An abnormal business risk identification method, device, medium and product

Abstract

The application discloses an abnormal business risk identification method and device, medium and product, and is applied to the field of financial technology and artificial intelligence. The method comprises the following steps: acquiring a business knowledge graph; determining a target business node in the business knowledge graph through global retrieval, and determining relevant business nodes corresponding to the target business node through local retrieval; generating a time sequence business chain based on the relevant business nodes, and determining a risk result of the time sequence business chain through a large language model. By constructing the business knowledge graph, multi-source fragmented risk data can be integrated, and various entities and multi-layer association relationships can be uniformly carried. By locking a high-risk community through global retrieval, positioning the target business node, and extracting the surrounding relevant business nodes through local retrieval, the retrieval breadth and detail accuracy can be considered. By analyzing the link through the large language model and outputting the quantitative risk result, the risk attribution classification is automatically completed, the artificial research and judgment workload is reduced, and the risk identification accuracy and result interpretability are improved.

Description

Technical Field

[0001] This invention relates to the fields of financial technology and artificial intelligence, and in particular to a method, device, medium and product for identifying abnormal business risks. Background Technology

[0002] With the rapid iteration of mobile internet, distributed architecture, and digital financial services, fintech has significantly lowered the barriers to online services and improved user experience. However, it has also given rise to a cybercrime industry characterized by rapid technological iteration and complex organizational structures. As a result, financial risk control and cybersecurity scenarios face enormous challenges.

[0003] Currently, mainstream risk control identification methods in the industry fall into two categories. One is a single-point detection method that relies on expert rules and traditional machine learning models, which can only identify shallow anomalies based on isolated entity features such as a single account or a single transaction. The other is a simple static knowledge graph mining technique, which only completes community division through basic clustering and connectivity analysis, and uses ordinary vector retrieval to retrieve text information for risk assessment.

[0004] Existing single-point risk control models and static graph retrieval technologies lack global graph penetration analysis capabilities, failing to identify cross-event and cross-platform group collaborations, resulting in severe underreporting. Basic graphs can only perform static network analysis, lacking temporal causal reasoning capabilities, making it difficult to automatically reconstruct complete illegal industry behavior paths and clearly explain risk transmission logic. Risk control personnel need to manually check logs and trace fund flows across systems, which not only affects the accuracy of judgments due to human experience but also lags far behind the second-by-second transfer speed of funds in illegal industries, leading to serious delays in risk handling. Summary of the Invention

[0005] This invention provides a method, device, medium, and product for identifying abnormal business risks, in order to solve the technical problems in traditional financial risk control such as the inability to identify deep cross-event correlations, the lack of interpretable logic in risk reasoning, and the inefficiency and lag of manual judgment.

[0006] According to one aspect of the present invention, a method for identifying abnormal business risks is provided, the method comprising: Obtain the business knowledge graph; The target business node in the business knowledge graph is determined by global retrieval, and the related business nodes corresponding to the target business node are determined by local retrieval. A time-series business chain is generated based on relevant business nodes, and the risk outcome of the time-series business chain is determined through a large language model.

[0007] Optionally, the business knowledge graph is acquired, including: acquiring business data, extracting entities from the business data according to target dimensions to obtain each entity, wherein the target dimensions include behavioral actions, risk processes, risk media and environmental characteristics, and the business data includes text risk sample data, user behavior time series data, network event record data and pre-risk control alarm annotations; identifying the relationships between each entity, wherein the relationships include temporal relationships, binding relationships, semantic relationships and causal backward relationships; and constructing a business knowledge graph with each entity as a node and each relationship as an edge.

[0008] The advantages of this setup are: multi-dimensional entity extraction can fully extract various risk objects; multiple relationships can accurately restore the logical and temporal connections between entities; and building a business knowledge graph can provide a standardized graph structure for subsequent hierarchical retrieval and link reasoning.

[0009] Optionally, before determining the target business node in the business knowledge graph through global retrieval, the method further includes: calling a preset community discovery algorithm to perform network clustering calculation on the business knowledge graph, using the association relationship between entities as the clustering weight, and aggregating to generate each graph sub-network; dividing each graph sub-network into each business community, wherein the business community includes a time-series process community, an organizational structure community, an event link community, a business behavior community, and a risk path community.

