closed-loop path, the system continues to retrieve related objects with graph relationships in the knowledge graph, using these business objects as new traversal entry points. Simultaneously, edges in the path are converted into financial transaction relationships or subordinate relationships, and corresponding historical transaction records are traced back accordingly. After unifying the related objects, historical transactions, or subordinate relationships with the business objects, a risk analysis result is formed for risk assessment. This result may include a closed-loop description, historical transaction details, and risk warnings.

[0111] For example, if a loan brokerage returns a loan to a client and the client is then routed back to the same brokerage firm, the Gremlin iteration statement would be as follows:

[0112] gV().hasLabel('Mediator').as('a')

[0113] .outE('Relationship between intermediaries and partners').as('e4').inV().as('b')

[0114] .select('a').outE('Customer's down payment came from the intermediary's account').as('e1').inV().hasLabel('Customer').as('c')

[0115] .outE('').as('e2').inV()

[0116] .outE('Relationship between intermediary and partner').as('e3').inV().where(eq('b'))

[0117] .path()

[0118] Figure 4 This application provides an illustration of a target traversal result. Figure 1 The query results of the above Gremlin traversal statement are as follows: Figure 4 As shown, Figure 4 In this case, intermediary A is affiliated with both intermediary companies D and E. The down payments for clients B and C both come from intermediary A. After approval by the primary institution bank G and the secondary institution bank F, the loans are issued to clients B and C. Subsequently, clients B and C transfer the client loans to intermediary A, resulting in the client loans flowing into the same intermediary account within three days of disbursement.

[0119] Analysis reveals that the aforementioned fund transfers created a closed loop: the intermediary was both the payer of the down payment and the final recipient of the loan funds, resulting in "empty fund transfers." Transactions were dispersed through different branches and third-party accounts to conceal the flow of funds. The two intermediary companies may have fabricated second-hand housing transactions to assist in completing loan applications and fund repatriation.

[0120] The system generates risk warning results, including closed-loop funding, risk control avoidance, and deep involvement of intermediaries.

[0121] Furthermore, based on the business objects corresponding to the nodes involved in the target traversal results, a conditional traversal is performed on the knowledge graph. For example, customer B can be selected for K-level expansion, with a degree of 1, which means starting from the current node, searching for all related neighbor nodes within level 1. The result is as follows:

[0122] Figure 5 This application provides an illustration of a target traversal result. Figure 2 ,like Figure 5 As shown in the diagram, this illustrates a risk case of a second-hand housing loan: Customer B applies for a loan through secondary institution bank F; the down payment is paid by intermediary A (which may involve fraudulent transactions or illegal sources of funds); primary institution bank G and secondary institution bank F jointly handle the loan, and the funds flow back to the same account within three days after the loan is issued, which raises suspicions of irregularities.

[0123] By identifying abnormal fund inflows or multi-entity connections through a risk closed-loop path, and incorporating the entities in the path along with historical transactions into the risk analysis results, the completeness and interpretability of risk clues are improved, while reducing the workload of manual comparison.

[0124] Based on the aforementioned embodiments, the traversal conditions further include: the traversal level K and the starting node. The target traversal result includes: the target traversal subgraph. The pre-constructed knowledge graph is traversed conditionally to filter nodes and / or edges that meet the traversal conditions. The target traversal result is generated based on the nodes and / or edges, including: starting from the starting node, traversing outward layer by layer in the knowledge graph until the current traversal level reaches the traversal level K; obtaining the nodes traversed in each layer as the associated nodes of the starting node, and recording the edges between the starting node and the associated nodes, as well as the edges between the associated nodes; combining the starting node, the associated nodes, and the edges recorded during the traversal process to generate the target traversal subgraph.

[0125] Among them, associated nodes refer to the nodes that are visited sequentially during the hierarchical traversal. The connection relationships between them and the starting node, as well as between them and other associated nodes, are recorded through edges to maintain the integrity of the local relationship links.

