A structured evidence graph fraud risk explanation and audit trail method

Abstract

The application discloses a structured evidence graph risk control explanation and audit trace method, obtains a risk control correlation graph, generates an index path set covering all entities and relations in the graph and having a number of repeated edges between paths less than a preset overlap threshold, and establishes an inverted index; receives a risk control search request, locates an index starting point according to the inverted index, concurrently searches in the index path set to obtain original evidence objects, counts the number of occurrences of each original evidence object in different paths and updates the confidence thereof according to the number, groups original evidence objects having confidence reaching a preset check threshold into evidence subgraphs, generates risk explanation text and risk probability according to the evidence subgraphs, fuses the confidence and the risk value to obtain a fusion score, generates a risk control research conclusion when the absolute value of the difference between the fusion score and the risk probability is less than a preset deviation threshold, and records corresponding graph paths and stores the same in association for auditing. The application realizes explainable risk control research and full-link auditable trace.

Description

Technical Field

[0001] This invention relates to the field of risk control data processing technology, and in particular to a method for interpreting structured evidence diagrams for risk control and for auditing record keeping. Background Technology

[0002] Existing risk control systems typically base their risk assessments on isolated single-point features or rules from a single data source, which suffers from the following drawbacks: First, the evidence upon which the assessment is based is scattered across different data sources and various correlation paths, lacking a cross-verification mechanism between the evidence, leading to insufficient reliability of the assessment conclusions. Second, the assessment process usually directly outputs risk or normal judgment results without outputting the evidence on which these results were derived and their correlations, resulting in poor interpretability and making it impossible for business personnel to verify the basis of the conclusions. Third, the evidence, paths, and conclusions upon which the assessment is based are not recorded in verifiable logs, making it impossible to reconstruct the assessment chain during post-audit and to detect whether the evidence or conclusions have been tampered with. Therefore, there is an urgent need for a risk control solution that can achieve cross-verification, result interpretation, and audit logs based on graph-based evidence retrieval. Summary of the Invention

[0003] This invention proposes a method for interpreting structured evidence diagrams for risk control and audit documentation, including: S1. Obtain the risk control association graph, generate an index path set that covers all entities and relationships in the risk control association graph and has fewer than a preset overlap threshold for the number of repeated edges between paths, and establish an inverted index between entities and paths. S2. Receive the risk control retrieval request, locate the index starting point according to the inverted index, and perform concurrent retrieval in the index path set from the index starting point to obtain the original evidence object containing nodes, relationships and attributes. The original evidence object is marked with its path as the source path. S3. Count the number of times each original evidence object appears in different paths and update its confidence level accordingly. Form an evidence subgraph by original evidence objects whose confidence level reaches the preset verification threshold, and generate risk explanation text and risk probability based on the evidence subgraph. S4. The confidence level and the risk value of each original evidence object in the evidence subgraph are fused and calculated according to the preset formula to obtain the fusion score. When the absolute value of the difference between the fusion score and the risk probability is less than the preset deviation threshold, a risk control judgment conclusion is generated. The index path corresponding to the evidence subgraph on which the risk control judgment conclusion is based is recorded as a graph path. The risk explanation text, the evidence subgraph and the graph path are associated and stored for auditing.

[0004] Furthermore, generating a set of index paths that covers all entities and relationships in the risk control association graph and has fewer repeated edges than a preset overlap threshold specifically includes: obtaining the graph topology connection relationship of the risk control association graph; starting from the subgraph with the highest entity risk association density in the risk control association graph, extending outward along the graph topology connection relationship to generate multiple tree-like basic index paths; and pruning the overlapping edges of the tree-like basic index paths until the number of repeated edges between paths is less than a preset overlap threshold, thereby obtaining the set of index paths.

[0005] Furthermore, after obtaining the set of index paths, the method further includes: real-time monitoring of the interaction frequency of entity nodes in the risk control association graph; when the interaction frequency of a specific entity node exceeds a preset high-frequency threshold, dynamically adjusting the path weight of the index path passing through the specific entity node, and reconstructing the local path passing through the specific entity node to obtain an updated set of index paths.

[0006] Furthermore, the concurrent retrieval from the index starting point in the index path set specifically includes: simultaneously initiating forward traversal and reverse backtracking in the index path set based on the index starting point; assigning node risk weights to each node in the index path set, and dynamically adjusting the upper limit of the retrieval hop count based on the node risk weights; and using the nodes and edges extracted by forward traversal and reverse backtracking that satisfy the upper limit of the retrieval hop count as the original evidence object.