[0010] The advantages of this setup are: it enables accurate clustering of the graph by relying on entity association weights, breaks down the graph into multiple targeted business communities, narrows the scope of subsequent searches, and reduces the computational overhead of global searches.

[0011] Optionally, the target business node in the business knowledge graph is determined through global retrieval, including: generating a global retrieval through graph retrieval enhancement to traverse each business community, calculating the first similarity between each business community and the preset risk sample, and taking the business community with the first similarity greater than the first preset similarity threshold as the target risk community; and determining the node in the target risk community that carries the pre-preset risk control alarm label as the target business node.

[0012] The advantages of this setup are: leveraging graph retrieval to enhance generation and achieve batch matching at the community level; using similarity thresholds to accurately filter low-risk communities and narrow the search scope; and relying on pre-positioned risk control annotations to quickly identify suspicious baseline nodes, reducing invalid node traversal and improving the efficiency and accuracy of target business node location.

[0013] Optionally, relevant business nodes corresponding to the target business node are determined through local retrieval, including: performing graph retrieval enhancement to generate local retrieval centered on the target business node, obtaining each neighboring node of the target business node; calculating the second similarity between each neighboring node and the target business node, and taking the neighboring nodes with the second similarity greater than the second preset similarity threshold as relevant business nodes.

[0014] The advantages of this setup are: it allows for precise capture of surrounding related entities through local graph retrieval around the target node, filtering out irrelevant neighboring nodes through similarity thresholds, accurately selecting highly relevant clues, compressing the amount of data for subsequent link deduction, and improving the accuracy and retrieval efficiency of relevant business node selection.

[0015] Optionally, a time-series business chain is generated based on relevant business nodes, including: calculating the information gain rate of each relevant business node, and taking the relevant business node with the largest information gain rate as the starting node for inference; selecting relevant business nodes in sequence based on the information gain rate to extend the link of the starting node for inference; stopping the extension when the link forms a closed loop or the information gain rate is less than a preset gain threshold, generating candidate business chains, and pruning and aggregating each candidate business chain to obtain the time-series business chain.

[0016] The advantages of this setup are: selecting the starting node with the strongest discriminative power based on the information gain rate and choosing the best path to extend, avoiding the inference of invalid edge nodes, timely truncation of worthless links based on termination conditions, and simplifying redundant paths through pruning and aggregation, thereby reducing the computational load of link inference.

[0017] Optionally, the risk outcome of the time-series business chain is determined by a large language model, including: generating a first prompt word based on the time-series business chain, performing risk calculation based on the first prompt word using a large language model to obtain a risk score; determining a target interval corresponding to the risk score from a preset score interval, and determining the risk outcome based on the target interval, wherein the risk outcome is low risk, medium risk, or high risk.

[0018] The advantages of this setup are: it automatically completes quantitative risk scoring by parsing the semantics of the graph links through a large language model, achieves unified classification judgment by relying on standardized scoring intervals, outputs standardized risk conclusions with interpretability, reduces the bias of human subjective judgment, and provides a clear classification basis for risk control and disposal.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform an abnormal business risk identification method according to any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer storage medium is provided, the computer storage medium storing computer instructions, the computer instructions being used to cause a processor to execute and implement an abnormal business risk identification method as described in any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements an abnormal business risk identification method according to any embodiment of the present invention.

[0022] The technical solution of this invention integrates fragmented risk data from multiple sources by constructing a business knowledge graph, uniformly carrying various entities and multi-layered relationships. Through global retrieval, high-risk communities are identified and target business nodes are located; through local retrieval, surrounding related nodes are extracted, balancing retrieval breadth and detail accuracy to comprehensively uncover hidden group association clues. A large language model parses the links and outputs quantitative risk results, automatically completing risk attribution and classification, reducing the workload of manual judgment, and improving the accuracy of risk identification and the interpretability of results.

[0023] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of an abnormal business risk identification method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of another abnormal business risk identification method provided in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of an abnormal business risk identification device provided in Embodiment 3 of the present invention; Figure 4This is a schematic diagram of the structure of an electronic device that implements an abnormal business risk identification method according to an embodiment of the present invention. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] Example 1 Figure 1 This is a flowchart illustrating an abnormal business risk identification method provided in Embodiment 1 of the present invention. This embodiment is applicable to abnormal business risk identification scenarios. The method can be executed by an abnormal business risk identification device, which can be implemented in hardware and / or software and can be configured in a computer controller. Figure 1 As shown, the method includes: S110, Obtain the business knowledge graph.

