Risk identification

Abstract

Provided in the embodiments of the present description are a risk identification method and apparatus, and a device and a storage medium. The method comprises: on the basis of relationship data of first entities in a first entity set, constructing a first entity relationship graph corresponding to the first entity set; determining a sample risk entity set from the first entity set; on the basis of nodes and edge relationships therebetween in the first entity relationship graph, determining a set of connected paths between sample risk entities in the sample risk entity set; on the basis of nodes passed through by the set of connected paths and edge relationships thereof, generating a graph risk entity search policy; and using the graph risk entity search policy to determine a target risk entity set from a second entity relationship graph corresponding to a second entity set.

Description

Risk Identification Technical Field

[0001] This specification relates to the field of computer technology, and in particular to risk identification methods, devices, equipment, and storage media. Background Art

[0002] While the growing development of internet finance has brought convenience to consumers and businesses, it has also spawned some clients and intermediaries who profit from fraudulent practices. These include individual frauds involving forged documents to defraud funds, as well as group or collective frauds carried out by multiple individuals.

[0003] Traditional operations research strategies based on user characteristics are difficult to describe and summarize such group or clustered fraud, making it difficult to identify similar risky customer clusters. Therefore, customer financial and information assets remain at risk, and a method for identifying risks in internet finance scenarios is urgently needed.

[0004] Summary of the Invention

[0005] The main purpose of this specification is to provide a risk identification method, device, equipment, and storage medium, aiming to accurately identify risks and improve the risk management effectiveness of financial services. The technical solution is as follows.

[0006] In a first aspect, the embodiments of this specification provide a risk identification method, including:

[0007] Constructing a first entity relationship graph corresponding to the first entity set according to the relationship data of each first entity in the first entity set;

[0008] Identifying a sample risk entity set from the first entity set;

[0009] According to each node and its edge relationship in the relationship graph, determining a set of connected paths between each of the sample risk entities in the sample risk entity set;

[0010] Generate a graph risk entity search strategy based on the path nodes and edge relationships of the connected path set;

[0011] The graph risk entity search strategy is used to identify a target risk entity set in the second entity relationship graph corresponding to the second entity set.

[0012] In a second aspect, an embodiment of this specification provides a risk identification device, including:

[0013] A relationship graph construction module, configured to construct a first entity relationship graph corresponding to the first entity set based on the relationship data of each first entity in the first entity set;

[0014] A risk entity library construction module, configured to identify a sample risk entity set from the first entity set;

[0015] A path mining module is used to determine a set of connected paths between each of the sample risk entities in the sample risk entity set based on each node and its edge relationship in the relationship graph;

[0016] A strategy generation module, configured to generate a graph risk entity search strategy based on the path nodes and edge relationships of the connected path set;

[0017] An identification module is used to identify a target risk entity set in a second entity relationship graph corresponding to the second entity set by adopting the graph risk entity search strategy.

[0018] In a third aspect, an embodiment of this specification provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the above method when executed by the processor.

[0019] In a fourth aspect, an embodiment of this specification provides a storage medium having a computer program stored thereon, and the computer program implements the steps of the above method when executed by a processor.

[0020] In a fifth aspect, an embodiment of this specification provides a computer program product, comprising: a computer program, which, when executed by a processor of an electronic device, enables the processor to at least implement the method described in the first aspect.

[0021] In an embodiment of the present specification, a first entity relationship graph corresponding to the first entity set is constructed based on the relationship data of each first entity in the first entity set, a sample risk entity set is identified from the first entity set, a connected path set between each sample risk entity in the sample risk entity set is identified based on each node and its edge relationship in the relationship graph, a graph risk entity search strategy is generated based on the path nodes and edge relationships of the connected path set, and the graph risk entity search strategy is used to identify the target risk entity set in the second entity relationship graph corresponding to the second entity set. A graph risk entity search strategy is generated by mining the relationship paths between existing sample risk entities. Using this graph risk entity search strategy can improve the accuracy of risk entity recognition and discover more hidden risk entity sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] FIG1 is a schematic diagram illustrating an example of a risk identification method provided in an embodiment of this specification;

[0024] FIG2 is a flow chart of a risk identification method provided in an embodiment of this specification;

[0025] FIG3 is a schematic diagram illustrating an example of a risk identification method provided in an embodiment of this specification;

[0026] FIG4 is a schematic diagram illustrating an example of a risk identification method provided in an embodiment of this specification;

[0027] FIG5 is a flow chart of a risk identification method provided in an embodiment of this specification;

[0028] FIG6 is a schematic diagram illustrating an example of a risk identification method provided in an embodiment of this specification;

[0029] FIG7 is a schematic diagram of the structure of a risk identification device provided in an embodiment of this specification;

[0030] FIG8 is a schematic structural diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the embodiments described are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this specification.

[0032] The risk identification device provided in the embodiments of this specification can be a terminal device such as a mobile phone, computer, tablet computer, smart watch or vehicle-mounted device, or it can be a module in the terminal device for implementing the risk identification method. The risk identification device can construct a first entity relationship graph corresponding to the first entity set based on the relationship data of each first entity in the first entity set, identify a sample risk entity set from the first entity set, and identify a connected path set between each sample risk entity in the sample risk entity set based on each node and its edge relationship in the relationship graph. Based on the path nodes and edge relationships of the connected path set, a graph risk entity search strategy is generated, and the graph risk entity search strategy is used to identify the target risk entity set in the second entity relationship graph corresponding to the second entity set.

