Method for processing violation behavior in data circulation and transaction, device, and computer storage medium

Abstract

The present application relates to the technical field of big data and large models, and provides a method for processing a violation behavior in a data circulation and transaction. The method comprises: on the basis of a legal document related to historical violation behaviors in a data circulation and transaction, constructing an evidence chain corresponding to the type to which each historical violation behavior belongs; by means of a process of monitoring a target data circulation and transaction, predicting the type of a violation behavior to which the target data circulation and transaction belongs; on the basis of the type of the violation behavior to which the target data circulation and transaction belongs and the evidence chain corresponding to the type to which the historical violation behavior belongs, determining an evidence type associated with evidence of the target data circulation and transaction; constructing an evidence chain of the target data circulation and transaction on the basis of the evidence type associated with the evidence of the target data circulation and transaction; and calculating a violation weight on the basis of the evidence chain of the target data circulation and transaction, and comparing the violation weight with a violation weight calculated from the evidence chain of the historical violation behavior having the same violation behavior type, thereby determining whether the target data circulation and transaction constitutes a violation. The technical solution of the present application can effectively determine and trace violation behaviors in a data circulation and transaction process.

Description

Data flow transaction violation behavior processing method, device and computer storage medium TECHNICAL FIELD

[0001] The present application relates to the technical field of big data and big models, and particularly relates to a data flow transaction violation behavior processing method, device and computer storage medium. BACKGROUND

[0002] Data, as the fifth production factor together with land, capital, technology and labor, contains great value, and data flow transaction is the key to releasing the value of data factors as production factors. During the data flow transaction process, there may be many violation risks, such as misuse by data demanders, secondary sale of data, collusion between data buyers and sellers for money laundering, and inconsistency between the information registered and published and the actual data content, etc. Therefore, it is necessary to determine and trace the violation behaviors in the data flow transaction process.

[0003] At present, the industry has proposed many schemes for monitoring the violation behaviors in the data flow transaction process. However, these schemes either cannot quickly and accurately identify potential violation behaviors in the transaction due to the large number of violation behaviors in the data flow transaction process, or cannot trace all relevant evidence of the violation behaviors to construct a violation scene and reconstruct the violation behaviors due to the large number of complex operations in the data flow transaction process, each of which produces a lot of evidence.

[0004] SUMMARY

[0005] The present application provides a data flow transaction violation behavior processing method, device and computer storage medium, which can effectively determine and trace the violation behaviors in the data flow transaction process.

[0006] In one aspect, the present application provides a data flow transaction violation behavior processing method, which comprises:

[0007] Based on historical violation behavior related legal documents of data flow transaction, an evidence chain corresponding to each type of historical violation behavior is constructed;

[0008] By monitoring the process of a target data flow transaction, the type of violation behavior to which the target data flow transaction belongs is predicted;

[0009] According to the type of violation behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical violation behavior with the same type of violation behavior, the evidence type to which the evidence of the target data flow transaction is associated is determined;

[0010] According to the evidence type to which the evidence of the target data flow transaction is associated, an evidence chain of the target data flow transaction is constructed;

[0011] According to the violation weight of the target data flow transaction calculated based on the evidence chain of the target data flow transaction and the violation weight of the historical violation behavior calculated based on the evidence chain of the historical violation behavior, it is determined whether the target data flow transaction is in violation.

[0012] In another aspect, the present application provides a data flow transaction violation behavior processing device, the device comprising:

[0013] A first chain building module is configured to build an evidence chain corresponding to a type of each historical violation behavior based on historical violation behavior related legal documents of a data flow transaction;

[0014] A prediction module is configured to predict a type of a violation behavior to which a target data flow transaction belongs by monitoring a process of the target data flow transaction;

[0015] A first determination module is configured to determine an evidence type to which evidence of the target data flow transaction is associated according to the type of the violation behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical violation behavior with the same type of violation behavior;

[0016] A second chain building module is configured to build an evidence chain of the target data flow transaction according to the evidence type to which the evidence of the target data flow transaction is associated;

[0017] A second determination module is configured to determine whether the target data flow transaction is in violation according to the violation weight of the target data flow transaction calculated based on the evidence chain of the target data flow transaction and the violation weight of the historical violation behavior calculated based on the evidence chain of the historical violation behavior.

[0018] In a third aspect, the present application provides a device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the technical solution of the data flow transaction violation behavior processing method as described above when executing the computer program.

[0019] In a fourth aspect, the present application provides a computer storage medium, which stores a computer program, and the computer program implements the steps of the technical solution of the data flow transaction violation behavior processing method as described above when executed by a processor.