[0029] Among them, business knowledge graph refers to a structured knowledge network built by integrating multi-source heterogeneous business data, including entities and the relationships between entities.

[0030] Optionally, the business knowledge graph is acquired, including: acquiring business data, extracting entities from the business data according to target dimensions to obtain each entity, wherein the target dimensions include behavioral actions, risk processes, risk media and environmental characteristics, and the business data includes text risk sample data, user behavior time series data, network event record data and pre-risk control alarm annotations; identifying the relationships between each entity, wherein the relationships include temporal relationships, binding relationships, semantic relationships and causal backward relationships; and constructing a business knowledge graph with each entity as a node and each relationship as an edge.

[0031] The business data specifically includes four categories: First, text risk sample data, such as unstructured text data like files of past confirmed fraud cases, dictionaries of typical fraudulent scripts, and examples of misleading texts on social media platforms. Second, user behavior time-series data, which records user operation trajectories on the application or web page. All data undergoes strict anonymization and desensitization processing before integration, such as hashing and encrypting users' real names and mobile phone numbers to comply with data privacy protection requirements. Third, network event log data, which records underlying network communication events obtained from legitimate and compliant sources, such as change logs and proxy node access records. Fourth, pre-emptive risk control alarm labels, which incorporate alarm tags output by existing traditional rule engines or basic risk control models, providing preliminary risk guidance for subsequent analysis.

[0032] Specifically, the target dimension refers to the key business perspective used when extracting entities from business data. This includes: behavioral actions, which identify key action nodes within the user lifecycle, such as registration, login, joining groups, transferring money, and switching devices; risk processes, which use semantic understanding to map text fragments to a standard fraud lifecycle model, extracting key stage features such as "phishing," "luring," and "fraudulent orders"; risk media, which refers to the unique resource "materials" used in illegal activities, such as extracting specific patterns of fraudulent scripts, cross-platform advertising redirection links, and malicious website nodes with concealed characteristics; and environmental features, which extract anonymized device fingerprints, traffic channel identifiers, and application installation package features. Entity extraction can utilize fine-tuned large language models or specially trained named entity recognition technology to extract entity features under the target dimension from the aforementioned fragmented event fragments. Then, the relationships between entities are identified. These relationships are crucial for connecting different entities and constructing a graph network. Specifically, they include: temporal relationships, such as "behavior → occurs → time node," anchoring discrete actions on an absolute timeline for easier analysis of time differences and concurrency; binding relationships, such as "device → associated → account," used to identify anomalous clustering risks like "one device, multiple numbers" or "one number, multiple devices"; semantic relationships, such as "text → matching → unique fraud pattern," normalizing and mapping mutated chat content to the underlying fraud knowledge base; and causal backward relationships, such as "step A → leads to → step B," forming directed edges along the time sequence, providing topological support for reconstructing the fraud loop. Identifying relationships between entities typically employs techniques such as dependency parsing and graph neural network embedding. Finally, all extracted entities are treated as independent nodes in the graph, and the identified relationships between entities are used as edges connecting these nodes, persisted to the graph database, thus forming a business knowledge graph.

[0033] S120. Determine the target business node in the business knowledge graph through global retrieval, and determine the related business nodes corresponding to the target business node through local retrieval.

[0034] Global retrieval is a mechanism for macro-level searching within a business knowledge graph, designed to match high-risk communities associated with known risk characteristics. For example, in the identification of illegal industries, global retrieval can recall high-risk communities related to fraudulent processes, organizational structures, and high-risk paths, helping to locate potential risk areas from a holistic perspective. Target business nodes refer to core entity nodes initially identified as potentially risky in the business knowledge graph, such as a suspected controlled account, abnormal device, or specific fraudulent step. Local retrieval refers to a mechanism that, based on the topological position of the target business node in the graph, retrieves highly relevant entities from its surrounding neighboring nodes. By calculating the cross-entropy and similarity between entities, entities closely associated with the target node can be selected to construct a local risk association network. Related business nodes refer to entity nodes obtained through local retrieval that are directly or indirectly related to the target business node.

[0035] Optionally, before determining the target business node in the business knowledge graph through global retrieval, the method further includes: calling a preset community discovery algorithm to perform network clustering calculation on the business knowledge graph, using the association relationship between entities as the clustering weight, and aggregating to generate each graph sub-network; dividing each graph sub-network into each business community, wherein the business community includes a time-series process community, an organizational structure community, an event link community, a business behavior community, and a risk path community.