[0033] Please refer to Figure 1, which provides a scenario diagram of a risk identification method for an embodiment of this specification. The risk identification device can construct a first entity relationship graph corresponding to the first entity set based on the relationship data of each first entity in the first entity set, identify a sample risk entity set from the first entity set, and identify a connection path set between each sample risk entity in the sample risk entity set based on each node and its edge relationship in the relationship graph. Based on the path nodes and edge relationships of the connection path set, a graph risk entity search strategy is generated, and the graph risk entity search strategy is used to identify the target risk entity set in the second entity relationship graph corresponding to the second entity set.

[0034] It can be understood that the risk identification method in the embodiments of this specification is mainly used in financial service scenarios, so the identified risks specifically refer to financial fraud risks, such as loan fraud, cash withdrawal, etc.

[0035] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, storage, and display, etc.), and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the relationship data mentioned in this specification is obtained with full authorization.

[0036] The risk identification method provided in this specification is described in detail below with reference to specific embodiments.

[0037] Please refer to Figure 2, which is a flowchart of a risk identification method according to an embodiment of this specification. As shown in Figure 2, the method according to the embodiment of this specification may include the following steps S102-S110.

[0038] S102: Construct a first entity relationship graph corresponding to the first entity set according to the relationship data of each first entity in the first entity set.

[0039] In one embodiment of the present specification, the first entity may be an individual customer or a corporate customer. Specifically, the first entity may be an entity involved in financial services, and all entities that may have financial risks are identified as first entities. Optionally, the relationship data includes at least one of fund transaction data, social relationship data, and enterprise basic data. Specifically, the relationship data may be fund transaction data such as transaction transfers, media usage records such as device Wi-Fi, social relationships such as friends, and enterprise basic data such as senior executives and legal persons generated by the above-mentioned first entity in daily activities. It should be noted that the relationship data is not limited to the relationship data listed here, and may include other data related to the first entity. Fund transaction data may include transaction account information, current account information, transfer and collection information, etc. of the first entity. Media usage records may include telephone number usage records, device identification, etc. Based on the relationship data, a 1-2 degree association relationship of the first entity is constructed. For example, in the transfer dimension, the constructed 1-degree relationship includes mutual transfer relationships, and the 2-degree relationship includes relationships with common large-amount transfer recipients. Combining the factual data of the above dimensions, the relationship vector (i.e., edge relationship) between any two entities can be obtained, which is recorded as:

[0040] R=[a1,a2,a3,…,a m ,b1,b2,b3,…,b n ,…,g t ],

[0041] Among them, a, b, ..., g represent the dimension to which the relationship belongs, and m, n, ..., t represent the number of relationships under the dimension. All the relationships constitute a full relationship map, that is, [R1, R4, R3, ..., R n ] T (n represents the total number of relationship edges). The first entity relationship graph can not only describe the direct relationship between any users or between users and enterprises, but also describe complex indirect relationships, such as the number of common friends and the number of common directors of enterprises. This is conducive to the subsequent mining of relatively hidden relationships between entities.

[0042] S104: Identify a sample risk entity set from the first entity set.

[0043] In one embodiment of the present specification, the first entity set includes entities with risks as well as entities with unknown risks or no risks. A sample risk entity set with risks can be first identified from the first entity set. In a feasible implementation, each first entity in the first entity set can be screened based on the characteristics of entities with historical risks, and sample risk entities can be identified to form a sample risk entity set. Specifically, the specific risk definitions in different scenarios are different. Taking the loan scenario in financial services as an example, the profile of the risk entity is a customer who makes a large expenditure and does not repay a single cent after the risk occurs. Based on this profile, sample risk entities with this behavior can be identified from the first entity set.

[0044] S106: According to each node and its edge relationship in the relationship graph, a set of connected paths between each of the sample risk entities in the sample risk entity set is determined.

[0045] In one embodiment of the present specification, sample risk entities are selected from the sample risk entity set in pairs as head and tail node pairs to confirm whether a connected path exists, that is, one sample risk entity is used as the head node and the other sample risk entity is used as the tail node. Based on the associated nodes (people or equipment, etc.) and edge relationships related to each sample risk entity in the relationship graph, it is confirmed whether a connected path can be constructed between the two sample risk entities.

[0046] S108: Generate a graph risk entity search strategy based on the path nodes and edge relationships of the connected path set.

[0047] In one embodiment of the present specification, a graph risk entity search strategy is generated based on the nodes of the relationship graph passed through by each connection path in the connection path set and the edge relationships between each path node. If a connection path can be constructed between two sample risk entities, it means that the two sample risk entities are directly or indirectly related. These two sample risk entities may constitute a set of related risk entities. Based on the connection paths between these two sample risk entities, the implicit association pattern of the risk entity set can be identified. Please refer to Figure 3, which is an example schematic diagram of a risk identification method provided by an embodiment of the present specification. Taking the sample risk entities as corporate customers as an example, the connection path confirmed based on the relationship graph shows that the legal person of sample risk entity 1 (corporate customer 1) and natural person a share a device, and that natural person a shares a mobile phone number with director a of sample risk entity 2 (corporate customer 2). A graph risk entity search strategy can be generated: confirm whether the second entity to be searched has a natural person who shares a device with its legal person or supervisor, and confirm whether the natural person shares a mobile phone number with the director / legal person / supervisor of the risk entity. If so, the second entity is confirmed to be a target risk entity related to the risk entity.

[0048] S110 , using the graph risk entity search strategy to identify a target risk entity set in the second entity relationship graph corresponding to the second entity set.

[0049] In one embodiment of the present specification, the second entity set is an entity set composed of second entities, and correspondingly, a second entity relationship graph can be constructed based on the relationship data of the second entities. It should be noted that the first entity set can be an entity set composed of existing users or potential users, and the second entity set can be the same as the first entity set, or it can be an entity set constructed based on different needs, for example, it can be a screened entity set for risks to be checked. One or more target risk entities can be searched using the graph risk entity search strategy, and each target risk entity constitutes a target risk entity set.