[0007] Furthermore, the step of counting the number of times each original evidence object appears in different paths and updating its confidence level accordingly specifically includes: extracting the main features, timestamps, and business transaction records of each original evidence object in different paths; when there are contradictions in the main features, timestamps, or business transaction records of original evidence objects in different paths, reducing the confidence level of the corresponding original evidence object; and increasing the confidence level of the corresponding original evidence object when the original evidence objects in different paths support each other.

[0008] Furthermore, the step of forming an evidence subgraph from the original evidence objects whose confidence level reaches the preset verification threshold specifically includes: forming the evidence subgraph from the nodes and edges corresponding to the original evidence objects whose confidence level reaches the preset verification threshold, together with the source paths marked on each original evidence object.

[0009] Furthermore, the step of generating risk explanation text and risk probability based on the evidence subgraph specifically includes: each conclusive statement in the generated risk explanation text is associated with a corresponding node or edge in the evidence subgraph as a basis; and the risk probability is obtained by statistically analyzing the confidence level and risk value of each original evidence object in the evidence subgraph.

[0010] Furthermore, the step of recording the index path corresponding to the evidence subgraph on which the risk control judgment conclusion is based as a graph path specifically includes: starting from the node where the risk evidence is located in the evidence subgraph, expanding hop by hop along the corresponding index path, verifying whether the adjacent node provides new risk evidence at each hop, and stopping the expansion if no new risk evidence is provided; extracting nodes and edges in reverse along the expanded path to generate an initial source tracing subgraph; performing loop elimination and redundant node pruning on the initial source tracing subgraph, and recording the path obtained after pruning as the graph path.

[0011] Furthermore, after recording the graph path, the method further includes: obtaining the flow status of each node on the graph path; assigning negative correlation decay weights to the confidence of each node along the graph path according to the number of hops; extracting core fraud gang nodes and evasion source nodes based on the flow status and decayed confidence, and marking the above nodes with visual features in the risk control association graph to generate a visual tracing graph.

[0012] Furthermore, the step of storing the risk explanation text, the evidence subgraph, and the graph path together for auditing specifically includes: calculating the hash fingerprint of each object in the order in which the risk explanation text, the evidence subgraph, and the graph path are generated; concatenating the hash fingerprint of the next object with the hash fingerprint of the previous object and using them together in the calculation to form a chained hash evidence, so that any stored object can be verified by chain afterward to see if it has been tampered with.

[0013] This invention provides a structured evidence graph-based risk control interpretation and audit trail method. It achieves full graph coverage and low-redundancy evidence retrieval through index path sets and inverted indexes, significantly reducing the computational load of online retrieval. Through multi-path cross-validation, it dynamically updates confidence levels, automatically suppressing conflicting evidence and strengthening corroborating evidence, thus improving the reliability of the judgment. It generates traceable risk interpretation texts through an evidence subgraph-driven interpretation model, and ensures the credibility of the conclusions through dual-track consistency verification of fused scores and risk probabilities. Finally, it achieves complete, verifiable, and non-repudiable audit trails through graph path records and chained hash evidence storage. Attached Figure Description

[0014] Figure 1 This is a flowchart illustrating a battery swapping service scheduling method proposed in this invention. Detailed Implementation

[0015] refer to Figure 1 This invention provides a method for interpreting structured evidence diagrams for risk control and for auditing record keeping, specifically including: S1. Obtain the risk control association graph, generate an index path set that covers all entities and relationships in the risk control association graph and has fewer than a preset overlap threshold for the number of repeated edges between paths, and establish an inverted index between entities and paths.

[0016] The risk control association graph can be a graph data structure containing nodes such as gantry transactions, OBU devices, and vehicle features, used to represent the association between ETC entities of trucks. For example, the nodes include gantry transaction flow nodes, vehicle feature recognition nodes, and OBU device transaction nodes. The graph can also be attached with semantic tags that reflect the business attributes of ETC risk control, such as the abnormally low toll rate minimum toll path tag corresponding to the toll billing chain block dimension, the tag corresponding to the vehicle license plate clone suspicion block dimension with inconsistent license plate color and mismatched vehicle type and axle number, and the tag corresponding to the OBU device shared block dimension with the abnormal displacement of high-frequency cross-vehicle binding of the same OBU. Each semantic tag establishes a mapping relationship with the corresponding type of entity node.