[0036] Community detection algorithms, such as random walk algorithms, identify tightly connected groups of nodes in a graph and optimize metrics like modularity to divide nodes into subnetworks with tightly connected internal connections and sparse external connections. During clustering, the strength of relationships between entities affects the clustering results; more tightly connected entities are more likely to be aggregated into the same subnetwork, thus generating various graph subnetworks. Business communities are subnetworks with specific semantic themes, specifically including five types: temporal process communities, which are subnetworks formed according to the chronological development of events, clearly presenting the sequence of business events; organizational structure communities, which are anonymized group architecture graphs formed by strong associations such as shared equipment, same network segment, and shared funding pools, used to identify the group structure of illegal industries; event link communities, which capture the propagation path of events using specific methods, accurately locating the propagation link of similar crimes; and business behavior communities, which are subnetworks that aggregate groups of accounts with similar profiles or collaborative operations, used to analyze abnormal account group behavior. Risk path communities are pre-calculated and cached high-frequency connected subgraphs of historical property rights fraud cases, enabling rapid association with known fraud risk patterns. Through clustering calculations, the massive and complex full graph can be segmented into structured thematic communities, which not only accelerates subsequent retrieval speed but also provides a more focused context for large-scale model analysis, improving the accuracy of risk identification.

[0037] Optionally, the target business node in the business knowledge graph is determined through global retrieval, including: generating a global retrieval through graph retrieval enhancement to traverse each business community, calculating the first similarity between each business community and the preset risk sample, and taking the business community with the first similarity greater than the first preset similarity threshold as the target risk community; and determining the node in the target risk community that carries the pre-preset risk control alarm label as the target business node.

[0038] Graph retrieval augmented generation is a technique that combines graph-structured data retrieval with generative models, enabling more precise information retrieval by leveraging the topological relationships and node attributes of graphs. Business communities are sub-networks with specific semantic themes formed by segmenting and clustering knowledge graphs using community discovery algorithms. The first similarity score is an indicator used to measure the similarity between a business community and a preset risk sample. The first preset similarity threshold is a manually set similarity cutoff value used to screen target risk communities.

[0039] Specifically, firstly, graph retrieval enhancement generation technology is used for global search, which traverses all business communities in the business knowledge graph. During the traversal, the first similarity between each business community and the preset risk sample is calculated. When calculating the similarity, the frequency of each entity in all triples in the knowledge graph as subject and object is counted first. After smoothing, the cross-entropy between entities is calculated, and then the similarity score is obtained through symmetry transformation and similarity conversion. The smoothing process is shown in the following formula (1): (1) in, Represents an entity, Indicates a relationship. Indicates in entity Under the condition, the relationship The conditional probability. Representing entities When used as a subject or object, it relates to the concept of connection. The frequency of occurrence of related triples. i is the count variable, and n represents the total number of all different relation types involved in entity e. The cross-entropy between entities is calculated using the following formula (2): (2) in, and They represent two entities respectively. Indicates in the known entity Under these conditions, entity The conditional information entropy. Representing entities With Relationship The conditional probability. The symmetry measure is shown in the following formula (3): (3) in, Representing entities With entity Symmetric measure, and Entities right , right The conditional information entropy. The similarity score is calculated using the following formula (4): (4) in, Representing entities With entity Similarity score, This represents a symmetry measure between entity A and entity B. Then, business communities with a first similarity score greater than a first preset similarity threshold are selected as target risk communities. Next, nodes within the target risk communities that carry pre-emptive risk control alarm labels are identified as target business nodes.

[0040] Optionally, relevant business nodes corresponding to the target business node are determined through local retrieval, including: performing graph retrieval enhancement to generate local retrieval centered on the target business node, obtaining each neighboring node of the target business node; calculating the second similarity between each neighboring node and the target business node, and taking the neighboring nodes with the second similarity greater than the second preset similarity threshold as relevant business nodes.

[0041] Among them, neighboring nodes refer to nodes directly connected to the target business node in the graph, such as devices and operational behaviors associated with the target account. The second similarity is an indicator used to measure the degree of association between neighboring nodes and the target business node. The second preset similarity threshold is a judgment standard pre-set based on business needs and historical data, used to filter out neighboring nodes that are sufficiently similar to the target business node.

