Fraud-related gang incident recognition system and method based on intelligence sharing and graph calculation, and related device

Abstract

Disclosed is a fraud-related gang incident recognition system and method based on intelligence sharing and graph calculation, and a related device. The solution mainly comprises an intelligence sharing platform and an incident model based on graph calculation. The intelligence sharing platform integrates a plurality of trained recognition models, establishes a model intelligence sharing system, and summarizes multivariate information of each model in real time. The incident model based on graph calculation is configured to perform data exchange with the intelligence sharing platform. The incident model based on graph calculation is configured to classify nodes based on a graph neural network, and perform analysis on same on the basis of economic characteristics and social characteristics, to construct a social network graph of the incident, further identify overlapping gang structures on the basis of the social network graph, and transmit the overlapping gang structures to the intelligence sharing platform for recognition processing. In the solution of the present invention, gang organizations in social networks can be effectively discovered and identified by combining a graph calculation method of node attributes and a network topology structure and by using an intelligence sharing platform.

Description

A fraud gang event identification system, method and related equipment based on intelligence sharing and graph computing Technical Field

[0001] The present invention relates to event identification and processing technology, and in particular to fraud-related gang event identification technology. Background Art

[0002] Graph computing is a computational model and technology used for complex network analysis. Its basic idea is to use a graph structure to represent network data and then perform operations and calculations on the graph to analyze the network.

[0003] The fundamental elements of graph computing include graph data models, graph operations and algorithms, and graph data management. Graph data models use a graph structure to represent network data. A typical graph data model consists of nodes, edges, and attributes. Nodes represent entities in the network, edges represent relationships or interactions between entities, and attributes represent characteristics of nodes and edges. Complex networks can also be represented using hypergraphs, which add supernodes and hyperedges to the graph to represent more complex relationships. Graph operations and algorithms are the core of graph computing. Typical graph operations include traversal, searching, pathfinding, and pattern matching. Graph computing defines a series of primitive operations, such as neighbor visits and edge filtering. Algorithms combine these primitives to implement complex analytical tasks. Common graph algorithms include page ranking, community discovery, node importance calculation, and machine learning-based graph neural networks. Graph data management addresses the storage and query challenges of large-scale graph data. Graph databases accelerate neighbor queries through indexing. Distributed graph computing frameworks, such as GraphX ​​and PowerGraph, enable large-scale graph computing on distributed systems.

[0004] Currently, graph computing has a variety of applications, including social network analysis, fraud detection, knowledge graphs, and bioinformatics network analysis. As data volumes grow, graph computing, leveraging its advantages in connecting data, has become a crucial tool for big data analysis. Future development trends include heterogeneous graph analysis, graph deep learning, and graph computing on streaming data. Overall, graph computing provides an important model and technical means for representing, storing, computing, and mining complex networks.

[0005] Gang analysis is to build a suspect relationship network, apply complex network analysis methods, understand the internal organizational structure of the gang, discover core members and their activity patterns, and provide intelligence support for combating crime.

[0006] Specifically, gang analysis first requires collecting various intelligence information related to gang members, such as communication records and financial transactions, to construct network data reflecting gang relationships. Then, using nodes to represent gang members and edges to represent the connections between them, a gang relationship map is constructed. Based on this relationship map, various network analysis metrics, such as node centrality, betweenness, and clustering coefficient, can be calculated to identify core gang members. Community discovery algorithms can also be used to identify cross-groups within the gang. If a dynamic relationship network is constructed, the gang's evolution can also be analyzed. Finally, the gang relationship map is displayed using visualization methods to intuitively reveal the gang's internal structure. Gang analysis not only identifies core members but also determines the gang's activity patterns, internal organization, and communication methods, providing critical intelligence to support subsequent crackdowns and arrests.