[0050] As shown in Figure 4, which provides an example schematic diagram of a risk identification method according to an embodiment of this specification, the graph risk entity search strategy obtained through the connected path is as follows: if there is a natural person A who shares a device with the legal representative of Enterprise Customer 1, and the person who shares a mobile phone number with this natural person A is a director of a risky Enterprise Customer 2, and the link that satisfies this graph strategy is a high-risk association pattern, then Enterprise Customer 1 is a potential risk customer. This method can mine a set of chain-related risky entities. If two directly related Enterprise Customers have a potential association pattern, and if one Enterprise Customer 2 is a risky entity, then the other Enterprise Customer 1 is also a potential risk entity.

[0051] In an embodiment of this specification, a first entity relationship graph corresponding to the first entity set is constructed based on the relationship data of each first entity in the first entity set, a sample risk entity set is identified from the first entity set, a connected path set between each sample risk entity in the sample risk entity set is identified based on each node and its edge relationship in the relationship graph, a graph risk entity search strategy is generated based on the path nodes and edge relationships of the connected path set, and the graph risk entity search strategy is used to identify the target risk entity set in the second entity relationship graph corresponding to the second entity set. Graph-based connected path mining can exhaustively enumerate all association patterns, and the mined path levels are deeper, which can discover more hidden association patterns, thereby more accurately identifying risky entity sets and reducing risks in financial services.

[0052] Please refer to Figure 5, which is a flowchart of a risk identification method according to an embodiment of this specification. As shown in Figure 5, the method according to the embodiment of this specification may include the following steps S202-S218.

[0053] S202: Construct a first entity relationship graph corresponding to the first entity set according to the relationship data of each first entity in the first entity set.

[0054] For details, please refer to the description of step S102 in the above embodiment of the specification, which will not be repeated here.

[0055] S204: Confirm corresponding risk entity behavior definition data according to the risk pattern to be identified.

[0056] In one embodiment of the present specification, the risk entity behavior definition data is the behavior data of entities that may be at risk, which is defined based on historical risk events or expert experience. Different risk entity behavior definition data correspond to different risk models. Specifically, when the risk model is cashing out, when defining the risk entity behavior definition data, more attention is paid to the behavior of the entities as sellers, buyers and intermediaries, such as whether the seller and buyer are engaged in false transactions, whether there are financial transactions between sellers, sellers and intermediaries, etc. For another example, when the risk model is loan fraud, it is usually between the intermediary and the user, or between the enterprise and the user. In this case, the risk entity behavior definition data can be defined as whether there are abnormal transactions with the enterprise or intermediary, or whether the network environment information reflected by the financial transaction behavior is the same.

[0057] S206: confirming sample risk entities that meet the risk entity behavior definition data based on the entity behavior data of the first entity in the first entity set to obtain a sample risk user set.

[0058] In one embodiment of the present specification, entity behavior data of a first entity is obtained, and it is confirmed whether the entity behavior data of the first entity matches the risk entity behavior definition data item. If the risk behavior set in the risk entity behavior definition data is satisfied, the first entity can be confirmed as a sample risk entity, and then a sample risk user set is obtained.

[0059] S208: Confirm each sample risk entity in the sample risk entity set as a first risk entity node and a second risk entity node.

[0060] In one embodiment of the present specification, the obtained sample risk entity sets are combined in pairs to form sample pairs, and exist as head and tail nodes respectively, that is, one sample risk entity is used as the first risk entity node and the other as the second risk entity node.

[0061] S210: Based on a path search algorithm and the nodes and edge relationships in the relationship graph, a sub-connected path from the first risk entity node to the second risk entity node is confirmed.

[0062] In one embodiment of the present specification, a path search algorithm is used to determine whether a connected path exists between a first risk entity node and a second risk entity node in a relationship graph. The connected path from the first risk entity node to the second risk entity is referred to as a sub-connected path. For example, if the path search algorithm discovers that a node associated with the first risk entity node is the same as a node associated with the second risk entity, a sub-connected path between the first risk entity node and the second risk entity node may be established through the same node.

[0063] Optionally, when executing a path search algorithm based on the nodes and their edge relationships in the relationship graph to confirm the sub-connected path from the first risk entity node to the second risk entity node, the following steps S2102-S2104 may be specifically included.

[0064] S2102 , respectively diffuse the first risk entity node and the second risk entity node according to a preset diffusion depth to obtain a first diffusion endpoint node corresponding to the first risk entity node and a second diffusion endpoint node corresponding to the second risk entity node.

[0065] Among them, the preset diffusion depth is defined as follows: for any node n, the depth of n is the length of the only path from the root to n, and the depth of the root is 0. The preset depth is diffused outward from the first risk entity node and the second risk entity node as the root to obtain the first diffusion end node corresponding to the first risk entity node and the second diffusion end node corresponding to the second risk entity node. The preset diffusion depth can be set according to the scenario requirements, preferably, it can be set to 2-4. For example, if the depth is 2, the diffusion method is to first visit the first node in the graph that has a path connected to the first risk entity node or the second risk entity node, and then visit the second node that has a path connected to the first node. The second node and the first node that do not have the same other paths are the diffusion end nodes.

[0066] S2104: Connect the nodes in the first diffusion endpoint node that are the same as the second diffusion endpoint node to obtain a connection path from the first risk entity node to the second risk entity node.