[0020] From the technical solution provided in the application, based on the historical illegal behavior related legal documents of data flow transaction, the evidence chain corresponding to the type of each historical illegal behavior is constructed. Since the historical illegal behavior related legal documents of data flow transaction are in a state of updating at any time or at a fixed time, the evidence chain of the illegal behavior of data flow transaction can be dynamically updated, so that the subsequent judgment of the illegal behavior of data flow transaction based on this has the latest basis, and the correctness of the judgment of the illegal behavior of data flow transaction is improved. On the one hand, by monitoring the process of the target data flow transaction, the type of the illegal behavior to which the target data flow transaction belongs is predicted, which can improve the efficiency of the subsequent judgment and tracing of the illegal behavior of the target data flow transaction; on the other hand, based on the type of the illegal behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical illegal behavior with the same illegal behavior type, the evidence chain of the target data flow transaction is constructed, the illegal weight is calculated according to the evidence chain of the target data flow transaction and compared with the illegal weight calculated from the evidence chain of the historical illegal behavior with the same illegal behavior type, and whether the target data flow transaction is illegal is determined, so as to realize the judgment and tracing of the illegal behavior. In summary, compared with the prior art, the technical solution of the application can effectively judge and trace the illegal behavior in the process of data flow transaction. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Fig. 1 is a flowchart of a data flow transaction illegal behavior processing method provided by an embodiment of the application;

[0023] Fig. 2 is a schematic diagram of an illegal behavior evidence chain provided by an embodiment of the application;

[0024] Fig. 3 is a structural schematic diagram of a data flow transaction illegal behavior processing device provided by an embodiment of the application;

[0025] Fig. 4 is a structural schematic diagram of an electronic device provided by an embodiment of the application. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the application will be described clearly and completely in combination with the drawings in the embodiments of the application. Obviously, the described embodiments are only some of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0027] In this specification, adjectives such as first and second can be used merely to distinguish one element or action from another without necessarily requiring or implying any actual such relationship or order. References to elements or components or steps (etc.) in the environment should not be construed as limiting the scope of the claims to only elements, components, or steps in the environment, but can be one or more elements, components, or steps in the environment.

[0028] In this specification, the sizes of the respective parts shown in the drawings can not be drawn to scale in order to emphasize certain features of the drawings.

[0029] There are many risks of violations in the process of data circulation transaction, such as abuse by data demanders, reselling data, collusion between data buyers and sellers for money laundering, and inconsistency between the information registered and published and the actual data content, etc. At present, although the industry has proposed many schemes for monitoring the violations in the process of data circulation transaction, these schemes either cannot quickly and accurately identify potential violations in the transaction due to the large number of types of violations in the process of data circulation transaction, or cannot trace all relevant evidence of the violations to build a violation scene and reconstruct the violations due to the large number of complex operations involved in the process of data circulation transaction, each of which produces a lot of evidence.

[0030] In view of the above problems of the prior art, the present application proposes a data circulation transaction violation processing method, the flow chart of which is shown in FIG. 1, mainly including steps S101 to S105, which are described in detail as follows:

[0031] Step S101: Based on the historical violation-related legal documents of data circulation transaction, an evidence chain corresponding to each type of historical violation is constructed.

[0032] The existing violation evidence chain construction scheme requires professionals to spend a lot of time and effort to extract entities and relationships related to violations from legal documents. Since the historical violation-related legal documents of data circulation transaction are in a state of updating at any time or at a fixed time, the present application proposes to construct an evidence chain corresponding to each type of historical violation based on the historical violation-related legal documents of data circulation transaction, which can dynamically update the evidence chain of the violation of data circulation transaction, so that the subsequent judgment of the violation of data circulation transaction based on it has the latest basis, and improves the correctness of the judgment of the violation of data circulation transaction. As an embodiment of the present application, the construction of an evidence chain corresponding to each type of historical violation based on the historical violation-related legal documents of data circulation transaction can be realized through steps S1011 to S1013, which are described in detail as follows:

[0033] Step S1011: Constructing the entity relation triplets <e p , r pq , e q > facing the violation behavior, the prior relation topology triplets <r p , s pq , r q > and the relation topology triplets <r p , s pq , r q > based on the prior relation topology to make the labeled dataset containing the entity relation triplets <e p , r pq , e q >, wherein r pq is a possible violation operation of the violation behavior, e p is an execution subject of r pq , e q is evidence generated by executing r pq , and r p and r q are two violation operations with the relation s pq .

[0034] In the embodiments of the present application, the violation operation generally refers to a specific behavior, action or process, i.e., a specific behavior implemented by a person or entity. For example, specific behaviors such as illegal access to data, tampering with records, etc. in a system can be referred to as “violation operation”. In contrast to the violation operation, the violation behavior is a more extensive concept, which may include the motivation, background and result of the operation, in other words, the violation behavior not only includes specific operations, but also the overall background and impact of these operations, for example, “an employee of a certain data trading platform accesses the company database without authorization, downloads customer data, and causes data leakage.” is a “violation behavior” because it involves the motivation and result of the operation.