[0042] Specifically, the process begins with a local retrieval enhanced by graph retrieval, centered on the target business node. This involves identifying all directly connected neighboring nodes based on the target business node's topological position within the graph. For example, using a suspected risky account as the center, neighboring nodes related to it, such as devices, operation times, and transaction objects, are identified. Next, a second similarity score is calculated between each neighboring node and the target business node. This involves first counting the frequency of relationships between the two nodes, smoothing the data to obtain conditional probabilities, and then calculating the cross-entropy and converting it into a similarity score. Finally, the calculated second similarity score is compared to a second preset similarity threshold. Neighboring nodes with a second similarity score greater than this threshold are identified as relevant business nodes.

[0043] S130. Generate a time-series business chain based on relevant business nodes, and determine the risk outcome of the time-series business chain through a large language model.

[0044] In this context, a time-series business chain refers to a structured sequence of behaviors generated chronologically or logically based on the temporal and causal relationships of related business nodes. A large language model is a language model fine-tuned for the financial field, possessing semantic understanding and natural language generation capabilities. In risk identification, the large language model is used to transform the structured time-series business chain into a human-understandable natural language explanation report, and outputs a risk score based on the risk characteristics within the chain, enabling interpretable risk decisions. The risk outcome refers to the risk assessment conclusion derived from the analysis of the time-series business chain using the large language model, typically represented by a risk score and its corresponding risk level. The risk score is calculated by weighted aggregation of the risk contributions of multiple links and is used to trigger different risk control measures.

[0045] Optionally, the risk outcome of the time-series business chain is determined by a large language model, including: generating a first prompt word based on the time-series business chain, performing risk calculation based on the first prompt word using a large language model to obtain a risk score; determining a target interval corresponding to the risk score from a preset score interval, and determining the risk outcome based on the target interval, wherein the risk outcome is low risk, medium risk, or high risk.

[0046] The time-series business chain refers to multiple representative and complete behavioral links generated through reasoning. The first cue word is a natural language description transformed from the structured graph link sequence, aiming to enable the large language model to understand the operational logic and risk characteristics. Here, the large language model specifically refers to a model fine-tuned for the financial field, possessing the ability to understand financial business scenarios and related risk semantics. The risk score is a quantitative representation of the risk level of the entire time-series business chain by the large language model. The preset score range is a pre-calibrated risk threshold range based on factors such as historical fraud cases and acceptable false positive and false negative rates. The risk result is a level determined according to the preset range corresponding to the risk score, categorized as low risk, medium risk, and high risk.

[0047] Specifically, the first prompt word is generated based on the time-series business chain, which is to convert the structured time-series business chain into natural language prompt content that the large language model can understand. After receiving the first prompt word, the large language model will conduct a comprehensive analysis and semantic interpretation of the risk attributes, the closeness of the relationship, and the overall behavior pattern of each entity in the chain, and then calculate a comprehensive risk score based on the internal algorithm, using the following formula (5): (5) in, This represents the weight of the i-th link. This represents the risk score of the i-th link, and the output risk score is the weighted value of n links. Finally, a target interval corresponding to the risk score is determined from the preset score interval, and the risk result is determined based on the target interval. For example, a high-risk threshold and a medium-risk threshold are preset. When the risk score is greater than or equal to the high-risk threshold, the target interval is high-risk, and the risk result is determined to be high-risk. When the risk score is greater than or equal to the medium-risk threshold but less than the high-risk threshold, the target interval is moderately suspicious, and the risk result is determined to be medium-risk. When the risk score is less than the medium-risk threshold, the target interval is low-risk or normal, and the risk result is determined to be low-risk. For high-scoring cases that are close to the threshold or have novel patterns, they will also be forwarded to human experts for review.

[0048] The technical solution of this invention integrates fragmented risk data from multiple sources by constructing a business knowledge graph, uniformly carrying various entities and multi-layered relationships. Through global retrieval, high-risk communities are identified and target business nodes are located; through local retrieval, surrounding related nodes are extracted, balancing retrieval breadth and detail accuracy to comprehensively uncover hidden group association clues. A large language model parses the links and outputs quantitative risk results, automatically completing risk attribution and classification, reducing the workload of manual judgment, and improving the accuracy of risk identification and the interpretability of results.