[0067] In one embodiment of the present specification, the first diffusion end node and the second diffusion end node (tail node) after expansion are associated. Specifically, if the first diffusion end node after expansion is the same as the second diffusion end node, the two nodes can be connected. Please refer to Figure 6. Figure 6 is an example schematic diagram of a risk identification method in an embodiment of the present specification. The head node can be the first risk entity node, and the tail node can be the second risk entity node. Taking the depth of 2 as an example, the first diffusion end nodes are d, e, f, and c, and the second diffusion end nodes are k, d, f, and c. Among them, the same nodes d, f, and c can be connected, such as "head node-bfg-tail node", which is a path. The nodes and edge types that constitute the path are abstracted to form a path rule. The total depth of the path is 4, constituting three connected paths from the first risk entity node to the second risk entity node.

[0068] It should be noted that in the traditional hop-by-hop diffusion method, the calculation complexity of the path rule with a depth of N from the head node to the tail node is O(k N ), and when there are a lot of hot spots in the relationship graph, it is impossible to query all paths within a limited time. Here, the head and tail nodes are diffused N / 2 degrees respectively, and then the same parts of the end nodes of the two subgraphs are connected. The formed path is abstracted to obtain the path rule. This path splicing method greatly reduces the computational complexity to Therefore, the depth of path excavation can be further increased to 4-6 degrees.

[0069] S212: Obtain a connected path set corresponding to the sample risk entity set based on the sub-connected paths corresponding to each of the first risk entity nodes and each of the second risk entity nodes.

[0070] In one embodiment of the present specification, the sub-connectivity paths generated according to the sample risk entity set are combined to obtain a connectivity path set.

[0071] S214: Generate a path search rule based on the path nodes and edge relationships of each connected path in the connected path set.

[0072] In one embodiment of the present specification, a path search rule is generated based on the node information and edge relationship of the pathway nodes, "head node-bfg-tail node", pathway node b is the frequent large-amount fund transfer user of the head node, pathway node f is the frequent large-amount fund transfer user of the frequent large-amount fund transfer user, pathway node g is the legal person, and f and g share a mobile phone number. Then the path search rule can be to first search for the frequent large-amount fund transfer users of the risk entity, then search for the frequent large-amount fund transfer users of the frequent large-amount fund transfer users, and then confirm whether the frequent large-amount fund transfer users share a mobile phone number with the legal persons of other entities, and then confirm the associated entities of the risk entity.

[0073] S216: Screen the path search rules to obtain target path search rules.

[0074] In one embodiment of the present specification, the generated path search rules are further screened to eliminate duplicate path search rules or path search rules with poor search effects, thereby identifying effective target path search rules.

[0075] Optionally, when screening the path search rules to obtain target path search rules, the method may include the following steps S2162-S2166.

[0076] S2162: Based on the sample risk entity set, confirm a third risk entity node in a third entity relationship graph corresponding to a third entity set.

[0077] In one embodiment of the present specification, the third entity set is an entity set composed of third entities. The third entity can be an entity set known to have risks, which can include entities with risks and entities without risks to serve as a verification entity data set. For example, the third entity set can be composed of a sample risk entity set and other randomly selected entities, and the other randomly selected entities can be marked as having risks. The third risk entity node in the third entity relationship graph is marked based on the sample risk entity set. It is understandable that the third entity set can also be the same as the first entity set, that is, the first entity set can be directly used to verify the path search rule.

[0078] S2164: Taking the third risk entity node as the head node, use the path search rule to confirm a second connection path connected to the third risk entity node.

[0079] In one embodiment of the present specification, a second connected path connected to the third risk entity node is searched in the third entity relationship graph using a path search rule mined according to the sample risk entity set.

[0080] S2166: Determine the evaluation value of the path search rule based on the node risk status and evaluation index of the tail node corresponding to the second connected path, and filter the path search rules based on the evaluation value to obtain a target path search rule.

[0081] In one embodiment of the present disclosure, after the second connected path is found, the node risk status of the tail node is determined. The node risk status can be the probability that the node is a risky entity. The evaluation value of the path search rule is determined based on the evaluation index. The effectiveness of the path search rule is determined based on the evaluation value, and it is determined whether the path search rule should be eliminated. For example, an evaluation value threshold is set, and path search paths with evaluation values ​​that meet the evaluation value threshold are determined as target path search rules.

[0082] Optionally, when the evaluation index is accuracy, the evaluation value of the path search rule is confirmed based on the node risk situation and evaluation index of the tail node corresponding to the second connected path, and the path search rule is screened based on the evaluation value to obtain the target path search rule, which may include the following steps S302-S306.

[0083] S302: Confirm the number of correct connection paths whose tail nodes are risk entities of the second connection paths.

[0084] S304: Calculate the accuracy of the path search rule based on the number of correct connection paths and the total number of the second connection paths.

[0085] S306: Filter out a target path search rule from the path search rules based on the accuracy rate.

[0086] Specifically, the accuracy calculation formula is:

[0087] Since the head node of the second connected path is a known risk entity, the number of paths in the recalled path whose head and tail nodes are both risk entities is obtained, that is, the number of connected paths whose tail nodes are risk entities. Here, the second connected path whose tail node is a risk entity is defined as a correct connected path, and the number of correct connected paths is calculated. The number of paths recalled by the path rule is the total number of recalled second connected paths. The accuracy of the path search rule is calculated based on the number of correct connected paths and the total number of second connected paths. Path search rules are screened based on the accuracy, and those with low accuracy are eliminated.

[0088] Optionally, when the evaluation index is the recall rate, the evaluation value of the path search rule is confirmed based on the node risk situation of the tail node corresponding to the second connected path and the evaluation index, and the path search rule is screened based on the evaluation value to obtain the target path search rule, which may include the following steps S308-S312.