[0035] The entity relation triplets <e p , r pq , e q > facing the violation behavior include e p , r pq and e q , wherein r pq is a possible violation operation of the violation behavior, e p is an execution subject of r pq , and e q is evidence generated by executing r pq . Taking the violation behavior “an employee of a certain data trading platform accesses the company database without authorization, downloads customer data, and causes data leakage.” as an example, “an employee of a certain data trading platform” is the execution subject e pq of r p"Unauthorized access to the company database" is a violation. pq "Customer data" is for execution r pq The evidence produced e q Relational topology triples <r p s pq r q In the context of relation s pq It is r p and r q There exists a specific connection or dependency between them, including causal relationships, logical relationships, temporal relationships, etc. Taking the violation of "an employee of a data trading platform accessing the company database without authorization and downloading customer data, resulting in data leakage" as an example, "unauthorized access to the company database" and "downloading customer data" are the violations in this case. p and r q Because "unauthorized access to the company database" is a violation. q A prerequisite or precondition is that "customer data has been downloaded" only after the operation of accessing the company's database is completed. q This violation could only occur because of s pq Describes r p and r q This causal or dependent relationship between the two.

[0036] Step S1012: Include triples containing entity relations <e p r pq e q The labeled dataset is input into the preset model to train the preset model, resulting in a trained language model.

[0037] To avoid error propagation caused by identifying entities before predicting relationships, this application uses a Seq2Seq-based model as its default model. This model can identify triples containing entity relationships. <e p r pq e q The labeled dataset is input to the Seq2Seq-based model, and the Seq2Seq-based model is trained to obtain a trained language model. The specific training method can be any existing method, and this application does not limit it.

[0038] Step S1013: Using the trained language model and by querying relevant legal documents of historical violations, construct the evidence chain corresponding to the type of each historical violation.

[0039] In the embodiments of the present application, the historical illegal behavior related legal documents can be historical illegal behavior related legal documents in the public database, such as the data in the database of China Judgments Documents Net and the like. Specifically, the evidence chain corresponding to each type of historical illegal behavior can be constructed by the following steps S1 to S3 through the query of the historical illegal behavior related legal documents by using the trained language model:

[0040] Step S1: According to the type of illegal behavior, the illegal behavior related fact text is queried in the database of historical illegal behavior related legal documents.

[0041] As described above, the database of historical illegal behavior related legal documents can be a public database such as China Judgments Documents Net. If the database stores the related data in the key-value storage mode, the illegal behavior related fact text can be queried by using the type of illegal behavior as the key.

[0042] Step S2: The illegal behavior related fact text queried in the database of historical illegal behavior related legal documents is input into the trained language model to identify the relationship between the named entity and the operation, and output the entity relationship triple <e i , r ij , e j >, wherein r ij is a possible illegal operation of a certain type of illegal behavior, e i is the subject of r ij , and e j is the evidence generated by executing r ij .

[0043] As described above, since the trained language model is trained by using the preset model (for example, a model based on Seq2Seq) on the annotated data set containing the entity relationship triple <e p , r pq , e q > made based on the prior relationship topology triple <r p , s pq , r q >, the illegal behavior related fact text queried in the database of historical illegal behavior related legal documents is input into the trained language model, and the entity relationship triple <e i , r ij , e j > is output by identifying the named entity and extracting the relationship between the operations, wherein r ij is a possible illegal operation of a certain type of illegal behavior, e i is the subject of r ij , and e j is the evidence generated by executing r ij ​The evidence generated.

[0044] Step S3: taking the entity relationship triple <e i , r ij , e j > as a node, querying whether there is an entity relationship triple with the operation r ij from the result of the current case document according to the prior relationship topology triple <r pq , s, r pq >, if there is, establishing an edge between the two nodes to form the evidence chain of the historical violation behavior, wherein r ij and r pq are two operations with the relationship s.

[0045] If the entity relationship triple with the operation r j is queried to exist in the result of the current case document, it is likely that there is an evidence chain with the link <r m , s mj , r j > as a link, therefore, an edge <r m , s mj , r j > is established between the two nodes, which is convenient for violation behavior tracing when determining, and finally forms the evidence chain of the violation behavior, wherein r m and r j are two operations with the relationship s mj , and here r m may be the same or different operation as r i .

[0046] Considering that the weight assignment of the evidence chain is very important for the determination of the violation behavior, the weights of different nodes and edges reflect their importance and credibility in the historical case, which is conducive to assisting the decision maker to make more reasonable violation behavior governance decisions. Therefore, when the edge between the two nodes is established to form the evidence chain of the historical violation behavior, it can be specifically: investigating the number of times count that the edge between the two nodes r m and r j appears in all evidence chains with the same violation behavior type and the total number N of nodes and edges in all evidence chains with the same violation behavior type; calculating count / N, and assigning count / N as a weight to the edge between the two nodes r m and r j to construct the evidence chain of the historical violation behavior. Taking the two evidence chains with the same violation behavior type in FIG. 2 as an example, assuming that node 4 (the circle with the label 4) and node 7 (the circle with the label 7) are the edges to be established (denoted as e 47 , i.e.