[0007] On this basis, people have proposed a scheme for gang identification based on graph neural network node classification. This scheme derives and constructs features from the account's transaction behavior data, combines them into a wide table, and the transaction behavior constitutes the relationship between points and edges, constructing a graph transaction relationship table as a graph relationship structure; node feature preprocessing includes missing value and outlier processing and feature correlation deduplication; feature visualization, category coding and chi-square binning are performed, in which the missing values ​​of the features are placed in a separate box during chi-square binning, and the outliers and other values ​​of the features are combined into one box; after mapping the features to the bins, each box is mapped to a separate feature. The features are transposed, and one-hot encoded. After correlation and data concentration are eliminated, the features are used as node feature inputs. The nodes are accounts. Node features are generated based on account information and transaction relationships. Label tuples are generated based on black and white samples. The adjacency matrix of transactions and counterparties, the adjacency matrix of transactions and device numbers used during transactions, and the connection dictionary of nodes and edges are generated based on the transaction relationships between accounts. Random samples are generated to construct training sets, test sets, and validation sets. GraphSAGE is used to build a graph convolutional neural network node classification model, and the node features themselves are combined with the sampling The features of the same neighboring nodes are linearly transformed respectively, and then the two are concat, and then another linear transformation is performed to obtain the feature representation of the target node. Finally, the feature representation of the target node is used to perform downstream tasks. When training the model, NCELoss can be used for unsupervised training, and cross entropy can be used for supervised classification training. A graph is created, the matrix tuple is transferred to the GPU, the input dimension and the sagegcn layer are created, and the node classification model is built using the DGL library in Python to obtain the predicted probability. The classification result is 1 for a black sample and 0 for a positive sample. For accounts with a predicted classification result of 1, after initializing each node with a unique label, the label propagation algorithm is used to repeatedly socialize a node's label to the label that appears most frequently among its neighboring nodes. The algorithm stops when the label of each node appears most frequently among its neighboring nodes. The algorithm is asynchronous because each node is updated without waiting for the rest of the nodes to be updated. The transfer during account transactions is used to first generate the account node, and then the device number node used in the account transaction is generated. The account-device number relationship network is generated, and the community group is obtained for node analysis.

[0008] However, existing gang identification solutions have many problems in actual application, mainly focusing on the following points:

[0009] (1) The sample models used in the existing technology mainly rely on some old public data sets. These data sets have problems such as poor data timeliness, single and old samples, inaccurate labeling, unreasonable division of training and test sets, insufficient sample size, and uneven sample distribution. Due to the lack of continuous tracking and updating, the samples contained in these data sets are difficult to reflect the latest characteristics and various variant types of current gangs, and can no longer truly represent the distribution of gang samples in the real world, which seriously restricts the applicability of the sample model. In the early stage of data set construction, the sample size was small and the collection was single, resulting in uneven sample distribution and a lack of samples in key areas. As time goes by, the samples in the data set are getting older, the characteristics of emerging gangs are not covered, and the timeliness of the samples is reduced. Attention should also be paid to the quality of sample labels. The existing data sets are roughly labeled, and there are problems such as inconsistent labeling standards and uneven labeling capabilities of labelers, which also weakens the effect of the sample model.

[0010] (2) Most existing gang identification technologies rely too heavily on the analysis of economic characteristics such as accounts and capital flows, ignoring other important sociological characteristics of gang activities. These technologies are based on structured economic data such as accounts and transfer records, and identify gangs through the correlation between accounts or transactions. However, gang activities are becoming increasingly complex and diverse, not limited to capital flows but also involving personnel connections, geographical distribution, and event correlations. It is difficult to construct a comprehensive picture of gangs and identify real-world gang patterns from an economic perspective alone.

[0011] Summary of the Invention

[0012] In response to the problems of insufficient timeliness and applicability of sample models in existing gang event identification schemes, as well as the sole reliance on economic characteristics for identification and analysis, the purpose of this invention is to provide a fraud-related gang event identification scheme based on intelligence sharing and graph computing. Its innovative construction of an intelligence sharing mechanism and the integration of multiple types of data features can effectively overcome the problems existing in the existing technology.

[0013] To achieve the above objectives, the present invention provides a fraud-related gang event identification system based on intelligence sharing and graph computing, the fraud-related gang event identification system comprising:

[0014] An intelligence sharing platform that integrates multiple trained recognition models and establishes a model intelligence sharing system. It aggregates the diverse information of each model in real time, identifies uploaded gang models based on the trained recognition models, and analyzes the suspicious characteristics of the gang models.

[0015] An event model based on graph computing is configured to interact with an intelligence sharing platform for data. The event model based on graph computing is configured to classify nodes based on a graph neural network, and to analyze based on economic and sociological characteristics, to construct a social network graph of the event, and further to identify overlapping group structures based on the social network graph, and transmit the result to the intelligence sharing platform.

[0016] In some embodiments of the present invention, the intelligence sharing platform is configured to manually label groups that have not been identified as suspicious, and store the labeling results in the knowledge graph module to continue training the model.

[0017] In some embodiments of the present invention, the intelligence sharing platform includes an intelligence sharing module, a knowledge graph module, an analysis and decision module, a manual annotation module, and an intelligence uploading module;

[0018] The intelligence sharing module is configured to share the training model and the training data source and to perform data sharing. The intelligence sharing module can store the acquired data into the local knowledge graph library for model training;

[0019] The knowledge graph module interacts with the intelligence sharing module to perform data exchange. The knowledge graph module stores the gang relationship knowledge graph and repeatedly trains the recognition model.