[0089] S308: Confirm the correct number of connection paths whose tail nodes are risk entities of the second connection paths.

[0090] Please refer to the above step S302 for details, which will not be described here in detail.

[0091] S310 , calculating a recall rate of the path search rule based on the number of correct connected paths and the total number of fourth connected paths in the third entity relationship graph, wherein the fourth connected paths are connected paths whose head and tail nodes are both risk entities.

[0092] Specifically, the calculation formula for recall is:

[0093] The fourth connected paths whose head and tail nodes are both risk entities are identified from the third entity relationship graph, and the recall rate is calculated based on the number of correct connected paths and the total number of fourth connected paths.

[0094] S312: Filter out a target path search rule from the path search rules based on the recall rate.

[0095] Specifically, the path search rules are screened according to the recall rate of each path search rule to obtain the target path search rule. For example, the recall rate can be compared with a recall rate threshold, and the path search rule with a recall rate greater than the recall rate threshold is determined as the target path search rule.

[0096] In a feasible implementation, a comprehensive evaluation of both accuracy and recall is performed on the large number of path rules mined in the above steps. Alternatively, either recall or accuracy can be used to evaluate the path search rules.

[0097] For example, the F1-Score can be calculated based on the recall rate and the precision rate. The calculation formula of the F1-Score is:

[0098] Thus, a target path search rule is screened out from the path search rules according to the F1-Score.

[0099] S218: Generate a graph risk entity search strategy based on the target path search rule.

[0100] In one embodiment of the present specification, a graph risk entity search strategy is formed based on the target path search rules obtained after verification.

[0101] S220: Using the graph risk entity search strategy, a target risk entity set is identified in the second entity relationship graph corresponding to the second entity set.

[0102] Please refer to the description of step S110 in the above embodiment of the specification, which will not be repeated here.

[0103] In an embodiment of the present specification, by confirming corresponding risk entity behavior definition data based on the risk pattern to be identified, and confirming sample risk entities that meet the risk entity behavior definition data based on the entity behavior data of the first entity in the first entity set, a sample risk user set is obtained, thereby facilitating the subsequent customization of a graph risk entity search strategy based on different risk patterns, thereby improving the search effect of the generated graph risk entity search strategy. In addition, each sample risk entity in the sample risk entity set is respectively identified as a first risk entity node and a second risk entity node. Based on a path search algorithm and each node and its edge relationship in the relationship graph, a sub-connected path from the first risk entity node to the second risk entity node is identified. Based on the sub-connected paths corresponding to each first risk entity node and each second risk entity node, a connected path set corresponding to the sample risk entity set is obtained. Through the path rule mining algorithm, not only can a graph strategy with strong stability be generated, but also with clear transaction interpretability, and by performing deep diffusion on the first risk entity node and the second risk entity node respectively, the complexity of the graph search can be reduced, thereby mining the association pattern between risk entities at a deeper level, thereby improving the accuracy of the identified risk entity set. Based on the path nodes and edge relationships of each connected path in the connected path set, path search rules are generated, and the path search rules are screened to obtain target path search rules. Based on the target path search rules, a graph risk entity search strategy is generated, and the path search rules are screened through evaluation indicators, so as to identify rules with better accuracy in risk entity mining in the path search rules, further improve the accuracy of risk identification by generating a graph risk entity search strategy, and improve the risk management effect of financial services.

[0104] The following will describe in detail the risk identification device provided in the embodiments of this specification in conjunction with Figure 7. It should be noted that the risk identification device in Figure 7 is used to execute the method of the embodiments shown in Figures 2 to 6 of this specification. For ease of explanation, only the parts relevant to the embodiments of this specification are shown. For specific technical details not disclosed, please refer to the embodiments shown in Figures 2 to 6 of this specification.

[0105] Please refer to Figure 7, which shows a schematic diagram of the structure of a risk identification device provided by an exemplary embodiment of this specification. The risk identification device can be implemented as all or part of a device through software, hardware, or a combination of both. The device 1 includes a relationship graph construction module 11, a risk entity library construction module 12, a path mining module 13, a strategy generation module 14, and an identification module 15.

[0106] The relationship graph construction module 11 is configured to construct a first entity relationship graph corresponding to the first entity set based on the relationship data of the first entities in the first entity set.

[0107] The risk entity library construction module 12 is used to identify a sample risk entity set from the first entity set.

[0108] The path mining module 13 is used to confirm the set of connected paths between the sample risk entities in the sample risk entity set based on the nodes and their edge relationships in the relationship graph.

[0109] The strategy generation module 14 is used to generate a graph risk entity search strategy based on the path nodes and edge relationships of the connected path set.

[0110] The identification module 15 is configured to identify a target risk entity set in the second entity relationship graph corresponding to the second entity set by adopting the graph risk entity search strategy.

[0111] Optionally, the path mining module 13 is specifically configured to identify each sample risk entity in the sample risk entity set as a first risk entity node and a second risk entity node;

[0112] Determine a sub-connected path from the first risk entity node to the second risk entity node based on a path search algorithm and the nodes and their edge relationships in the relationship graph;

[0113] A connected path set corresponding to the sample risk entity set is obtained based on the sub-connected paths corresponding to each of the first risk entity nodes and each of the second risk entity nodes.

[0114] Optionally, the path mining module 13 is specifically configured to diffuse the first risk entity node and the second risk entity node respectively according to a preset diffusion depth to obtain a first diffusion endpoint node corresponding to the first risk entity node and a second diffusion endpoint node corresponding to the second risk entity node;

[0115] The nodes in the first diffusion endpoint nodes that are the same as the second diffusion endpoint nodes are connected to obtain a connection path from the first risk entity node to the second risk entity node.