[0047] e47 = <r4, s 47 , r7>) are two nodes, if a chain of evidence is represented by the direction of the arrow, the number of times it appears in the two chains of evidence shown in the figure is 2, that is, count = 2, and the total number of times all nodes and edges to be established appear in all chains of evidence is 20, that is, N = 20, then the weight w 47 of the edge e 47 is 2 / 20, that is, w 47 = 0.1. The calculation method of the weight of the node in the chain of evidence is similar to that of the weight of the edge, that is, the ratio of the number of times any node appears in all chains of evidence with the same type of violation behavior to the total number of nodes and edges in all chains of evidence with the same type of violation behavior.

[0048] Step S102: predicting the type of violation behavior to which the target data flow transaction belongs by monitoring the process of the target data flow transaction.

[0049] In the process of data flow transaction, if the judgment of violation behavior depends on manual investigation and evidence collection before and after the data flow transaction, and the judgment of violation behavior is completed according to the obtained evidence, it is not only time-consuming and laborious but also prone to errors. In order to solve this problem, the present application obtains the evidence of several types of historical violation behaviors similar to the data flow transaction according to the evidence information involved in the data flow transaction, and uses a large language model (Large Language Model, LLM) to predict the type of violation behavior corresponding to the current transaction according to the evidence of the historical violation behavior obtained. Specifically, the prediction of the type of violation behavior to which the target data flow transaction belongs can be realized by steps S1021 to S1024 by monitoring the process of the target data flow transaction, and the details are as follows:

[0050] Step S1021: collecting evidence information of the target data flow transaction.

[0051] In the embodiments of the present application, the target data is the object of a certain operation, and the certain operation needs to be determined whether it is in violation and traceable in the future. The evidence information of the target data circulation transaction will be used as the basis for determining the violation of the target data. In collecting the evidence information of the target data circulation transaction, it is generally collected automatically through monitoring the data element circulation transaction market, or the evidence provided by the user upon request for audit. Considering that the collected evidence information of the data circulation transaction is often too broad, for example, the evidence collected each time the data circulation transaction is a text containing more than a certain number (for example, 2000) of characters, which is less readable, and these contents will introduce noise to the violation determination and increase the difficulty of violation determination. Therefore, in the embodiments of the present application, when collecting the evidence information of the target data circulation transaction, the LLM is used to summarize the evidence information collected in the previous stage, i.e., the related evidence of the target data circulation transaction being monitored at present. Based on the summary of the evidence information collected in the previous stage, the original or initially collected evidence information of the target data circulation transaction is summarized without losing the original intention, and is summarized into a text of a predetermined number (for example, 100-200) of characters. In this way, the evidence information of the target data circulation transaction after summarization is more concise and informative, reduces the noise introduced by the violation determination, and increases the difficulty of the violation determination.

[0052] Step S1022: mapping the evidence information of the target data circulation transaction to a digital vector space to obtain a corresponding vector of the evidence information of the target data circulation transaction.

[0053] When mapping the evidence information of the target data circulation transaction to a digital vector space, the historical violation neighbor search operation can be used to map the evidence information of the target data circulation transaction to a digital vector space through an embedding layer to obtain a corresponding vector of the evidence information of the target data circulation transaction. Considering that the FastText model is not sensitive to the length of the text input and can generate a dense matrix, which is convenient for calculating the Euclidean distance between similar vectors, when mapping the evidence information of the target data circulation transaction (which can be the evidence information summarized through the foregoing example) to a digital vector space through an embedding layer, the FastText model is used as an embedding model. It should be noted that since the downstream task is to predict the type of the violation behavior involved in the data circulation transaction, in the embodiments of the present application, the evidence information of the historical data circulation transaction can be used to train the FastText model and other embedding models.

[0054] Step S1023: calculating the similarity between the corresponding vector of the evidence information of the target data circulation transaction and the corresponding vector of the evidence information of the historical violation behavior to obtain K types of historical violation behaviors similar to the target data circulation transaction, wherein K is a natural number greater than 1.

[0055] Step S1024: predicting the possible violation type of the target data flow transaction according to K types of historical violation behaviors similar to the target data flow transaction and the types of evidence information of the K types of historical violation behaviors, by the large language model.

[0056] Specifically, the LLM can infer the evidence information of the target data flow transaction, the K types of historical violation behaviors similar to the target data flow transaction, and their evidence information according to the prompt word (prompt), and finally predict the possible violation type of the target data flow transaction, which is used for further determination by the subsequent violation behavior judgment and tracing function module.

[0057] Step S103: determining the evidence type associated with the evidence of the target data flow transaction according to the type of the violation behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical violation behavior with the same type of violation behavior.