[0017] Specifically, generating the index path set and building an inverted index includes: obtaining the graph topology connection relationship and semantic label information of the risk control association graph; identifying the high-cohesion risk control semantic subgraph in the graph based on the semantic labels; starting from the high-cohesion risk control semantic subgraph, extending outward along the graph topology connection relationship to generate multiple tree-like basic index paths; pruning overlapping edges of the tree-like basic index paths so that the number of repeated edges of the tree-like basic index paths is less than a preset overlap threshold, for example, pruning to a repeated edge ratio of less than 10%, to obtain the index path set; and extracting boundary entities from the index path set to build an inverted index.

[0018] The inverted index is a data lookup structure that uses entity nodes as keys and index path identifiers containing that entity as values. Its function is to locate the starting point of the index during the online phase. After the location is completed, concurrent retrieval is performed on multiple paths in the index path set.

[0019] Furthermore, after obtaining the set of index paths, the process also includes: real-time monitoring of the interaction frequency of entity nodes in the risk control association graph; when the interaction frequency of a specific entity node exceeds a preset high-frequency threshold, dynamically adjusting the path weight of the index path passing through the specific entity node, and reconstructing the local paths passing through the specific entity node to obtain an updated set of index paths. For example, when the interaction frequency of a certain OBU device exceeds the preset high-frequency threshold of 100 times within 24 hours, an event-driven mechanism is triggered to increase the weight of the path where the OBU is located and reconstruct and merge the surrounding local paths.

[0020] Because the index path set segments the graph and the proportion of repeated edges is constrained by a preset overlap threshold, and the inverted index marks the entry point of each path with boundary entities, online retrieval can directly hit the associated path without performing a traversal scan of the entire graph, thus significantly reducing the computational load of online retrieval. This is the effect brought about by the synergy between index construction and inverted index.

[0021] S2. Receive the risk control retrieval request, locate the index starting point according to the inverted index, and perform concurrent retrieval from the index starting point in the index path set to obtain the original evidence object containing nodes, relationships and attributes. The original evidence object is labeled with its path as the source path.

[0022] Among them, the risk control retrieval request can be issued by the high-speed ETC clearing and settlement system to query the passage risk status of a specific truck. For example, when requesting to query the risk status of a truck with a certain license plate, the license plate node is located in the inverted index as the starting point of the index.

[0023] Specifically, concurrent retrieval from the index starting point in the index path set includes: starting forward traversal and backward backtracking simultaneously from the index starting point, for example, forward retrieval of the truck's subsequent travel path and backward backtracking of its preceding travel path; assigning node risk weights to each node in the index path set, dynamically adjusting the upper limit of the retrieval hop count based on the node risk weights, and using the nodes and edges extracted by forward traversal and backward backtracking that meet the upper limit of the retrieval hop count as the original evidence objects.

[0024] The node risk weight ranges from 0 to 1 and is calculated by weighting the node's historical toll evasion records, device malfunction rate, and associated gang density. The upper limit of the search hop count is dynamically adjusted based on the node risk weight using a mapping function; the higher the node risk weight, the larger the corresponding upper limit of the search hop count. For example, with a basic search hop count of 3 hops, a core suspect vehicle with 5 historical toll evasion records and a device malfunction rate of 0.8, has a node risk weight of 0.9, increasing the upper limit of the search hop count to 5 hops; a regular vehicle with 0 historical toll evasion records and a device malfunction rate of 0.1 has a node risk weight of 0.1, limiting the upper limit of the search hop count to 2 hops; and a high-frequency OBU node with 2 historical toll evasion records and a device malfunction rate of 0.6 has a node risk weight of 0.7, limiting the upper limit of the search hop count to 4 hops.

[0025] Because forward traversal and backward backtracking simultaneously extract nodes and edges, the effective evidence coverage within the same time window is expanded to twice that of unidirectional retrieval, thereby improving the recall rate of the original evidence objects.

[0026] S3. Count the number of times each original evidence object appears in different paths and update its confidence level accordingly. Form an evidence subgraph by combining the original evidence objects whose confidence level reaches the preset verification threshold, and generate risk explanation text and risk probability based on the evidence subgraph.