[0116] Optionally, the strategy generation module 14 is specifically configured to generate a path search rule based on the path nodes and edge relationships of each connected path in the connected path set;

[0117] screening the path search rules to obtain target path search rules;

[0118] A graph risk entity search strategy is generated based on the target path search rule.

[0119] Optionally, the strategy generation module 14 is specifically configured to confirm a third risk entity node in a third entity relationship graph corresponding to a third entity set based on the sample risk entity set;

[0120] Taking the third risk entity node as a head node, using the path search rule to confirm a second connection path connected to the third risk entity node;

[0121] An evaluation value of the path search rule is determined based on the node risk status and evaluation index of the tail node corresponding to the second connected path, and the path search rule is screened based on the evaluation value to obtain a target path search rule.

[0122] Optionally, the strategy generation module 14 is specifically configured to confirm the number of correct connection paths whose tail nodes of the second connection paths are risk entities;

[0123] Calculating the accuracy of the path search rule based on the number of the correct connection paths and the total number of the second connection paths;

[0124] A target path search rule is selected from the path search rules based on the accuracy rate.

[0125] Optionally, the strategy generation module 14 is specifically configured to confirm the number of correct connection paths whose tail nodes of the second connection paths are risk entities;

[0126] Calculating a recall rate of the path search rule based on the number of correct connected paths and the total number of fourth connected paths in the third entity relationship graph, wherein the fourth connected paths are connected paths whose head and tail nodes are both risk entities;

[0127] A target path search rule is selected from the path search rules based on the recall rate.

[0128] Optionally, the relationship data includes at least one of financial transaction data, social relationship data, and enterprise basic data.

[0129] Optionally, the relationship graph construction module 11 is specifically used to confirm corresponding risk entity behavior definition data according to the risk pattern to be identified;

[0130] A sample risk entity that meets the risk entity behavior definition data is confirmed based on the entity behavior data of the first entity in the first entity set to obtain a sample risk user set.

[0131] It should be noted that the risk identification device provided in the above embodiment, when executing the risk identification method, only uses the division of the above-mentioned functional modules as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the risk identification device provided in the above embodiment and the risk identification method embodiment are based on the same concept. The implementation process is detailed in the method embodiment and will not be repeated here.

[0132] The serial numbers of the embodiments in this specification are for descriptive purposes only and do not represent the merits of the embodiments. In some cases, the actions or steps recited in the claims may be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0133] An embodiment of this specification also provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the risk identification method of the embodiment shown in Figures 2 to 6 above is implemented. The specific execution process can be found in the specific description of the embodiment shown in Figures 2 to 6, which will not be repeated here.

[0134] Please refer to Figure 8, which shows a schematic diagram of the structure of an electronic device provided in accordance with an exemplary embodiment of this specification. The electronic device described herein may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.

[0135] The processor 110 may include one or more processing cores. The processor 110 utilizes various interfaces and circuits to connect various components within the electronic device. It executes instructions, programs, code sets, or instruction sets stored in the memory 120, as well as accesses data stored in the memory 120, to perform various functions and process data for the terminal 100. Optionally, the processor 110 may be implemented using at least one of the following hardware forms: a digital signal processing (DSP), a field-programmable gate array (FPGA), or a programmable logic array (PLA). The processor 110 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. The CPU primarily processes the operating system, user interfaces, and applications; the GPU is responsible for rendering and drawing display content; and the modem handles wireless communications. It is understood that the modem may not be integrated into the processor 110 and may be implemented separately via a communication chip.

[0136] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable medium (Non-Transitory Computer-Readable Storage Medium). The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an iOS system developed by Apple, including a system deeply developed based on the iOS system or other systems.

[0137] The memory 120 can be divided into an operating system space and a user space. The operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve better operating results, the operating system allocates corresponding system resources to different third-party applications. However, the requirements for system resources in different application scenarios in the same third-party application are also different. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and the third-party application are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0138] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0139] The input device 130 is used to receive input commands or data and includes, but is not limited to, a keyboard, a mouse, a camera, a microphone, or a touch-sensitive device. The output device 140 is used to output commands or data and includes, but is not limited to, a display device and a speaker. In one example, the input device 130 and the output device 140 may be combined, and the input device 130 and the output device 140 may be a touch-sensitive display.

[0140] The touch display screen can be designed as a full screen, a curved screen or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in the embodiments of this specification.

[0141] In addition, those skilled in the art will understand that the structures of the electronic devices shown in the above figures do not limit the electronic devices. The electronic devices may include more or fewer components than shown, or may combine certain components or arrange the components differently. For example, the electronic devices may also include radio frequency circuits, input units, sensors, audio circuits, WiFi modules, power supplies, Bluetooth modules, and other components, which will not be described in detail here.

[0142] In the electronic device shown in FIG8 , the processor 110 may be configured to call a computer application stored in the memory 120 and specifically perform the following operations:

[0143] Constructing a first entity relationship graph corresponding to the first entity set according to the relationship data of each first entity in the first entity set;

[0144] Identifying a sample risk entity set from the first entity set;

[0145] According to each node and its edge relationship in the relationship graph, determining a set of connected paths between each of the sample risk entities in the sample risk entity set;

[0146] Generate a graph risk entity search strategy based on the path nodes and edge relationships of the connected path set;

[0147] The graph risk entity search strategy is used to identify a target risk entity set in the second entity relationship graph corresponding to the second entity set.