[0058] Specifically, the implementation of step S103 can be: according to the type of the violation behavior to which the target data flow transaction belongs, searching for the corresponding violation behavior of the target data flow transaction in the historical violation behaviors of the data flow transaction, i.e., the violation behavior with the same type of violation behavior; taking the corresponding node in the evidence chain of the corresponding violation behavior of the target data flow transaction as the starting point, traversing all nodes connected to the corresponding node; obtaining the evidence related information and weight of all nodes connected to the corresponding node and the information and weight of the connected edges, and determining the evidence type associated with the evidence of the target data flow transaction according to the operation in the connected nodes.

[0059] Step S104: constructing the evidence chain of the target data flow transaction according to the evidence type associated with the evidence of the target data flow transaction.

[0060] Specifically, constructing the evidence chain of the target data flow transaction according to the evidence type associated with the evidence of the target data flow transaction can be achieved by the following steps S1041 to S1044:

[0061] Step S1041: collecting all evidence associated with the evidence of the target data flow transaction from the data flow transaction platform according to the evidence type associated with the evidence of the target data flow transaction.

[0062] Step S1042: investigating the relationship between the target evidence, and confirming whether the relationship between the target evidence is consistent with the relationship between any two evidences in the evidence chain of the historical violation behavior, wherein the target evidence is any two to-be-connected evidences collected from the data flow transaction platform.

[0063] It should be noted that any two pieces of evidence to be linked among all the evidence related to the target data circulation transaction collected from the data circulation and trading platform, one of which is the currently collected evidence and the other is the previously acquired evidence.

[0064] Step S1043: If there is a relationship between the target evidence and two pieces of evidence in the evidence chain of historical violations, then connect the target evidence to construct a link in the evidence chain of the target data circulation transaction.

[0065] In this embodiment, the relationship between any two pieces of evidence in the evidence chain of historical violations can be represented by the relational topology triplet mentioned in the aforementioned embodiment for constructing the evidence chain corresponding to each type of historical violation. <r i s ij r j >s ij Therefore, if the target evidence exists, operation r... i and r j Furthermore, a relational topological triple exists in the evidence chain of historical violations with the same type of violation. <r i s ij r j >, then the target evidence should have a relationship between two pieces of evidence in the evidence chain that conforms to the historical violation, thus connecting the target evidence (i.e., operation r) i and r j The corresponding entity relationship triple is used to construct a link in the evidence chain for the circulation and transaction of target data.

[0066] Step S1044: Repeat steps S1042 and S1043 until all evidence associated with the target data circulation transaction has been examined.

[0067] Step S105: Determine whether the target data circulation transaction is illegal based on the violation weight of the target data circulation transaction calculated from the evidence chain of the target data circulation transaction and the violation weight of the historical violation calculated from the evidence chain of the historical violation.

[0068] Step S104 illustrates the process of constructing a link in the evidence chain of the target data circulation transaction. Using a similar method, after constructing the complete evidence chain of the target data circulation transaction, the weights of all nodes and edges in the evidence chain are summed to obtain the violation weight of the target data circulation transaction. Then, the violation weight of the target data circulation transaction is compared with the violation weights of all historical violations of the same violation type. If the violation weight of the target data circulation transaction is greater than or equal to the minimum violation weight of historical violations of the same violation type, then the target data circulation transaction is determined to be in violation.

[0069] From the data flow transaction violation behavior processing method shown in the above Figure 1 example, based on the historical violation behavior related legal documents of the data flow transaction, the evidence chain corresponding to the type of each historical violation behavior is constructed. Since the historical violation behavior related legal documents of the data flow transaction are in a state of updating at any time or at a fixed time, the evidence chain of the violation behavior of the data flow transaction can be dynamically updated, so that the subsequent judgment of the violation behavior of the data flow transaction based on this has the latest basis, and the correctness of the judgment of the violation behavior of the data flow transaction is improved. On the one hand, by monitoring the process of the target data flow transaction, the type of the violation behavior to which the target data flow transaction belongs can be predicted, which can improve the efficiency of the judgment and tracing of the violation behavior of the target data flow transaction; on the other hand, based on the type of the violation behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical violation behavior with the same type of violation behavior, the evidence chain of the target data flow transaction is constructed, the violation weight is calculated according to the evidence chain of the target data flow transaction and compared with the violation weight calculated from the evidence chain of the historical violation behavior with the same type of violation behavior, and whether the target data flow transaction violates the rules is determined, so as to realize the judgment and tracing of the violation behavior. In summary, compared with the prior art, the technical scheme of the present application can effectively judge and trace the violation behavior in the process of data flow transaction.