[0049] Example 2 Figure 2 This is a flowchart of an abnormal business risk identification method provided in Embodiment 2 of the present invention. This embodiment adds a specific process for generating a time-series business chain based on relevant business nodes, building upon Embodiment 1. The specific content of steps S210-S220 and S260 is largely the same as steps S110-S130 in Embodiment 1, and therefore will not be repeated in this embodiment. Figure 2 As shown, the method includes: S210, Obtain the business knowledge graph.

[0050] Optionally, the business knowledge graph is acquired, including: acquiring business data, extracting entities from the business data according to target dimensions to obtain each entity, wherein the target dimensions include behavioral actions, risk processes, risk media and environmental characteristics, and the business data includes text risk sample data, user behavior time series data, network event record data and pre-risk control alarm annotations; identifying the relationships between each entity, wherein the relationships include temporal relationships, binding relationships, semantic relationships and causal backward relationships; and constructing a business knowledge graph with each entity as a node and each relationship as an edge.

[0051] S220. Determine the target business node in the business knowledge graph through global retrieval, and determine the related business nodes corresponding to the target business node through local retrieval.

[0052] Optionally, before determining the target business node in the business knowledge graph through global retrieval, the method further includes: calling a preset community discovery algorithm to perform network clustering calculation on the business knowledge graph, using the association relationship between entities as the clustering weight, and aggregating to generate each graph sub-network; dividing each graph sub-network into each business community, wherein the business community includes a time-series process community, an organizational structure community, an event link community, a business behavior community, and a risk path community.

[0053] Optionally, the target business node in the business knowledge graph is determined through global retrieval, including: generating a global retrieval through graph retrieval enhancement to traverse each business community, calculating the first similarity between each business community and the preset risk sample, and taking the business community with the first similarity greater than the first preset similarity threshold as the target risk community; and determining the node in the target risk community that carries the pre-preset risk control alarm label as the target business node.

[0054] Optionally, relevant business nodes corresponding to the target business node are determined through local retrieval, including: performing graph retrieval enhancement to generate local retrieval centered on the target business node, obtaining each neighboring node of the target business node; calculating the second similarity between each neighboring node and the target business node, and taking the neighboring nodes with the second similarity greater than the second preset similarity threshold as relevant business nodes.

[0055] S230. Calculate the information gain rate of each relevant business node, and take the relevant business node with the largest information gain rate as the starting node for deduction.

[0056] Among them, the information gain ratio is used to measure the ability of a feature node to reduce the uncertainty of the surrounding environment of the target account, and is calculated using the following formula (6): (6) in, Represents a candidate entity within the target risk community. Represents all relevant entities recalled by a local search. Represents information gain ratio. The information entropy represents all relevant entities recalled by the local search, reflecting the total uncertainty of the environment surrounding the target account. Let X be the conditional information entropy of the surrounding environment under the assumption that node X is involved in the crime.

[0057] The starting node for the simulation is the node selected from the relevant business nodes that makes the greatest contribution to eliminating system uncertainties, and serves as the starting point for the link simulation.

[0058] Specifically, the information gain rate of each relevant business node is first calculated. That is, from the fraud community entities recalled by global search, the node that contributes the most to eliminating system uncertainty is found. The system will traverse the candidate nodes in the community, calculate the information gain rate of each node, and select the relevant business node with the largest information gain rate as the starting node for inference, so as to avoid the reasoning getting stuck in irrelevant edge nodes.

[0059] S240. Based on the information gain rate, relevant business nodes are selected sequentially to extend the link of the simulation starting node.

[0060] Specifically, then, based on the information gain rate, relevant business nodes are selected sequentially to extend the link of the starting node of the deduction. A greedy graph traversal strategy based on the information gain rate can be adopted. The traversal is divided into two rounds. After determining the first node, the first round dynamically queries and expands the surrounding out-degree related entities. When selecting a branch, the conditional information gain rate brought by the candidate node is calculated. The maximum information gain rate is always used as the next hop direction of the path jump. The second round is similar, except that the candidate node is selected as the in-degree node.

[0061] S250. When the link forms a closed loop or the information gain rate is less than the preset gain threshold, the expansion is stopped, candidate service chains are generated, and each candidate service chain is pruned and aggregated to obtain the time-series service chain.

[0062] The preset gain threshold is a pre-defined criterion; when a node's information gain rate falls below this threshold, it indicates that the node cannot provide valuable information for link expansion. Candidate business chains are multiple potential business chains generated through link expansion. Pruning and aggregation is the process of filtering and merging candidate business chains to ultimately obtain the most representative business chain.