[0020] The analysis and decision module is configured to interact with the knowledge graph module and the manual annotation module for data, and can perform artificial intelligence recognition on the graph data obtained by forensic collection by calling the recognition model trained by the knowledge graph module, and put the unsuccessfully recognized data into the manual annotation module;

[0021] The manual annotation module is configured to allow the user to manually modify the recognition results, and after the modification is completed, the data is put into the knowledge graph to continue model training;

[0022] The intelligence uploading module is configured to interact with the knowledge graph module for data, and is capable of receiving the graph data model obtained through forensics and storing it in the knowledge graph module, and analyzing the uploaded graph data through the analysis and decision module.

[0023] In some embodiments of the present invention, the intelligence sharing platform automatically matches the optimal model and simultaneously calls multi-model aggregation to form a model evaluation group.

[0024] In some embodiments of the present invention, the model evaluation panel uses multiple models to predict each data point, and the prediction of each model is configured as a "vote", and the prediction obtained by the majority of models is used as the final prediction result.

[0025] In some embodiments of the present invention, the graph-computing-based event model includes an event collection unit, an event relationship extraction unit, and an event analysis unit;

[0026] The event collection unit is configured to organize the data obtained by forensics into an entity-action-context structure;

[0027] The event relationship extraction unit is configured to extract event elements and their relationships from the unstructured text obtained by evidence collection and construct a structured event representation;

[0028] The event analysis unit is configured to analyze the association between event entities on the knowledge graph, extract the logical relationship between events, and use a graph computing algorithm to implement event association analysis.

[0029] To achieve the above objectives, the present invention also provides a method for identifying fraud gangs based on intelligence sharing and graph computing, characterized in that the identification method first uses a node embedding algorithm to learn the low-dimensional feature vector of each node, so that nodes with similar features are mapped to similar positions in the vector space;

[0030] Then, a clustering algorithm is used in the vector space to discover the community structure in the network based on the clustering of node vectors.

[0031] Next, the clustering results are filtered and adjusted according to the economic and sociological characteristics of the nodes;

[0032] Next, the closeness of the gang is further assessed based on network analysis indicators;

[0033] Next, track the relationships between gangs and identify the structure of overlapping gangs;

[0034] Finally, the obtained gang structure is placed in the intelligence sharing platform, and the gang model is identified through the platform identification module.

[0035] In order to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, it implements the implementation steps of the above-mentioned method for identifying fraud gang events based on intelligence sharing and graph computing.

[0036] In order to achieve the above-mentioned purpose, the present invention also provides a processor, which is used to run a program, and when the program is running, it executes the implementation steps of the above-mentioned method for identifying fraud gang events based on intelligence sharing and graph computing.

[0037] In order to achieve the above-mentioned purpose, the present invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and runnable on the processor. The program code is loaded and executed by the processor to implement the implementation steps of the above-mentioned method for identifying fraud gang events based on intelligence sharing and graph computing.

[0038] In order to achieve the above-mentioned purpose, the present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the implementation steps of the above-mentioned method for identifying fraud-related gang events based on intelligence sharing and graph computing.

[0039] The fraud-related gang identification solution based on intelligence sharing and graph computing provided by this invention has the following advantages over existing technologies:

[0040] (1) The solution of the present invention provides a new intelligence sharing model, in which relevant intelligence from different intelligence sources can be quickly integrated together to construct a gang relationship map, which can greatly shorten the time from obtaining original intelligence to generating the gang relationship map, and ensure the timeliness of intelligence. At the same time, the integration of multi-source intelligence also enriches the data volume of the relationship map and improves the accuracy of model analysis. This intelligence sharing model breaks the limitation of traditional reliance on a single intelligence source, realizes the efficient integration and sharing of multi-source heterogeneous intelligence, and the rich training data improves the effect of subsequent graph calculation and analysis. The intelligence sharing model of the present invention can effectively ensure the timeliness and accuracy of the gang analysis model, provide a solid data foundation for the construction of the gang relationship knowledge map, and lay the foundation for subsequent graph calculation and analysis.

[0041] (2) Unlike existing solutions that rely solely on a single data source, the present invention integrates data from various channels and fully integrates information from different categories. Based on a rich and diverse data foundation, it lays a solid foundation for building a more accurate and comprehensive gang model. The organic combination of heterogeneous data from various sources makes the model more comprehensive and more accurate in understanding the behavior patterns of gangs. The collaborative support of multi-source heterogeneous information is an important guarantee for improving the effectiveness of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The present invention is further described below with reference to the accompanying drawings and specific embodiments.

[0043] Figure 1 is a flow chart of the identification and analysis performed by the intelligence sharing platform in this example;

[0044] FIG2 is a diagram illustrating an example of the structure of an event model based on graph computing in this example;

[0045] FIG3 is a flowchart of constructing an event social network graph based on the graph computing event model in this example and identifying overlapping group structures. DETAILED DESCRIPTION

[0046] In order to make the technical means, creative features, objectives and effects achieved by the present invention easier to understand, the present invention is further described below with reference to specific illustrations.