[0070] Please refer to Figure 3, which is a data flow transaction violation behavior processing device provided by an embodiment of the present application. The device can include a first chain building module 301, a prediction module 302, a first determination module 303, a second chain building module 304 and a second determination module 305, which are described in detail as follows:

[0071] The first chain building module 301 is configured to construct an evidence chain corresponding to the type of each historical violation behavior based on historical violation behavior related legal documents of the data flow transaction.

[0072] The prediction module 302 is configured to predict the type of the violation behavior to which the target data flow transaction belongs by monitoring the process of the target data flow transaction.

[0073] The first determination module 303 is configured to determine the evidence type associated with the evidence of the target data flow transaction according to the type of the violation behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical violation behavior with the same type of violation behavior.

[0074] The second chain building module 304 is configured to construct the evidence chain of the target data flow transaction according to the evidence type associated with the evidence of the target data flow transaction.

[0075] The second determination module 305 is configured to determine whether the target data flow transaction is illegal according to the illegal weight of the target data flow transaction calculated based on the evidence chain of the historical illegal behavior and the illegal weight of the historical illegal behavior calculated based on the evidence chain of the historical illegal behavior.

[0076] As can be seen from the data flow transaction illegal behavior processing apparatus in the above-described FIG. 3 example, the evidence chain corresponding to the type of each historical illegal behavior is constructed based on the historical illegal behavior related legal documents of the data flow transaction. Since the historical illegal behavior related legal documents of the data flow transaction are in a state of being updated at any time or at a fixed time, the evidence chain of the illegal behavior of the data flow transaction can be dynamically updated, so that the subsequent determination of the illegal behavior of the data flow transaction based thereon has the latest basis, and the correctness of the determination of the illegal behavior of the data flow transaction is improved. On the one hand, by monitoring the process of the target data flow transaction, the type of the illegal behavior to which the target data flow transaction belongs can be predicted, so that the efficiency of the subsequent determination and tracing of the illegal behavior of the target data flow transaction is improved. On the other hand, based on the type of the illegal behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical illegal behavior with the same illegal behavior type, the evidence chain of the target data flow transaction is constructed, the illegal weight is calculated according to the evidence chain of the target data flow transaction and compared with the illegal weight calculated based on the evidence chain of the historical illegal behavior with the same illegal behavior type, and it is determined whether the target data flow transaction is illegal, so as to realize the determination and tracing of the illegal behavior. In summary, compared with the prior art, the technical scheme of the present application can effectively determine and trace the illegal behavior in the process of the data flow transaction.

[0077] FIG. 4 is a structural schematic diagram of an apparatus according to an embodiment of the present application. As shown in FIG. 4, the apparatus 4 of this embodiment mainly includes a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and executable on the processor 40, for example, a program of the data flow transaction illegal behavior processing method. The processor 40 implements the steps in the above-described data flow transaction illegal behavior processing method embodiments when executing the computer program 42, for example, the steps S101-S105 shown in FIG. 1. Alternatively, the processor 40 implements the functions of the modules / units in the above-described various apparatus embodiments when executing the computer program 42, for example, the functions of the first chain building module 301, the prediction module 302, the first determination module 303, the second chain building module 304, and the second determination module 305 shown in FIG. 3.

[0078] Exemplarily, the computer program 42 of the data flow transaction violation behavior processing method mainly includes: constructing an evidence chain corresponding to a type of each historical violation behavior based on historical violation behavior related legal documents of the data flow transaction; predicting a type of a violation behavior to which a target data flow transaction belongs by monitoring a process of the target data flow transaction; determining an evidence type to which evidence of the target data flow transaction is associated according to the type of the violation behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical violation behavior of the same type of violation behavior; constructing an evidence chain of the target data flow transaction according to the evidence type to which the evidence of the target data flow transaction is associated; and determining whether the target data flow transaction is in violation according to a violation weight of the target data flow transaction calculated according to the evidence chain of the target data flow transaction and a violation weight of the historical violation behavior calculated according to the evidence chain of the historical violation behavior. The computer program 42 can be divided into one or more modules / units, one or more modules / units are stored in the memory 41 and executed by the processor 40 to complete the present application. One or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe an execution process of the computer program 42 in the device 4. For example, the computer program 42 can be divided into the functions of the first chain construction module 301, the prediction module 302, the first determination module 303, the second chain construction module 304 and the second determination module 305 (modules in a virtual device), and specific functions of each module are as follows: the first chain construction module 301 is configured to construct an evidence chain corresponding to a type of each historical violation behavior based on historical violation behavior related legal documents of the data flow transaction; the prediction module 302 is configured to predict a type of a violation behavior to which a target data flow transaction belongs by monitoring a process of the target data flow transaction; the determination module 303 is configured to determine an evidence type to which evidence of the target data flow transaction is associated according to the type of the violation behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical violation behavior of the same type of violation behavior; the second chain construction module 304 is configured to construct an evidence chain of the target data flow transaction according to the evidence type to which the evidence of the target data flow transaction is associated; and the determination module 305 is configured to determine whether the target data flow transaction is in violation according to a violation weight calculated according to the evidence chain of the target data flow transaction and a violation weight calculated according to the evidence chain of the historical violation behavior of the same type of violation behavior.