[0148] In one embodiment, when the processor 110 determines the set of connected paths between the sample risk entities in the sample risk entity set based on the nodes and their edge relationships in the relationship graph, the processor 110 specifically performs the following operations:

[0149] Confirming each sample risk entity in the sample risk entity set as a first risk entity node and a second risk entity node respectively;

[0150] Determine a sub-connected path from the first risk entity node to the second risk entity node based on a path search algorithm and the nodes and their edge relationships in the relationship graph;

[0151] A connected path set corresponding to the sample risk entity set is obtained based on the sub-connected paths corresponding to each of the first risk entity nodes and each of the second risk entity nodes.

[0152] In one embodiment, when the processor 110 executes the path search algorithm based on the nodes and their edge relationships in the relationship graph to determine the sub-connected path from the first risk entity node to the second risk entity node, the processor 110 specifically performs the following operations:

[0153] Diffusion is performed on the first risk entity node and the second risk entity node respectively according to a preset diffusion depth to obtain a first diffusion endpoint node corresponding to the first risk entity node and a second diffusion endpoint node corresponding to the second risk entity node;

[0154] The nodes in the first diffusion endpoint nodes that are the same as the second diffusion endpoint nodes are connected to obtain a connection path from the first risk entity node to the second risk entity node.

[0155] In one embodiment, when executing the generation of the graph risk entity search strategy based on the pathway nodes and edge relationships of the connected path set, the processor 110 specifically performs the following operations:

[0156] Generate a path search rule based on the path nodes and edge relationships of each connected path in the connected path set;

[0157] screening the path search rules to obtain target path search rules;

[0158] A graph risk entity search strategy is generated based on the target path search rule.

[0159] In one embodiment, when the processor 110 performs the screening of the path search rules to obtain the target path search rules, the processor 110 specifically performs the following operations:

[0160] Based on the sample risk entity set, confirming a third risk entity node in a third entity relationship graph corresponding to the third entity set;

[0161] Taking the third risk entity node as a head node, using the path search rule to confirm a second connection path connected to the third risk entity node;

[0162] An evaluation value of the path search rule is determined based on the node risk status and evaluation index of the tail node corresponding to the second connected path, and the path search rule is screened based on the evaluation value to obtain a target path search rule.

[0163] In one embodiment, when the processor 110 determines the evaluation value of the path search rule based on the node risk status and evaluation index of the tail node corresponding to the second connectivity path, and filters the path search rule based on the evaluation value to obtain the target path search rule, the processor 110 specifically performs the following operations:

[0164] Confirming that the tail node of the second communication path is the correct number of communication paths of the risk entity;

[0165] Calculating the accuracy of the path search rule based on the number of the correct connection paths and the total number of the second connection paths;

[0166] A target path search rule is selected from the path search rules based on the accuracy rate.

[0167] In one embodiment, when the processor 110 determines the evaluation value of the path search rule based on the node risk status and evaluation index of the tail node corresponding to the second connectivity path, and filters the path search rule based on the evaluation value to obtain the target path search rule, the processor 110 specifically performs the following operations:

[0168] Confirming that the tail node of the second communication path is the correct number of communication paths of the risk entity;

[0169] Calculating a recall rate of the path search rule based on the number of correct connected paths and the total number of fourth connected paths in the third entity relationship graph, wherein the fourth connected paths are connected paths whose head and tail nodes are both risk entities;

[0170] A target path search rule is selected from the path search rules based on the recall rate.

[0171] In one embodiment, the relationship data includes at least one of financial transaction data, social relationship data, and enterprise basic data.

[0172] In one embodiment, when the processor 110 identifies the sample risk entity set from the first entity set, the processor 110 specifically performs the following operations:

[0173] Confirm the corresponding risk entity behavior definition data based on the risk pattern to be identified;

[0174] A sample risk entity that meets the risk entity behavior definition data is confirmed based on the entity behavior data of the first entity in the first entity set to obtain a sample risk user set.

[0175] In an embodiment of the present specification, a first entity relationship graph corresponding to the first entity set is constructed based on the relationship data of each first entity in the first entity set, a sample risk entity set is identified from the first entity set, a connected path set between each sample risk entity in the sample risk entity set is identified based on each node and its edge relationship in the relationship graph, a graph risk entity search strategy is generated based on the path nodes and edge relationships of the connected path set, and the graph risk entity search strategy is used to identify the target risk entity set in the second entity relationship graph corresponding to the second entity set. Graph-based connected path mining can exhaustively enumerate all association patterns, and the mined path levels are deeper, which can discover more hidden association patterns, thereby more accurately identifying risky entity sets and reducing risks in financial services.

[0176] Furthermore, by confirming the corresponding risk entity behavior definition data according to the risk pattern to be identified, sample risk entities that meet the risk entity behavior definition data are confirmed based on the entity behavior data of the first entity in the first entity set to obtain a sample risk user set, thereby facilitating the subsequent customization of the graph risk entity search strategy according to different risk patterns, thereby improving the search effect of the generated graph risk entity search strategy; in addition, each sample risk entity in the sample risk entity set is respectively identified as a first risk entity node and a second risk entity node, and based on the path search algorithm and each node and its edge relationship in the relationship graph, a sub-connected path from the first risk entity node to the second risk entity node is identified. Based on the sub-connected paths corresponding to each first risk entity node and each second risk entity node, a connected path set corresponding to the sample risk entity set is obtained. Through the path rule mining algorithm, not only can a graph strategy with strong stability be generated, but also with clear transaction interpretability, and by performing deep diffusion on the first risk entity node and the second risk entity node respectively, the complexity of the graph search can be reduced, and the association pattern between risk entities at a deeper level can be mined, thereby improving the accuracy of the identified risk entity set. Based on the path nodes and edge relationships of each connected path in the connected path set, path search rules are generated, and the path search rules are screened to obtain target path search rules. Based on the target path search rules, a graph risk entity search strategy is generated, and the path search rules are screened through evaluation indicators, so as to identify rules with better accuracy in risk entity mining in the path search rules, further improve the accuracy of risk identification by generating a graph risk entity search strategy, and improve the risk management effect of financial services.