[0047] The solution of the present invention innovatively introduces an intelligence sharing mechanism to perform deduplication comparison, effectively ensuring the timeliness and applicability of the model; at the same time, by integrating the two major elements of economic characteristics and social characteristics to construct a comprehensive portrait of the gang, effectively improving the recognition effect.

[0048] On this basis, the present invention provides a fraud gang incident identification system solution based on intelligence sharing and graph computing.

[0049] The fraud gang event identification system is mainly composed of an intelligence sharing platform and an event model based on graph computing.

[0050] Among them, the intelligence sharing platform in this system integrates multiple trained recognition models and establishes a model intelligence sharing system to summarize the effects, characteristics, applicable scenarios and other multi-faceted information of each gang model in real time. The intelligence sharing platform can identify the uploaded gang model based on the trained recognition model and analyze the suspicious characteristics of the gang model.

[0051] On top of this, the intelligence sharing platform also features a manual annotation function, which can manually annotate groups whose models haven't identified suspicious characteristics. The annotation results are then stored in the knowledge graph module for further training of the recognition model. The resulting intelligence sharing platform is scalable, reusable, and intelligent.

[0052] The graph computing-based event model in this system is configured to interact with the intelligence sharing platform for data. At the same time, the graph computing-based event model is configured to classify nodes based on the graph neural network, and analyze them according to economic and sociological characteristics to construct a social network graph of the event. It further identifies overlapping group structures based on the social network graph and transmits them to the intelligence sharing platform.

[0053] Furthermore, this graph computing-based event model is also configured to be able to collect and preprocess multi-source heterogeneous data, and to perform cleaning, disambiguation, and standardization on the data obtained from forensic collection to obtain standardized data; at the same time, for the standardized data obtained through preprocessing, corresponding feature extraction and construction are further performed based on the characteristics of different aspects such as economic behavior and social behavior, and the features are clustered in combination with domain knowledge to obtain a more abstract and semantic feature representation.

[0054] Furthermore, this graph computing-based event model is also configured to use individuals and groups as nodes, different types of features as attributes of the nodes, to build a corresponding relationship network, and connect different entities such as individuals, groups, and features.

[0055] Building on this foundation, this graph-based event model is configured to use graph convolution operations to aggregate a node's first- and multi-order neighbors and introduce an attention mechanism to prioritize the contributions of different neighbors to the central node. Furthermore, a node classification loss function is constructed, utilizing known individual-group relationships as training supervision. Through multiple rounds of aggregation, nodes can encode more information about the network structure.

[0056] Regarding the fraud gang incident identification system solution based on intelligence sharing and graph computing provided by the present invention, the implementation process and corresponding technical features are described in detail below.

[0057] Referring to Figure 1, the intelligence sharing platform 100 in this system specifically includes five functional modules: an intelligence sharing module 110, a knowledge graph module 120, an analysis and decision module 130, a manual labeling module 140, and an intelligence upload module 150. These five functional modules cooperate with each other to form the intelligence sharing platform 100.

[0058] The intelligence sharing module 110 is used to construct a gang relationship graph from multiple sources and obtain real-time intelligence on gang members. The intelligence sharing module 110 is specifically configured to enable the sharing of training models and training data sources, enabling data sharing. The data obtained by the intelligence sharing module can be stored in a local knowledge graph for model training.

[0059] As a further explanation, the intelligence sharing module 110 here specifically includes a data storage module, which can be used to archive the data uploaded by the user in the form of a graph database for regular backup and archiving of historical intelligence.

[0060] Furthermore, the knowledge graph module 120 is configured to store the group relationship knowledge graph and exchange data with the intelligence sharing module 110. Based on a machine learning algorithm, the knowledge graph module 120 places the intelligence model into the recognition module for repeated training to improve recognition accuracy. The resulting knowledge graph module 120 is scalable and self-learning.

[0061] The knowledge graph module is also configured so that the generated recognition model can be called by the analysis and decision-making module to determine the nature of the gang;

[0062] As a further explanation, the knowledge graph module here includes the aggregation and training functions of existing gang identification models.

[0063] Furthermore, the analysis and decision-making module 130 is configured to interact with the knowledge graph module 120 and the manual annotation module 140 to assist in group analysis and decision-making based on the recognition results. The analysis and decision-making module 130 can perform artificial intelligence recognition on the forensic image data by invoking the recognition model trained by the knowledge graph module 120, and place unsuccessfully recognized data into the manual annotation module 140. The analysis and decision-making module 130 is also configured to feed back the successfully recognized data to the user for review, presenting it to the user in an intuitive manner, allowing the user to promptly and accurately understand the recognition results of the corresponding image data.