[0027] Specifically, the confidence level of each original evidence object is updated based on the number of times it appears in different paths. This includes: extracting the subject characteristics, timestamps, and business transaction records of each original evidence object in different paths; performing subject consistency verification based on subject characteristics; performing spatiotemporal consistency verification based on timestamps; and performing business rule consistency verification based on business transaction records. When original evidence objects in different paths contradict each other in subject consistency verification, spatiotemporal consistency verification, or business rule consistency verification, the confidence level of the corresponding original evidence object is reduced. When original evidence objects in different paths support each other, the confidence level of the corresponding original evidence object is increased. For example, the confidence level of the low-fee passage evidence object from path A increases from 0.75 to 0.90 after being verified by the business rule verification dimension; the confidence level of the OBU cross-province record evidence object from path B decreases from 0.80 to 0.20 after being conflicted by the spatiotemporal consistency verification dimension; and the confidence level of the license plate cloning feature evidence object from path C increases from 0.65 to 0.85 after being verified by the subject consistency verification dimension.

[0028] The preset verification threshold is, for example, 0.7. The nodes and edges corresponding to the original evidence objects whose confidence reaches the preset verification threshold, together with the source paths marked on each original evidence object, are used to form an evidence subgraph. This evidence subgraph is a directed graph data structure with a confidence attribute.

[0029] Specifically, the risk explanation text and risk probability are generated based on the evidence subgraph, including: inputting the evidence subgraph into an explanation model built based on natural language processing technology; mapping the graph structure data into natural language text and quantified risk prediction values; each conclusive statement in the risk explanation text generated by the model is associated with a corresponding node or edge in the evidence subgraph as a basis; and obtaining the risk probability based on the confidence level and risk value of each original evidence object in the evidence subgraph. For example, the model outputs the risk explanation text: After cross-validation of search path A and path B, a certain OBU device appears simultaneously at the provincial boundary gantry A and gantry B at time T, which is inaccessible in time and space, violating the card-switching toll evasion rule, and is judged as high risk, with a risk probability of 0.92 output.

[0030] Because the interpretation model can only perform mapping calculations based on the node and edge relationships existing in the evidence subgraph, the model cannot generate subjects, relationships, or conclusions that do not exist in the evidence subgraph, thereby reducing the risk of illusions and factual fabrications in the interpretation text. This is the synergistic effect of the constraint of the evidence subgraph on the interpretation generation process. At the same time, because the confidence of conflicting evidence is automatically suppressed while the confidence of corroborating evidence is automatically strengthened, the evidence objects retained in the evidence subgraph have higher judgment reliability.

[0031] S4. The confidence level and the risk value of each original evidence object in the evidence subgraph are fused and calculated according to the preset formula to obtain the fusion score. When the absolute value of the difference between the fusion score and the risk probability is less than the preset deviation threshold, a risk control judgment conclusion is generated. The index path corresponding to the evidence subgraph on which the risk control judgment conclusion is based is recorded as a graph path. The risk explanation text, the evidence subgraph and the graph path are associated and stored for auditing.

[0032] The calculation of confidence level and risk value of each original evidence object is performed according to a preset formula, including: according to the formula Calculate the global risk fusion score, where For the first The risk value of an evidence object, that is, the initial risk value it carries or is calculated through local features. For the first The confidence level of each piece of evidence is dynamically adjusted. For the first Preset decision weights for each piece of evidence.

[0033] Specifically, for example, if the risk values ​​of the three evidence objects are 0.9, 0.8, and 0.7 respectively, the dynamically adjusted confidence levels are 0.95, 0.9, and 0.85 respectively, and the preset decision weights are 0.4, 0.4, and 0.2 respectively, then the fusion score is 0.9×0.95×0.4+0.8×0.9×0.4+0.7×0.85×0.2=0.342+0.288+0.119=0.749; if the risk probability is 0.76, then the absolute value of the difference between the fusion score and the risk probability is 0.011, which is less than the preset deviation threshold of 0.1, and a risk control judgment conclusion is generated at this time; furthermore, when the fusion score is greater than the preset risk threshold of 0.7, a judgment conclusion that there is a risk of card fraud and fee evasion is generated.

[0034] Because the fusion score is calculated independently using mathematical formulas and the risk probability is output independently by the interpretation model, the two obtain the same risk judgment result based on different technical paths. This allows the dual-track comparison to cross-verify the consistency of decisions, thereby triggering a review mechanism to ensure the reliability of the conclusions when the difference exceeds the limit.