[0126] In actual processing, after receiving the traversal level K and the starting node, the knowledge graph is expanded layer by layer from the starting node's position in the graph, and the adjacent nodes connected to the current node are marked at each level.

[0127] When the level count reaches K, the expansion stops, while the set of nodes and edges traversed in the traversal path is preserved.

[0128] Record the nodes traversed in each layer as associated nodes, and simultaneously extract the relationship edges between the starting node and associated nodes, as well as the relationship edges between each associated node. Then, organize the starting node, associated nodes, and recorded edges together into a subgraph data structure to output the target traversed subgraph.

[0129] By preserving local knowledge connections extending from the starting node in a limited-depth manner, multi-layered relationship chains are presented, providing structured input for subsequent risk analysis based on node business objects and edge relationships.

[0130] Based on the aforementioned embodiments, further, risk analysis results are generated according to the business objects corresponding to the nodes involved in the target traversal results and / or the association relationships corresponding to the edges involved in the target traversal results. This includes: extracting the topological features of the target traversal subgraph from the target traversal subgraph; and performing anomaly identification on the business objects and association relationships corresponding to the target traversal subgraph based on the topological features to generate risk analysis results.

[0131] Among them, topological features are used to describe the statistical properties of the local structure. The statistical properties include at least one or more of the following: node in-degree, path length, number of branches, loop features, and node connection density, and serve as input for anomaly identification.

[0132] Anomaly identification is used to determine whether the business objects and relationships corresponding to the target traversal subgraph present risk anomalies. The judgment criteria include the connection level between business objects, the strength of the transaction association indicated by the edge, whether there are high-frequency cross-entity connections, and whether a closed-loop transmission relationship is formed.

[0133] In the specific implementation, after obtaining the target traversal subgraph, the node identifiers, edge types and connection directions are parsed first, and the out-degree, in-degree and local path length of each node are counted. Then, the topological features are formed by combining the repeated connection relationships, loop relationships and cross-level jump relationships in the subgraph.

[0134] The analysis is performed jointly based on the topological features and the business object information corresponding to the target traversal subgraph. Anomalies can be identified in the topological features according to the preset anomaly judgment model, rule threshold or graph structure matching template. When high fan-out connections, abnormal short path closed loops, dense clustering of similar subjects or multi-level transmission links are identified, the corresponding risk analysis results are output.

[0135] By extracting topological features and identifying anomalies in the target traversal subgraph, the local connectivity patterns in the graph structure can be transformed into computable risk assessment criteria, thereby improving the accuracy and interpretability of risk identification in complex interconnected scenarios.

[0136] Based on the aforementioned embodiments, the target traversal result further includes: traversal conditions including: second node constraint conditions and / or second edge constraint conditions, performing conditional traversal on the pre-constructed knowledge graph, filtering nodes and / or edges that satisfy the traversal conditions, and generating the target traversal result based on the nodes and / or edges, including: performing point-edge queries on the knowledge graph to obtain target nodes and / or target edges that satisfy the second node constraint conditions and / or second edge constraint conditions.

[0137] The second node constraint is used to limit the screening criteria of target nodes in point-edge queries. It is implemented by constraining node attributes, node types or node labels so as to retrieve target nodes that match risk objects, business entities or related entities in the knowledge graph.

[0138] The second constraint condition is used to limit the screening criteria for the target edge. It is implemented by constraining the relationship type, edge attribute or business meaning of the edge in order to retrieve the target edge that represents the flow of funds, business association or transaction connection.

[0139] Point-edge query refers to a query method that directly matches the conditions of nodes and edges in the graph. It does not rely on path traversal, but locates objects that meet the conditions in the knowledge graph based on the constraints.

[0140] In the specific implementation, after receiving a graph query statement related to risk query, a matching query is executed based on the node attribute index, edge type index, or relation attribute index. Nodes and / or edges that satisfy the second node constraint condition and / or the second edge constraint condition are output as target nodes and / or target edges, and are used for subsequent risk object association analysis.