[0064] The analysis and decision module 130 configured in this way can simultaneously improve the accuracy of the corresponding recognition results and analysis and decision conclusions as the amount of data increases.

[0065] As a further explanation, the analysis and decision module 130 here cooperates with the knowledge graph module 120 to identify the graph data model extracted by classification through the knowledge graph and confirm the group type.

[0066] Furthermore, the manual annotation module 140 is used to manually annotate unrecognizable group structures. This allows users to manually modify the recognition results. Once the modification is completed, the data is put into the knowledge graph to continue model training, improving model accuracy. As the amount of data increases, the number of manual annotations can be gradually reduced, until manual annotation is completely eliminated.

[0067] As a further explanation, the manual labeling module 140 here includes labeling and display modules, wherein the labeling module supports users to manually identify unidentified data, and the display module supports displaying the labeled content.

[0068] Furthermore, the intelligence upload module 150 is configured to cooperate with the intelligence sharing module 110 and the knowledge graph module 120 to provide an interface for uploading user models. The intelligence upload module 150 can receive the graph data model obtained from the forensics and store it in the knowledge graph module 120. The uploaded graph data is then analyzed by the analysis and decision module 130.

[0069] As a further illustration, the intelligence upload module 150 herein has an intelligence collection interface, which defines a standard interface for accessing various structured and unstructured intelligence sources. For example, the intelligence upload module 150 supports common data formats such as JSON, XML, text, and databases.

[0070] As a further explanation, the intelligence upload module 150 here is also configured to perform pre-processing such as cleaning, deduplication, and disambiguation on the collected intelligence, convert the data into a unified internal intelligence representation format, and construct a standard intelligence object containing attributes such as subjects, things, and behaviors.

[0071] In some embodiments of the present invention, when deploying recognition tasks based on the intelligence sharing platform 100, the backend of the intelligence sharing platform will automatically match the optimal model and call multi-model aggregation to form a model evaluation group.

[0072] Furthermore, the intelligence sharing platform 100 constructs a model evaluation group based on the aggregation of multiple recognition models trained in the knowledge graph module 120. Using the Max Voting algorithm, multiple recognition models are used to predict each data point, with each model's prediction configured as a "vote." The prediction obtained by the majority of models is used as the final prediction result. The model evaluation group thus formed can be used in the analysis and decision module 130, thereby further improving the accuracy of the recognition results and analysis and decision conclusions of the analysis and decision module 130.

[0073] Furthermore, the multi-model aggregation process requires deduplication and comparison of model outputs to identify duplicate recognition results and conduct due diligence to avoid blindly stacking models and affecting judgment. This module integrates the recognition results, generates candidate gang identification results based on different models, and classifies the models based on the confidence scores of all models.

[0074] In some embodiments of the present invention, the intelligence sharing platform can also collect targeted user feedback to identify samples that the model has missed or misidentified, drive the generation of new samples, and optimize the model sample library. Specifically, misidentified samples are input into the knowledge graph module and used as key training samples to repeatedly train the model.

[0075] The intelligence sharing platform formed based on the above solution can effectively break down the barriers between data and models, enable the R&D results of various institutions to be shared and complement each other's strengths, and continuously promote the upgrading and iteration of models.

[0076] 2 , the graph computing-based event model 200 in this system includes an event collection unit 210 , an event relationship extraction unit 220 , and an event analysis unit 230 .

[0077] The event collection unit 210 here is configured to organize the data obtained by forensic collection into a structure of entity (such as the subject and participants describing the event) - action (behavior describing the occurrence of the event) - context (background information such as the time and place of the event).

[0078] The event relationship extraction unit 220 is configured to extract event elements and their relationships from the unstructured text obtained by forensics, construct a structured event representation, and perform relationship extraction using natural language processing.

[0079] The event analysis unit 230 is configured to analyze the associations between event entities on the knowledge graph, extract the logical relationships between events, and implement event association analysis using a graph computing algorithm.

[0080] The solution of the present invention is based on the constructed fraud-related gang event identification system based on intelligence sharing and graph computing, and further provides a fraud-related gang event identification method to achieve efficient and high-precision identification.

[0081] The process of identifying fraud gang events using the fraud gang event identification system based on intelligence sharing and graph computing constructed by the present invention is as follows:

[0082] First, extract node features for fraud gang incidents;

[0083] Next, polymerization is carried out to form a structure;

[0084] Next, filter and adjust the results;

[0085] Next, calculate the gang tightness;

[0086] Finally, identify the gang structure.