[0063] Specifically, when the inferred links generated during the link expansion process form a closed loop in the graph, or when it is discovered that the information gain rate of all neighboring nodes of a certain node is lower than a preset gain threshold, the expansion stops, and candidate business chains are generated. Finally, each candidate business chain is pruned and aggregated. After multiple rounds of parallel walks and pruning, several of the most representative complete behavioral links are selected from high-risk communities to form time-series business chains. The time-series business chains can clearly reflect the development path and correlation of behaviors.

[0064] S260. Determine the risk outcomes of the time-series business chain through a large language model.

[0065] Optionally, the risk outcome of the time-series business chain is determined by a large language model, including: generating a first prompt word based on the time-series business chain, performing risk calculation based on the first prompt word using a large language model to obtain a risk score; determining a target interval corresponding to the risk score from a preset score interval, and determining the risk outcome based on the target interval, wherein the risk outcome is low risk, medium risk, or high risk.

[0066] The technical solution of this invention uses information gain rate to screen the starting node with the strongest discriminative power and select the best path to extend, avoids ineffective edge node inference, relies on termination conditions to cut off valueless links in a timely manner, and simplifies redundant paths through pruning and aggregation, so as to quickly generate a logically complete and causally clear time-series business chain and reduce the amount of link inference calculation.

[0067] Example 3 Figure 3 This is a schematic diagram of an abnormal business risk identification device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a knowledge graph acquisition module 310, used to acquire a business knowledge graph; The business node retrieval module 320 is used to determine the target business node in the business knowledge graph through global retrieval and to determine the related business nodes corresponding to the target business node through local retrieval. The risk outcome determination module 330 is used to generate a time-series business chain based on relevant business nodes and determine the risk outcome of the time-series business chain through a large language model.

[0068] Optionally, the knowledge graph acquisition module 310 is specifically used for: acquiring business data; extracting entities from the business data according to target dimensions to obtain each entity, wherein the target dimensions include behavioral actions, risk processes, risk media, and environmental characteristics; and the business data includes text risk sample data, user behavior time-series data, network event record data, and pre-risk control alarm annotations; identifying the relationships between each entity, wherein the relationships include temporal relationships, binding relationships, semantic relationships, and causal backward relationships; and constructing a business knowledge graph with each entity as a node and each relationship as an edge.

[0069] Optionally, the device further includes: a business community division module, used to call a preset community discovery algorithm to perform network clustering calculation on the business knowledge graph before determining the target business node in the business knowledge graph through global retrieval, using the association relationship between entities as the clustering weight, and aggregating to generate each graph subnet; dividing each graph subnet into each business community, wherein the business community includes a time sequence process community, an organizational structure community, an event link community, a business behavior community, and a risk path community.

[0070] Optionally, the business node retrieval module 320 specifically includes: a global retrieval unit, used to: generate a global retrieval through graph retrieval enhancement to traverse each business community, calculate the first similarity between each business community and the preset risk sample, and take the business community with the first similarity greater than the first preset similarity threshold as the target risk community; and determine the nodes in the target risk community that carry the pre-preset risk control alarm label as the target business node.

[0071] Optionally, the business node retrieval module 320 specifically includes: a local retrieval unit, used to: perform graph retrieval enhancement to generate local retrieval centered on the target business node, obtain each neighboring node of the target business node; calculate the second similarity between each neighboring node and the target business node, and take the neighboring nodes with the second similarity greater than the second preset similarity threshold as relevant business nodes.

[0072] Optionally, the risk result determination module 330 specifically includes: a business chain generation unit, used to: calculate the information gain rate of each relevant business node, and take the relevant business node with the largest information gain rate as the starting node for inference; select relevant business nodes in sequence based on the information gain rate to extend the link of the starting node for inference; when the link forms a closed loop or the information gain rate is less than the preset gain threshold, stop the extension, generate candidate business chains, and perform pruning and aggregation on each candidate business chain to obtain the time-series business chain.

[0073] Optionally, the risk result determination module 330 specifically includes: a risk result determination unit, used to: generate a first prompt word based on the time-series business chain, perform risk calculation based on the first prompt word through a large language model to obtain a risk score; determine the target interval corresponding to the risk score from the preset score interval, and determine the risk result based on the target interval, wherein the risk result is low risk, medium risk, or high risk.