[0079] The device 4 can include but is not limited to the processor 40 and the memory 41. Those skilled in the art can understand that FIG. 4 is only an example of the device 4 and does not constitute a limitation on the device 4, and can include more or fewer components than those shown, or combine certain components, or different components, for example, the computing device can also include an input / output device, a network access device, a bus, etc.

[0080] The processor 40 can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0081] The memory 41 can be an internal storage unit of the device 4, such as a hard disk or an internal memory of the device 4. The memory 41 can also be an external storage device of the device 4, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory 41 can include both the internal storage unit and the external storage device of the device 4. The memory 41 is used to store computer programs and other programs and data required by the device. The memory 41 can also be used to temporarily store data that has been output or is to be output.

[0082] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional units and modules is exemplified, and in actual application, the above functions can be completed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to complete all or part of the above described functions. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit, and the integrated unit can be realized in the form of hardware or in the form of software functional unit. In addition, the specific names of each functional unit and module are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the units and modules in the apparatus can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0083] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0084] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0085] In the embodiments provided in the present application, it should be understood that the disclosed apparatuses / devices and methods can be implemented in other ways. For example, the above-described apparatus / device embodiments are merely illustrative, for example, the division of modules or units is merely a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0086] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0087] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0088] The integrated modules / units, if implemented in the form of software functional units and sold or used as independent products, can be stored in a computer storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program of the data flow transaction irregular behavior processing method can be stored in a computer storage medium. When the computer program is executed by a processor, the steps of each method embodiment can be implemented, that is, based on the historical irregular behavior related legal documents of the data flow transaction, the evidence chain corresponding to each type of historical irregular behavior to which the historical irregular behavior belongs is constructed; the type of the irregular behavior to which the target data flow transaction belongs is predicted by monitoring the process of the target data flow transaction; the evidence type to which the evidence of the target data flow transaction is associated is determined according to the type of the irregular behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical irregular behavior of the same irregular behavior type; the evidence chain of the target data flow transaction is constructed according to the evidence type to which the evidence of the target data flow transaction is associated; and whether the target data flow transaction is irregular is determined according to the irregular weight of the target data flow transaction calculated from the evidence chain of the target data flow transaction and the irregular weight of the historical irregular behavior calculated from the evidence chain of the historical irregular behavior. The computer program includes computer program code, which can be in the form of source code, object code, executable file or some intermediate form, etc. The computer storage medium can include any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content included in the computer storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer storage medium does not include electric carrier signal and telecommunication signal.

[0089] The above examples are only used to illustrate the technical solutions of the present application, but not limit the same; although the present application has been described in detail with reference to the foregoing examples, those skilled in the art should understand that the technical solutions recorded in the foregoing examples can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for processing data flow transaction violation behavior, characterized in that, The method comprises: Based on the historical illegal behavior related legal documents of data flow transaction, the evidence chain corresponding to the type of each historical illegal behavior is constructed; By monitoring the process of the target data flow transaction, the type of the illegal behavior to which the target data flow transaction belongs is predicted; According to the type of the illegal behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical illegal behavior with the same illegal behavior type, the evidence type associated with the evidence of the target data flow transaction is determined; According to the evidence type associated with the evidence of the target data flow transaction, the evidence chain of the target data flow transaction is constructed; According to the illegal weight of the target data flow transaction calculated by the evidence chain of the target data flow transaction and the illegal weight of the historical illegal behavior calculated by the evidence chain of the historical illegal behavior, whether the target data flow transaction is illegal is determined.

2. The method of claim 1, wherein the data flow transaction violation is a read-after-write violation. The historical illegal behavior related legal documents based on data flow transaction are used to construct the evidence chain corresponding to the type of each historical illegal behavior, which comprises: Constructing entity relationship triplets <e p , r pq , e q > facing violations, prior relationship topology triplets <r p , s pq , r q >, and based on the prior relationship topology triplets <r p , s pq , r q > make a labeled dataset containing entity relationship triplets <e p , r pq , e q >, r pq is a possible violation operation of the violation, e p is the execution subject of r pq , e q is the evidence produced by executing r pq , r p and r q are two violation operations with relationship s pq ; The labeled data set is input into a preset model to train the preset model, and a trained language model is obtained; The trained language model is used to query the historical illegal behavior related legal documents, and the evidence chain corresponding to the type of each historical illegal behavior is constructed.