[0087] Specifically, when extracting node features for fraud-related gang incidents, a node embedding algorithm is used to learn the low-dimensional feature vector of each node, so that nodes with similar features are mapped to similar positions in the vector space.

[0088] Next, a clustering algorithm (such as K-means) is used in the vector space to discover the community structure in the network based on the clustering of node vectors; nodes belonging to the same community may belong to the same gang.

[0089] Next, the clustering results are filtered and adjusted based on the economic and sociological characteristics of the nodes. For example, nodes with similar income levels are more likely to belong to the same gang, while nodes with large age differences may belong to different gangs.

[0090] Then, indicators such as connection density and clustering coefficient are used to further evaluate the closeness of the gang.

[0091] Finally, based on the calculated group closeness, the relationships between groups (such as common friends) are tracked to identify the structure of overlapping groups.

[0092] The fraud-related incident identification system solution based on intelligence sharing and graph computing proposed in this example solution can be implemented as a corresponding software program, forming a corresponding fraud-related incident identification software system based on intelligence sharing and graph computing. When running, this software program will execute the corresponding fraud-related incident identification method based on intelligence sharing and graph computing, and store the data in a corresponding storage medium for access and execution by the processor.

[0093] Accordingly, the implementation process and corresponding technical features of the fraud gang incident identification solution based on intelligence sharing and graph computing provided by the present invention are further illustrated below through corresponding specific examples.

[0094] In this example, an intelligence sharing platform is first constructed based on the solution of the present invention. As shown in Figure 1 , the intelligence sharing platform 100 specifically includes an intelligence sharing module 110, a knowledge graph module 120, an analysis and decision module 130, a manual annotation module 140, and an intelligence upload module 150. The functions and corresponding technical features of these modules are as described above and will not be elaborated here.

[0095] Furthermore, in its specific implementation, this intelligence sharing platform has a centralized model warehouse, allowing each research institution to upload the latest trained models to the warehouse in a standardized format.

[0096] This intelligence sharing platform also has functions such as model version management and model search, which makes it convenient for users to find and obtain the required models.

[0097] This intelligence sharing platform also establishes clear model sharing agreements, stipulates the scope of shared models, usage permissions and other details, and formulates model review standards to evaluate the effectiveness, generalization ability, algorithm innovation, etc. of uploaded models, to ensure the quality of shared models and realize the establishment of a model intelligence sharing system.

[0098] This intelligence sharing platform also includes a model repository to register and store various deep learning model files and support version management. A model upload tool has been developed to automatically extract model structure, parameters, and other metadata through simple configuration.

[0099] This intelligence sharing platform also builds a model runtime environment, allowing users to directly call and run stored models for testing. It implements permission control and access auditing to limit model access to authorized users. A metadata management module is also developed to store and index model test results, applicable scenarios, and parameter information for easy search. Furthermore, an open API is provided to enable integration with third-party systems.

[0100] This intelligence sharing platform also features an automated model metadata extraction tool. Once a model is uploaded, the tool automatically analyzes the model structure, runs the model to generate output, and extracts metadata such as performance metrics and applicable scenarios. This metadata is stored in the platform's database. The platform also provides a unified model registration interface, requiring all institutions to submit model metadata when registering their models. The platform's backend aggregates all registered models and their metadata in real time, generating reports such as model overviews and comparisons for easy user browsing and searching.

[0101] This intelligence sharing platform uses cloud computing technology to support the deployment and rapid calling of models.

[0102] After building the intelligence sharing platform, the following steps are used to identify fraud gangs, as shown in Figure 3:

[0103] (S1): Construct a large-scale social network graph containing individual nodes and relationship edges through forensically obtained data.

[0104] As a further explanation, in this step, general forensic software is used to extract illegal data and generate data files in a standard format; at the same time, natural language processing is used to analyze unstructured evidence and identify entities such as the names of people and organizations involved; semantic relationships in the evidence are extracted through methods such as syntactic dependency analysis, and the identified entities are used as nodes and relationships as edges to construct a large-scale social network containing thousands of nodes and edges.

[0105] The individual nodes here include individual economic characteristics (such as income, consumption level, etc.) and sociological characteristics (such as age, occupation, education level, etc.). The relationship edges represent the social and cooperative relationships between individuals.

[0106] (S2): A node embedding algorithm is used to learn the low-dimensional feature representation of each node, and an initial feature vector is constructed for each node, which contains the attribute information of the node and the statistical information of the node's neighboring nodes.

[0107] For further explanation, this step can be implemented using a deep learning-based graph neural network model. This model learns a low-dimensional vector representation of each node, also known as the node embedding vector, by aggregating information about the node's neighbors. The graph neural network model is trained to optimize an unsupervised loss function, ensuring that the node embedding vector preserves the network structure and node attribute information.