[0177] In addition, an embodiment of this specification provides a computer program product, which includes a computer program. When the computer program is executed by a processor of an electronic device, the processor can at least implement the method provided in the embodiments shown in Figures 1 to 6 above.

[0178] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0179] The above disclosure is only a preferred embodiment of this specification, and certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A risk identification method, the method comprising: Constructing a first entity relationship graph corresponding to the first entity set according to the relationship data of each first entity in the first entity set; Identifying a sample risk entity set from the first entity set; According to each node and its edge relationship in the relationship graph, confirming a set of connected paths between each of the sample risk entities in the sample risk entity set; Generate a graph risk entity search strategy based on the path nodes and edge relationships of the connected path set; The graph risk entity search strategy is used to identify a target risk entity set in a second entity relationship graph corresponding to the second entity set.

2. The method according to claim 1, wherein the step of confirming the set of connected paths between the sample risk entities in the sample risk entity set according to the nodes and their edge relationships in the relationship graph comprises: Confirming each sample risk entity in the sample risk entity set as a first risk entity node and a second risk entity node respectively; Based on the path search algorithm and the nodes and their edge relationships in the relationship graph, determine the sub-connected path from the first risk entity node to the second risk entity node; A connection path set corresponding to the sample risk entity set is obtained based on the sub-connection paths corresponding to each of the first risk entity nodes and each of the second risk entity nodes.

3. The method according to claim 2, wherein the step of determining the sub-connected path from the first risk entity node to the second risk entity node based on the path search algorithm and the nodes and their edge relationships in the relationship graph comprises: Diffusion is performed on the first risk entity node and the second risk entity node respectively according to a preset diffusion depth to obtain a first diffusion endpoint node corresponding to the first risk entity node and a second diffusion endpoint node corresponding to the second risk entity node; The nodes in the first diffusion endpoint nodes that are the same as the second diffusion endpoint nodes are connected to obtain a connection path from the first risk entity node to the second risk entity node.

4. The method according to claim 1, wherein the step of generating a graph risk entity search strategy based on the path nodes and edge relationships of the connected path set comprises: Generate a path search rule based on the path nodes and edge relationships of each connected path in the connected path set; Screening the path search rules to obtain target path search rules; A graph risk entity search strategy is generated based on the target path search rule.

5. The method according to claim 4, wherein screening the path search rule to obtain the target path search rule comprises: Based on the sample risk entity set, confirming a third risk entity node in a third entity relationship graph corresponding to the third entity set; The third risk entity node is used as the head node, and the path search rule is used to confirm the node connected to the third risk entity. A second connection path connecting the body nodes; The evaluation value of the path search rule is determined based on the node risk status and evaluation index of the tail node corresponding to the second connected path, and the path search rule is screened based on the evaluation value to obtain a target path search rule.

6. The method according to claim 5, wherein the evaluation index comprises accuracy; The step of determining the evaluation value of the path search rule based on the node risk status and the evaluation index of the tail node corresponding to the second connected path, and screening the path search rule based on the evaluation value to obtain the target path search rule includes: Confirming that the tail node of the second connection path is the correct number of connection paths of the risk entity; Calculating the accuracy of the path search rule based on the number of the correct connected paths and the total number of the second connected paths; A target path search rule is selected from the path search rules based on the accuracy rate.

7. The method according to claim 5, wherein the evaluation index comprises a recall rate; The step of determining the evaluation value of the path search rule based on the node risk status and the evaluation index of the tail node corresponding to the second connected path, and screening the path search rule based on the evaluation value to obtain the target path search rule includes: Confirming that the tail node of the second connection path is the correct number of connection paths of the risk entity; Calculating the recall rate of the path search rule based on the number of correct connected paths and the total number of fourth connected paths in the third entity relationship graph, wherein the fourth connected path is a connected path whose head and tail nodes are both risk entities; A target path search rule is selected from the path search rules based on the recall rate.

8. The method according to claim 1, wherein the relationship data includes at least one of financial transaction data, social relationship data, and enterprise basic data.

9. The method according to claim 1, wherein the step of identifying a sample risk entity set from the first entity set comprises: Confirm the corresponding risk entity behavior definition data according to the risk model that needs to be identified; A sample risk entity that meets the risk entity behavior definition data is confirmed according to the entity behavior data of the first entity in the first entity set to obtain a sample risk user set.

10. A risk identification device, comprising: A relationship graph construction module, used to construct a first entity relationship graph corresponding to the first entity set according to the relationship data of each first entity in the first entity set; A risk entity library construction module, used to identify a sample risk entity set from the first entity set; A path mining module, used to confirm a set of connected paths between each of the sample risk entities in the sample risk entity set according to each node and its edge relationship in the relationship graph; A strategy generation module, used for generating a graph risk entity search strategy based on the path nodes and edge relationships of the connected path set; The identification module is used to use the graph risk entity search strategy to identify the second entity relationship corresponding to the second entity set. The target risk entity set is identified in the family graph.

11. An electronic device, comprising: Processor and memory; The memory stores a computer program, wherein the computer program is suitable for being loaded by the processor and executing the steps of the method according to any one of claims 1 to 9.

12. A storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 9.

13. A computer program product comprising: A computer program, when executed by a processor of an electronic device, causes the processor to perform the steps of the method as claimed in any one of claims 1 to 9.

Images