3. The method for handling violations of data circulation and transaction rules as described in claim 2, characterized in that, The trained language model is used to query the historical illegal behavior related legal documents, and the evidence chain corresponding to the type of each historical illegal behavior is constructed. According to the type of the illegal behavior, the illegal behavior related fact text is queried in the database of the historical illegal behavior related legal documents; input the fact text related to the violation behavior to the trained language model to identify the relationship between the named entity and the extraction operation, output an entity relationship triple <e i , r ij , e j >, wherein r ij is a possible violation operation of a certain type of violation behavior, e i is the execution subject of r ij , and e j is the evidence generated by executing r ij ; The entity relationship triple <e i , r ij , e j > is taken as a node, and whether there is an entity relationship triple with operation r pq is queried from the result of the current case document according to the prior relationship topology triple <r ij , s, r pq >, if there is, an edge between two nodes is established to form an evidence chain of historical illegal behavior, and r ij and r pq are two operations with the relationship s.

4. The method for handling violations of data circulation and transaction rules as described in claim 3, characterized in that, The edge between the two nodes is established to form the evidence chain of the historical illegal behavior, which comprises: r m and r j between the two nodes r of the edge to be established and the number of times count that the edge appears in all evidence chains with the same violation type and the total number N of nodes and edges in all evidence chains with the same violation type; count / N is calculated, and the count / N is assigned as a weight to the two nodes r m and r j between the edges to construct a chain of evidence of historical misbehavior.

5. The method for handling violations of data circulation and transaction rules as described in claim 1, characterized in that, The process of the target data flow transaction is monitored to predict the type of the illegal behavior to which the target data flow transaction belongs, which comprises: The evidence information of the target data flow transaction is collected; The evidence information of the target data flow transaction is mapped to a digital vector space to obtain a corresponding vector of the evidence information of the target data flow transaction; The similarity between the corresponding vector of the evidence information of the target data flow transaction and the corresponding vector of the evidence information of the historical illegal behavior is calculated to obtain K types of historical illegal behaviors similar to the target data flow transaction, wherein K is a natural number greater than 1; According to the K types of historical illegal behaviors similar to the target data flow transaction, the possible illegal type of the target data flow transaction is predicted by a large language model.

6. The method of claim 1, wherein the data flow transaction violation is a read after write violation. 5 According to the type of the illegal behavior to which the target data flow transaction belongs and the evidence chain corresponding to the historical illegal behavior with the same illegal behavior type, the evidence type associated with the evidence of the target data flow transaction is determined, which comprises: According to the type of the illegal behavior to which the target data flow transaction belongs, the corresponding illegal behavior of the historical illegal behavior of data flow transaction is found; Taking the corresponding node in the evidence chain of the corresponding illegal behavior of the target data flow transaction as the starting point, all nodes connected with the corresponding node are traversed; Obtaining all the evidence-related information and weights of the connected nodes of the corresponding node and the information and weights of the connected edges, and determining the evidence type of the evidence related to the target data circulation transaction according to the operation of the connected nodes.

7. The method for handling violations of data circulation and transaction rules as described in claim 1, characterized in that, The evidence chain of the target data circulation transaction is constructed according to the evidence type of the evidence related to the target data circulation transaction, which includes: Step S1: According to the evidence type of the evidence related to the target data circulation transaction, collecting all the evidence related to the target data circulation transaction from the data circulation transaction platform; Step S2: Investigating the relationship between the target evidence, and confirming whether the relationship between the target evidence is consistent with the relationship between any two evidences in the evidence chain of the historical illegal behavior, the target evidence being any two to-be-connected evidences among all the evidence related to the target data circulation transaction collected from the data circulation transaction platform; Step S3: If the target evidence has the relationship between the two evidences in the evidence chain of the historical illegal behavior, connecting the target evidence to construct a link in the evidence chain of the target data circulation transaction; Repeating steps S2 and S3 until all the evidence related to the target data circulation transaction is investigated. The device includes:

8. A data flow transaction violation handling apparatus, characterized by, A first chain construction module for constructing an evidence chain corresponding to each type of historical illegal behavior based on historical illegal behavior-related legal documents of data circulation transactions; A prediction module for predicting the type of illegal behavior to which the target data circulation transaction belongs by monitoring the process of the target data circulation transaction; A first determination module for determining the evidence type of the evidence related to the target data circulation transaction according to the type of illegal behavior to which the target data circulation transaction belongs and the evidence chain corresponding to the historical illegal behavior with the same type of illegal behavior; A second chain construction module for constructing the evidence chain of the target data circulation transaction according to the evidence type of the evidence related to the target data circulation transaction; A second determination module for determining whether the target data circulation transaction is illegal according to the illegal weight of the target data circulation transaction calculated from the evidence chain of the target data circulation transaction and the illegal weight of the historical illegal behavior calculated from the evidence chain of the historical illegal behavior. The processor executes the computer program to realize the steps of the method of any one of claims 1 to 7.

9. An electronic device, the device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The computer program is executed by the processor to realize the steps of the method of any one of claims 1 to 7.

10. A computer storage medium storing a computer program, the computer program comprising instructions, which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 9. ​

Images