[0141] If the query statement contains both a second node constraint and a second edge constraint, then only the nodes and edges that satisfy both the second node constraint and the second edge constraint will be returned.

[0142] By adopting this specific implementation method, nodes and edges that meet the constraints can be directly obtained in complex business graphs, making the query results more focused on specific business objects and their relationship information, thereby improving the accuracy and processing efficiency of risk clue retrieval.

[0143] Based on the aforementioned embodiments, further, risk analysis results are generated according to the business objects corresponding to the nodes involved in the target traversal results and / or the association relationships corresponding to the edges involved in the target traversal results, including at least one of the following: determining the in-degree and out-degree of the target node based on the knowledge graph; marking the target node and generating risk analysis results when the in-degree and out-degree exceed a preset threshold; and marking the target edge and the two end nodes of the target edge when the target edge represents historical transactions based on the knowledge graph, and marking the target edge and the two end nodes of the target edge when the transaction characteristics of the historical transactions meet the abnormal characteristics, and generating risk analysis results.

[0144] In-degree is used to measure the number of connections of a target node in the knowledge graph.

[0145] The preset threshold is used to indicate the boundary for judging the number of node connections anomalies. This threshold can be preset based on the statistical distribution of historical business graphs, the average connection level of similar business objects, or risk control configuration strategies.

[0146] Transaction characteristics are used to describe attributes such as transaction time, transaction frequency, fund flow, or transaction amount.

[0147] Abnormal features refer to the deviation state formed when transaction features match the preset abnormal judgment rules.

[0148] In the specific implementation, after obtaining the nodes and edges that satisfy the second node constraint and the second edge constraint, the target nodes and target edges involved are extracted, and the corresponding node identifiers, edge identifiers and association attributes are read from the knowledge graph.

[0149] For a target node, its inbound and outbound edge sets are queried based on the node index. The number of connections is counted and compared with a preset threshold. When the number of connections exceeds the threshold, the target node is written into the risk tag set, and a risk analysis result containing node identifier, anomaly cause, and related object information is generated simultaneously.

[0150] For the target edge, historical transaction records are traced back based on the transaction mapping relationship corresponding to the target edge. Rule comparison is performed by combining characteristics such as transaction time interval, frequency of recurrence, flow path and amount fluctuation. When the abnormal characteristics are met, the target edge and its two end nodes are jointly marked as risk-related objects, and the related transaction link, hit rules and risk warning information are output.

[0151] By synchronously identifying the connection strength of the target node and the historical transactions reflected by the target edge, the traversal results are further transformed into risk analysis results that can be directly used for management decisions, thereby improving the accuracy of risk clue location and the interpretability of the results.

[0152] Figure 6 A schematic diagram of a knowledge graph-based risk management device provided in this application embodiment is shown below. Figure 6 As shown, the risk management device 60 based on knowledge graph provided in this embodiment includes: a generation module 601, a processing module 602, and a management module 603;

[0153] Among them, the generation module 601 is used to respond to the user's query operation and generate a graph query statement based on the query operation. The graph query statement includes: traversal conditions;

[0154] The processing module 602 is used to perform conditional traversal on the pre-built knowledge graph, filter nodes and / or edges that meet the traversal conditions, and generate the target traversal result based on the nodes and / or edges.

[0155] The management module 603 is used to generate risk analysis results based on the business objects corresponding to the nodes involved in the target traversal results and / or the association relationships corresponding to the edges involved in the target traversal results.

[0156] In one possible implementation, the traversal conditions include: a starting node, a termination condition, and a first node constraint and / or a first edge constraint. The processing module 602 is further configured to, in the knowledge graph, take the starting node as the current node, update the adjacent nodes to the current node when the adjacent nodes of the current node satisfy the first node constraint and / or the first edge constraint, and end the traversal when the termination condition is met; and connect each current node in sequence to generate the target traversal path.