[0108] After model training, embedding representations of all nodes are obtained and these vectors are mapped into a common low-dimensional vector space. In this space, the relationships between nodes are calculated using the distance or similarity between vectors. The similarity of node embeddings is used to discover community structures in the network, that is, nodes with highly similar characteristics are clustered into the same community.

[0109] (S3): After obtaining the low-dimensional vector representation of each node in the social network, the community structure in the network is discovered based on the positional relationship of each node embedding vector.

[0110] To further explain, this step maps all node vectors into a common vector space. Within this vector space, a clustering algorithm (such as K-means) is used to cluster node vectors based on their relative positions. Because the node vectors learned using graph neural networks retain information about the network structure, similar nodes are assigned vectors that are closer together.

[0111] When performing K-means clustering, node vectors with similar positions will be clustered into the same class / cluster.

[0112] Finally, nodes in the same cluster are labeled as belonging to a community. Clusters formed by clustering may not represent the actual community structure of the network, but the nodes within a cluster are highly similar and may represent a potential gang. By observing the specific attributes of nodes within different clusters, it can be determined that some clusters may correspond to certain gangs.

[0113] (S4): Filter and adjust the clustering results based on the economic and sociological characteristics of the nodes.

[0114] Clustering results based solely on node vectors may not accurately reflect the true group structure in the network, as vector similarity cannot fully capture the multidimensional characteristics of nodes that represent complex social relationships. To improve the interpretability of the results, we further filter and adjust the clustering results based on the economic and sociological characteristics of the nodes.

[0115] Specifically, it is necessary to identify statistical data such as the age distribution and income level distribution of nodes within each cluster. If the income levels of nodes within a cluster are highly consistent, then these nodes with similar economic characteristics are likely to belong to the same gang. However, if the age differences within a cluster are significant, for example, if there are both teenagers and middle-aged people, then these nodes of different age groups are unlikely to belong to the same gang. This knowledge, combined with the node feature distribution within each cluster, is used to filter the clustering results. Clusters whose node characteristics do not conform to common gang characteristics are filtered out. Clusters with age differences but similar other characteristics are then split into multiple gangs. By incorporating knowledge of the sociological and economic attributes of the nodes as constraints and guidance in this step, the results can be adjusted and optimized based on vector clustering, making the final output of gang divisions more realistic and improving the interpretability of the results.

[0116] (S5): Use network analysis indicators to assess the closeness of the gang.

[0117] After identifying potential groups within a social network, we need to assess the closeness between members within each group to determine their effectiveness. This step uses network analysis metrics, such as intra-group connection density and clustering coefficient, to assess the closeness between members within each group.

[0118] The connection density here can directly reflect the strength of the mutual connections and constraints between gang members, while the clustering coefficient can measure the local clustering effect of nodes.

[0119] This step calculates the average connection density and clustering coefficient for each group. Higher values ​​indicate a tighter internal structure within the group. This helps to more accurately understand the interactions and dynamic evolution between groups. In short, using network analysis metrics such as connection density and clustering coefficient, and considering group overlap, can provide a richer and more comprehensive understanding of the group structure and characteristics within social networks.

[0120] It should be noted here that the first five steps are sequential steps, and the previous step is a prerequisite for the subsequent steps.

[0121] (S6): The gang structure obtained in step (5) is placed on the intelligence sharing platform, and the gang model is identified through the platform identification module. If the result is identified as a criminal gang, the gang structure is stored in the gang data set as a sample for continued learning, and the identification result is fed back; if the result identifies a non-criminal gang, it is stored in the platform for manual identification and appraisal. If the identification result is a criminal gang, the data is stored in the sample library for continued training, and the result is returned; otherwise, the data is discarded and the result is returned.

[0122] In addition, experts will review groups with unclear confidence levels. Experts will make judgments based on various clues, store positive samples determined by humans and models into the data set, and regularly use new samples to incrementally train the model. Based on feedback, the model's recognition performance will be continuously improved, group characteristics will be updated, and the model structure and parameters will be adjusted.

[0123] As can be seen from the above, the solution of the present invention can effectively discover and identify gang organizations in social networks by combining the graph calculation method of node attributes and network topology structure and using the intelligence sharing platform.

[0124] An embodiment of the present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the program implements the implementation steps of the above-mentioned method for identifying fraud-related gang events based on intelligence sharing and graph computing.

[0125] An embodiment of the present invention further provides a processor, which is used to run a program, wherein when the program is running, the implementation steps of the above-mentioned method for identifying fraud-related gang events based on intelligence sharing and graph computing are executed.

[0126] An embodiment of the present invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and runnable on the processor. The program code is loaded and executed by the processor to implement the implementation steps of the above-mentioned method for identifying fraud gang events based on intelligence sharing and graph computing.