[0074] The technical solution of this invention integrates fragmented risk data from multiple sources by constructing a business knowledge graph, uniformly carrying various entities and multi-layered relationships. Through global retrieval, high-risk communities are identified and target business nodes are located; through local retrieval, surrounding related nodes are extracted, balancing retrieval breadth and detail accuracy to comprehensively uncover hidden group association clues. A large language model parses the links and outputs quantitative risk results, automatically completing risk attribution and classification, reducing the workload of manual judgment, and improving the accuracy of risk identification and the interpretability of results.

[0075] The abnormal business risk identification device provided in this embodiment of the invention can execute an abnormal business risk identification method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0076] Example 4 Figure 4A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0077] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) or random access memory (RAM), communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from the storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. Input / output (I / O) interfaces are also connected to the bus 14.

[0078] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0079] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as an abnormal business risk identification method.

[0080] In some embodiments, an abnormal business risk identification method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the abnormal business risk identification method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform an abnormal business risk identification method by any other suitable means (e.g., by means of firmware).

[0081] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0082] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0083] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0084] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0085] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0086] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0087] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0088] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for identifying abnormal business risks, characterized in that, include: Obtain the business knowledge graph; The target business node in the business knowledge graph is determined by global retrieval, and the related business nodes corresponding to the target business node are determined by local retrieval. A time-series business chain is generated based on the relevant business nodes, and the risk outcome of the time-series business chain is determined through a large language model.

2. The method according to claim 1, characterized in that, The acquisition of the business knowledge graph includes: Acquire business data, extract entities from the business data according to the target dimensions to obtain each entity, wherein the target dimensions include behavioral actions, risk processes, risk media and environmental characteristics, and the business data includes text risk sample data, user behavior time series data, network event record data and pre-risk control alarm annotations; Identify the relationships between entities, including temporal relationships, binding relationships, semantic relationships, and causal backward relationships; A business knowledge graph is constructed using each of the entities as nodes and each of the relationships as edges.

3. The method according to claim 2, characterized in that, Before determining the target business node in the business knowledge graph through global retrieval, the method further includes: A preset community discovery algorithm is invoked to perform network clustering calculations on the business knowledge graph, using the association relationship between entities as the clustering weight, and aggregating to generate each graph sub-network; Each of the aforementioned graph subnets is divided into various business communities, including a time-series process community, an organizational structure community, an event chain community, a business behavior community, and a risk path community.

4. The method according to claim 3, characterized in that, The step of determining the target business node in the business knowledge graph through global retrieval includes: The graph retrieval enhancement generates a global retrieval that traverses each of the business communities, calculates the first similarity between each business community and a preset risk sample, and identifies business communities with a first similarity greater than a first preset similarity threshold as target risk communities. Nodes within the target risk community that carry forward risk control alarm labels are identified as target business nodes.

5. The method according to claim 1, characterized in that, The step of determining the relevant business nodes corresponding to the target business node through local retrieval includes: A graph retrieval enhancement local retrieval is performed centered on the target business node to obtain each neighboring node of the target business node; Calculate the second similarity between each of the neighboring nodes and the target service node, and identify the neighboring nodes whose second similarity is greater than a second preset similarity threshold as the relevant service nodes.

6. The method according to claim 1, characterized in that, The generation of the time-series business chain based on the relevant business nodes includes: Calculate the information gain ratio of each relevant business node, and take the relevant business node with the largest information gain ratio as the starting node for inference. Based on the information gain rate, relevant business nodes are selected sequentially to extend the link of the simulation starting node; When the link forms a closed loop or the information gain rate is less than the preset gain threshold, the expansion stops, candidate service chains are generated, and each candidate service chain is pruned and aggregated to obtain the time-series service chain.

7. The method according to claim 1, characterized in that, The determination of the risk outcome of the time-series business chain through a large language model includes: A first prompt word is generated based on the aforementioned time-series business chain. A risk score is obtained by performing risk calculation based on the first prompt word using a large language model. A target interval corresponding to the risk score is determined from a preset scoring interval, and a risk result is determined based on the target interval, wherein the risk result is low risk, medium risk, or high risk.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

9. A computer storage medium, characterized in that, The computer storage medium stores computer instructions that are used to cause a processor to execute the method of any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-7.

Images