[0157] In one possible implementation, the termination conditions include: the updated current node is the same as the starting node, or the current node determined after traversal is the same as the adjacent node of the starting node; correspondingly, the target traversal path includes: a risk closed-loop path; the management module 603 is also used to further perform conditional traversal of the knowledge graph based on the business objects corresponding to the nodes involved in the target traversal result, to determine the associated objects of the business objects; to determine the historical transactions or subordinate relationships indicated by the association relationships corresponding to the edges involved in the target traversal result; and to generate risk analysis results based on the business objects, associated objects, and historical transactions or subordinate relationships.

[0158] In one possible implementation, the traversal conditions include: the traversal level K and the starting node. The target traversal result includes: the target traversal subgraph. The processing module 602 is also used to traverse the knowledge graph layer by layer from the starting node until the current traversal level reaches the traversal level K; obtain the nodes traversed in each layer as the associated nodes of the starting node, and record the edges between the starting node and the associated nodes, as well as the edges between the associated nodes; combine the starting node, the associated nodes, and the edges recorded during the traversal to generate the target traversal subgraph.

[0159] In one possible implementation, the management module 603 is further configured to extract the topological features of the target traversal subgraph from the target traversal subgraph; based on the topological features, perform anomaly identification on the business objects and relationships corresponding to the target traversal subgraph, and generate risk analysis results.

[0160] In one possible implementation, the target traversal result includes: traversal conditions including: second node constraints and / or second edge constraints. The processing module 602 is also used to perform point-edge queries in the knowledge graph to obtain the target node and / or target edge that satisfy the second node constraints and / or second edge constraints.

[0161] In one possible implementation, the management module 603 is further configured to determine the in-degree and out-degree of the target node based on the knowledge graph, mark the target node and generate risk analysis results when the in-degree and out-degree exceed a preset threshold; when the target edge represents historical transactions, determine the historical transactions indicated by the target edge based on the knowledge graph, mark the target edge and the nodes at both ends of the target edge and generate risk analysis results when the transaction characteristics of the historical transactions meet the abnormal characteristics.

[0162] In one possible implementation, the processing module 602 is further configured to extract multiple business objects and their relationships from multi-source risk monitoring data. These relationships include at least one of fund transfer relationships and subordinate relationships, with fund transfer relationships used to indicate historical transactions. The business objects and their relationships are then combined according to preset graph structure rules to generate a knowledge graph. This embodiment provides a device that can execute the methods provided in the above-described method embodiments. Its implementation principle and technical effects are similar, and will not be elaborated upon here.

[0163] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device 70 provided in this embodiment includes at least one processor 701 and a memory 702. Optionally, the electronic device 70 further includes a communication component 703. The processor 701, memory 702, and communication component 703 are connected via a bus.

[0164] In a specific implementation, at least one processor 701 executes computer execution instructions stored in memory 702, causing at least one processor 701 to perform the above-described method.

[0165] The specific implementation process of processor 701 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0166] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0167] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0168] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0169] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0170] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0171] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0172] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application.

[0173] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0174] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0175] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0176] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or in the form of software program modules.

[0177] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0178] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0179] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A risk management method based on knowledge graphs, characterized in that, include: In response to a user's query operation, a graph query statement is generated based on the query operation, the graph query statement including: traversal conditions; A conditional traversal is performed on the pre-constructed knowledge graph to filter nodes and / or edges that satisfy the traversal conditions, and a target traversal result is generated based on the nodes and / or edges. Based on the business objects corresponding to the nodes involved in the target traversal result, and / or the association relationships corresponding to the edges involved in the target traversal result, a risk analysis result is generated.

2. The method according to claim 1, characterized in that, The traversal conditions include: a starting node, a termination condition, and a first node constraint and / or a first edge constraint. The target traversal result includes: the target traversal path. The step of performing conditional traversal on the pre-constructed knowledge graph, filtering nodes and / or edges that satisfy the traversal conditions, and generating the target traversal result based on the nodes and / or edges includes: In the knowledge graph, the starting node is taken as the current node. When the adjacent node of the current node satisfies the first node constraint condition and / or the first edge constraint condition, the adjacent node is updated to the current node. The traversal ends when the termination condition is met. Connect each of the current nodes in sequence to generate the target traversal path.