[0127] The present invention also provides a computer program product which, when executed on a data processing device, is suitable for executing the implementation steps of the above-mentioned method for identifying fraud-related gang events based on intelligence sharing and graph computing.

[0128] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0129] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0130] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0131] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products of the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0132] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0134] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0135] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0136] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0137] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0138] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0139] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A fraud gang incident identification system based on intelligence sharing and graph computing, characterized by: The fraud gang event identification system includes: An intelligence sharing platform that integrates multiple trained recognition models and establishes a model intelligence sharing system. It aggregates the diverse information of each model in real time, identifies uploaded gang models based on the trained recognition models, and analyzes the suspicious characteristics of the gang models. An event model based on graph computing is configured to interact with an intelligence sharing platform for data. The event model based on graph computing is configured to classify nodes based on a graph neural network, and to analyze based on economic and sociological characteristics, to construct a social network graph of the event, and further to identify overlapping group structures based on the social network graph, and transmit the result to the intelligence sharing platform.

2. The fraud gang event identification system based on intelligence sharing and graph computing according to claim 1 is characterized in that: The intelligence sharing platform is configured to manually label groups that have not been identified as suspicious, and store the labeling results in the knowledge graph module to continue training the model.

3. The fraud gang event identification system based on intelligence sharing and graph computing according to claim 1 or 2 is characterized in that: The intelligence sharing platform includes an intelligence sharing module, a knowledge graph module, an analysis and decision-making module, a manual annotation module, and an intelligence uploading module; The intelligence sharing module is configured to share the training model and the training data source and to perform data sharing. The intelligence sharing module can store the acquired data into the local knowledge graph library for model training; The knowledge graph module interacts with the intelligence sharing module for data storage, stores the gang relationship knowledge graph, and repeatedly trains the recognition model; The analysis and decision module is configured to interact with the knowledge graph module and the manual annotation module for data, and can perform artificial intelligence recognition on the graph data obtained by forensic collection by calling the recognition model trained by the knowledge graph module, and put the unsuccessfully recognized data into the manual annotation module; The manual annotation module is configured to allow the user to manually modify the recognition results, and after the modification is completed, the data is put into the knowledge graph to continue model training; The intelligence uploading module is configured to interact with the knowledge graph module for data, and is capable of receiving the graph data model obtained through forensics and storing it in the knowledge graph module, and analyzing the uploaded graph data through the analysis and decision module.

4. The fraud gang event identification system based on intelligence sharing and graph computing according to claim 3 is characterized in that: The intelligence sharing platform automatically matches the optimal model and simultaneously calls multi-model aggregation to form a model evaluation group.

5. The fraud gang event identification system based on intelligence sharing and graph computing according to claim 4 is characterized in that: The model evaluation group uses multiple models to predict each data point, and the prediction of each model is configured as a "vote", and the prediction obtained by the majority of models is used as the final prediction result.

6. The fraud gang event identification system based on intelligence sharing and graph computing according to claim 1 is characterized in that: The event model based on graph computing includes an event collection unit, an event relationship extraction unit, and an event analysis unit; The event collection unit is configured to organize the data obtained by forensics into an entity-action-context structure; The event relationship extraction unit is configured to extract event elements and their relationships from the unstructured text obtained by evidence collection and construct a structured event representation; The event analysis unit is configured to analyze the association between event entities on the knowledge graph, extract the logical relationship between events, and use a graph computing algorithm to implement event association analysis.

7. A method for identifying fraud gangs based on intelligence sharing and graph computing, characterized in that: The recognition method first uses a node embedding algorithm to learn a low-dimensional feature vector for each node, so that nodes with similar features are mapped to similar positions in the vector space; Then, a clustering algorithm is used in the vector space to discover the community structure in the network based on the clustering of node vectors. Next, the clustering results are filtered and adjusted according to the economic and sociological characteristics of the nodes; Next, the closeness of the gang is further assessed based on network analysis indicators; Next, track the relationships between gangs and identify the structure of overlapping gangs; Finally, the obtained gang structure is placed in the intelligence sharing platform, and the gang model is identified through the platform identification module.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by the processor, the steps of implementing the method for identifying fraud gang events based on intelligence sharing and graph computing described in claim 7 are implemented.

9. A terminal device comprising a processor, a memory, and a program stored in the memory and executable on the processor, characterized in that: The program code is loaded and executed by the processor to implement the implementation steps of the method for identifying fraud-related gang events based on intelligence sharing and graph computing as described in claim 7.

10. A computer program product, characterized in that When executed on a data processing device, it is suitable for executing the implementation steps of the method for identifying fraud-related gang events based on intelligence sharing and graph computing as described in claim 7.

Images