[0035] Specifically, the index path corresponding to the evidence subgraph on which the risk control judgment is based is recorded as the graph path. This includes: starting from the node containing the risk evidence in the evidence subgraph, expanding hop by hop along the corresponding index path, verifying at each hop whether the adjacent node provides new risk evidence, and stopping the expansion if no new evidence is provided; extracting nodes and edges in reverse along the expanded path to generate an initial source subgraph, performing loop elimination and redundant node pruning on the initial source subgraph, and recording the resulting path as the graph path. For example, starting from the gantry transaction node and expanding hop by hop, the first hop discovers new evidence of OBU swapping, the second hop discovers new evidence of license plate fraud, and the third hop does not produce new evidence, triggering the stop condition. The system then extracts and generates the initial source subgraph in reverse, and after loop elimination and redundant node pruning, obtains the graph path Node01 to Node02 to Node03.

[0036] Because the graph path is generated along the corresponding path in the index path set, the index path set is not only used for online retrieval and cross-validation, but is also continuously reused in the tracing stage. This forms a collaborative closed loop between the offline index infrastructure and the online assessment process, enabling the decision-making basis to form a complete evidence chain and achieving traceability of risk assessment.

[0037] Furthermore, after recording the graph path, the process also includes: obtaining the flow status of each node on the graph path, for example, Node01 is a gantry transaction type node with the flow status of initiating abnormal passage, Node02 is an OBU device transaction type node with the flow status of card swapping device exchange, and Node03 is a truck vehicle characteristic type node with the flow status of core toll evasion source; and assigning negative correlation decay weights to the confidence of each node along the graph path according to the number of hops, for example, using an exponential decay model. or reciprocal decay model ,in Based on confidence level, For the number of jumps, The attenuation coefficient is used as the basis for determining the attenuation confidence level. Based on the circulation status and the attenuation confidence level, the core fraud gang nodes and the source nodes of fee evasion are extracted. The nodes are then visually marked in the risk control association graph to generate a visual traceability graph. For example, the node corresponding to Node03 is extracted as the core source node of fee evasion.

[0038] Specifically, the risk interpretation text, evidence subgraphs, and graph paths are stored together for auditing purposes. This includes: calculating the hash fingerprints of each object in the order in which the risk interpretation text, evidence subgraphs, and graph paths are generated; and chaining the hash fingerprints of the next object with the hash fingerprints of the previous object to participate in the calculation, forming a chained hash evidence storage.

[0039] Because chained hash fingerprints are generated for the three types of objects—risk explanation text, evidence subgraphs, and graph paths—any subsequent tampering will cause the hash verification to fail, thus achieving non-repudiable audit traceability across the entire risk control decision-making process.

[0040] In one specific implementation, this embodiment also provides a structured evidence graph risk control interpretation and auditing system, including a graph indexing module, an evidence retrieval module, an evidence verification module, and a fusion analysis module. The graph indexing module is used to execute the steps described in S1 of claim 1, the evidence retrieval module is used to execute the steps described in S2 of claim 1, the evidence verification module is used to execute the steps described in S3 of claim 1, and the fusion analysis module is used to execute the steps described in S4 of claim 1. Because the modules are sequentially connected in series according to the data flow to form a closed loop, the output of the preceding module becomes the input of the subsequent module, resulting in the automatic flow of the entire chain from the risk control retrieval request to the final generation of chained hash evidence storage within the system.

[0041] In one specific embodiment, this embodiment also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described structured evidence graph risk control interpretation and audit recording method.

[0042] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for interpreting structured evidence diagrams for risk control and audit documentation, characterized in that, include: S1. Obtain the risk control association graph, generate an index path set that covers all entities and relationships in the risk control association graph and has fewer than a preset overlap threshold for the number of repeated edges between paths, and establish an inverted index between entities and paths. S2. Receive the risk control retrieval request, locate the index starting point according to the inverted index, and perform concurrent retrieval in the index path set from the index starting point to obtain the original evidence object containing nodes, relationships and attributes. The original evidence object is marked with its path as the source path. S3. Count the number of times each original evidence object appears in different paths and update its confidence level accordingly. Form an evidence subgraph by original evidence objects whose confidence level reaches the preset verification threshold, and generate risk explanation text and risk probability based on the evidence subgraph. S4. The confidence level and the risk value of each original evidence object in the evidence subgraph are fused and calculated according to the preset formula to obtain the fusion score. When the absolute value of the difference between the fusion score and the risk probability is less than the preset deviation threshold, a risk control judgment conclusion is generated. The index path corresponding to the evidence subgraph on which the risk control judgment conclusion is based is recorded as a graph path. The risk explanation text, the evidence subgraph and the graph path are associated and stored for auditing.

2. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 1, characterized in that, The step of generating an index path set that covers all entities and relationships in the risk control association graph and has fewer repeated edges between paths than a preset overlap threshold specifically includes: obtaining the graph topology connection relationship of the risk control association graph; starting from the subgraph with the highest entity risk association density in the risk control association graph, extending outward along the graph topology connection relationship to generate multiple tree-like basic index paths; and pruning the overlapping edges of the tree-like basic index paths until the number of repeated edges between paths is less than a preset overlap threshold, thereby obtaining the index path set.

3. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 2, characterized in that, After obtaining the set of index paths, the method further includes: real-time monitoring of the interaction frequency of entity nodes in the risk control association graph; when the interaction frequency of a specific entity node exceeds a preset high-frequency threshold, dynamically adjusting the path weight of the index path passing through the specific entity node, and reconstructing the local path passing through the specific entity node to obtain an updated set of index paths.

4. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 1, characterized in that, The concurrent retrieval from the index starting point in the index path set specifically includes: starting forward traversal and reverse backtracking simultaneously in the index path set based on the index starting point; assigning node risk weights to each node in the index path set, and dynamically adjusting the upper limit of the retrieval hop count based on the node risk weights; and using the nodes and edges extracted by forward traversal and reverse backtracking that satisfy the upper limit of the retrieval hop count as the original evidence object.

5. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 1, characterized in that, The method of counting the occurrences of each original evidence object in different paths and updating its confidence level accordingly includes: extracting the main features, timestamps, and business transaction records of each original evidence object in different paths; reducing the confidence level of the corresponding original evidence object when there are contradictions in the main features, timestamps, or business transaction records of the original evidence objects in different paths; and increasing the confidence level of the corresponding original evidence object when the original evidence objects in different paths support each other.

6. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 1, characterized in that, The step of forming an evidence subgraph from original evidence objects whose confidence level reaches a preset verification threshold specifically includes: forming the evidence subgraph from the nodes and edges corresponding to the original evidence objects whose confidence level reaches the preset verification threshold, together with the source paths marked on each original evidence object.

7. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 1, characterized in that, The step of generating risk explanation text and risk probability based on the evidence subgraph specifically includes: each conclusive statement in the generated risk explanation text is associated with a corresponding node or edge in the evidence subgraph as a basis; and the risk probability is obtained by statistically analyzing the confidence level and risk value of each original evidence object in the evidence subgraph.

8. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 1, characterized in that, The step of recording the index path corresponding to the evidence subgraph on which the risk control judgment conclusion is based as a graph path specifically includes: starting from the node where the risk evidence is located in the evidence subgraph, expanding hop by hop along the corresponding index path, verifying whether the adjacent node provides new risk evidence at each hop, and stopping the expansion if no new risk evidence is provided; extracting nodes and edges in reverse along the expanded path to generate an initial source tracing subgraph; performing loop elimination and redundant node pruning on the initial source tracing subgraph, and recording the path obtained after pruning as the graph path.

9. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 8, characterized in that, After recording the graph path, the method further includes: obtaining the flow status of each node on the graph path; assigning negative correlation decay weights to the confidence of each node according to the number of hops along the graph path; extracting core fraud gang nodes and evasion source nodes based on the flow status and decayed confidence, and marking the above nodes with visual features in the risk control association graph to generate a visual tracing graph.

10. The structured evidence diagram risk control interpretation and audit record keeping method according to claim 1, characterized in that, The step of storing the risk explanation text, the evidence subgraph, and the graph path together for auditing specifically includes: calculating the hash fingerprint of each object in the order in which the risk explanation text, the evidence subgraph, and the graph path are generated; concatenating the hash fingerprint of the next object with the hash fingerprint of the previous object and using them together in the calculation to form a chained hash evidence, so that any stored object can be verified by chain afterward to see if it has been tampered with.

Images