3. The method according to claim 2, characterized in that, The termination conditions include: the updated current node is the same as the starting node, or the current node determined after traversal is the same as the adjacent node of the starting node; correspondingly, the target traversal path includes: a risk closed-loop path; generating risk analysis results based on the business objects corresponding to the nodes involved in the target traversal result, and / or the association relationships corresponding to the edges involved in the target traversal result, includes: Based on the business objects corresponding to the nodes involved in the target traversal results, the knowledge graph is further subjected to conditional traversal to determine the associated objects of the business objects; Determine the historical transactions or subordinate relationships indicated by the association relationships corresponding to the edges involved in the target traversal result; Based on the business object, related objects, and historical transactions or subordinate relationships, risk analysis results are generated.

4. The method according to claim 1, wherein the traversal conditions include: Traversing the layer number K and the starting node, the target traversal result includes: the target traversal subgraph. The step of performing conditional traversal on the pre-constructed knowledge graph, filtering nodes and / or edges that satisfy the traversal conditions, and generating the target traversal result based on the nodes and / or edges includes: Starting from the starting node, traverse the knowledge graph layer by layer outward until the current traversal level reaches the traversal level K; Obtain the nodes traversed in each layer as associated nodes of the starting node, and record the edges between the starting node and associated nodes, as well as the edges between the associated nodes; The target traversal subgraph is generated by combining the starting node, the associated nodes, and the edges recorded during the traversal.

5. The method according to claim 4, characterized in that, The step of generating risk analysis results based on the business objects corresponding to the nodes involved in the target traversal result, and / or the association relationships corresponding to the edges involved in the target traversal result, includes: Extract the topological features of the target traversal subgraph from the target traversal subgraph; Based on the topological features, the business objects and relationships corresponding to the target traversal subgraph are used for anomaly identification, and risk analysis results are generated.

6. The method according to claim 1, characterized in that, The target traversal result includes: the traversal conditions include: second node constraints and / or second edge constraints; the step of performing conditional traversal on the pre-constructed knowledge graph, filtering nodes and / or edges that satisfy the traversal conditions, and generating the target traversal result based on the nodes and / or edges includes: Perform a point-edge query on the knowledge graph to obtain the target node and / or target edge that satisfy the second node constraint and / or the second edge constraint.

7. The method according to claim 6, characterized in that, The step of generating risk analysis results based on the business objects corresponding to the nodes involved in the target traversal result, and / or the association relationships corresponding to the edges involved in the target traversal result, includes at least one of the following: Based on the knowledge graph, the in-degree and out-degree of the target node are determined. If the in-degree and out-degree exceed a preset threshold, the target node is marked, and a risk analysis result is generated. When the target edge represents historical transactions, the historical transactions indicated by the target edge are determined based on the knowledge graph. If the transaction characteristics of the historical transactions meet the abnormal characteristics, the target edge and the two end nodes of the target edge are marked, and risk analysis results are generated.

8. The method according to any one of claims 1-7, wherein before generating the graph query statement based on the query operation, the method further comprises: Multiple business objects are extracted from multi-source risk monitoring data, as well as the relationships between these business objects. These relationships include at least one of fund transfer relationships and subordinate relationships, wherein the fund transfer relationships are used to indicate historical transactions. The business objects and their relationships are combined according to preset graph structure rules to generate a knowledge graph.

9. A risk management device based on knowledge graphs, characterized in that, include: The generation module is used to respond to a user's query operation and generate a graph query statement based on the query operation. The graph query statement includes: traversal conditions. The processing module is used to perform conditional traversal on the pre-built knowledge graph, filter nodes and / or edges that satisfy the traversal conditions, and generate the target traversal result based on the nodes and / or edges. The management module is used to generate risk analysis results based on the business objects corresponding to the nodes involved in the target traversal results and / or the association relationships corresponding to the edges involved in the target traversal results.

10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images