CN110413707A - The excavation of clique's relationship is cheated in internet and checks method and its system - Google Patents
The excavation of clique's relationship is cheated in internet and checks method and its system Download PDFInfo
- Publication number
- CN110413707A CN110413707A CN201910660468.6A CN201910660468A CN110413707A CN 110413707 A CN110413707 A CN 110413707A CN 201910660468 A CN201910660468 A CN 201910660468A CN 110413707 A CN110413707 A CN 110413707A
- Authority
- CN
- China
- Prior art keywords
- clique
- relationship
- group
- excavation
- fraud
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 37
- 238000009412 basement excavation Methods 0.000 title claims abstract description 26
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 48
- 238000011835 investigation Methods 0.000 claims abstract description 23
- 239000000203 mixture Substances 0.000 claims abstract description 9
- 230000006399 behavior Effects 0.000 claims description 36
- 238000005516 engineering process Methods 0.000 claims description 10
- 238000004458 analytical method Methods 0.000 claims description 6
- 238000001514 detection method Methods 0.000 claims description 6
- 238000012545 processing Methods 0.000 claims description 6
- 238000004590 computer program Methods 0.000 claims description 5
- 238000003780 insertion Methods 0.000 claims description 5
- 230000037431 insertion Effects 0.000 claims description 5
- 238000003860 storage Methods 0.000 claims description 5
- 206010000117 Abnormal behaviour Diseases 0.000 claims description 4
- 230000008901 benefit Effects 0.000 claims description 4
- 238000011156 evaluation Methods 0.000 claims description 4
- 238000006116 polymerization reaction Methods 0.000 claims description 3
- 230000008859 change Effects 0.000 abstract description 3
- 238000013507 mapping Methods 0.000 abstract description 3
- 230000002265 prevention Effects 0.000 abstract description 2
- 238000012795 verification Methods 0.000 abstract description 2
- 230000007246 mechanism Effects 0.000 description 9
- 230000002776 aggregation Effects 0.000 description 5
- 238000004220 aggregation Methods 0.000 description 5
- 230000008569 process Effects 0.000 description 5
- 101100059544 Arabidopsis thaliana CDC5 gene Proteins 0.000 description 4
- 101150115300 MAC1 gene Proteins 0.000 description 4
- 238000011161 development Methods 0.000 description 4
- 238000010801 machine learning Methods 0.000 description 4
- 238000005065 mining Methods 0.000 description 4
- 239000013598 vector Substances 0.000 description 4
- 238000013135 deep learning Methods 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 238000012360 testing method Methods 0.000 description 3
- 238000009825 accumulation Methods 0.000 description 2
- 238000013475 authorization Methods 0.000 description 2
- 239000012141 concentrate Substances 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 238000005457 optimization Methods 0.000 description 2
- 238000005295 random walk Methods 0.000 description 2
- 238000012800 visualization Methods 0.000 description 2
- 101100244969 Arabidopsis thaliana PRL1 gene Proteins 0.000 description 1
- 241000209202 Bromus secalinus Species 0.000 description 1
- 241001269238 Data Species 0.000 description 1
- 102100039558 Galectin-3 Human genes 0.000 description 1
- 101100454448 Homo sapiens LGALS3 gene Proteins 0.000 description 1
- 101150051246 MAC2 gene Proteins 0.000 description 1
- BQCADISMDOOEFD-UHFFFAOYSA-N Silver Chemical compound [Ag] BQCADISMDOOEFD-UHFFFAOYSA-N 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000012098 association analyses Methods 0.000 description 1
- 230000003542 behavioural effect Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000012512 characterization method Methods 0.000 description 1
- 238000011217 control strategy Methods 0.000 description 1
- 238000007418 data mining Methods 0.000 description 1
- 238000013136 deep learning model Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 230000004069 differentiation Effects 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- PCHJSUWPFVWCPO-UHFFFAOYSA-N gold Chemical compound [Au] PCHJSUWPFVWCPO-UHFFFAOYSA-N 0.000 description 1
- 229910052737 gold Inorganic materials 0.000 description 1
- 239000010931 gold Substances 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000001788 irregular Effects 0.000 description 1
- 238000012804 iterative process Methods 0.000 description 1
- 238000005304 joining Methods 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 230000008092 positive effect Effects 0.000 description 1
- 230000033764 rhythmic process Effects 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 229910052709 silver Inorganic materials 0.000 description 1
- 239000004332 silver Substances 0.000 description 1
- 238000007619 statistical method Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2465—Query processing support for facilitating data mining operations in structured databases
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/28—Databases characterised by their database models, e.g. relational or object models
- G06F16/284—Relational databases
- G06F16/288—Entity relationship models
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/953—Querying, e.g. by the use of web search engines
- G06F16/9536—Search customisation based on social or collaborative filtering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
- G06Q50/01—Social networking
Landscapes
- Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Strategic Management (AREA)
- Economics (AREA)
- General Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Marketing (AREA)
- Primary Health Care (AREA)
- Health & Medical Sciences (AREA)
- Tourism & Hospitality (AREA)
- General Business, Economics & Management (AREA)
- Fuzzy Systems (AREA)
- Mathematical Physics (AREA)
- Probability & Statistics with Applications (AREA)
- Software Systems (AREA)
- Computational Linguistics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The excavation and investigation method of clique's relationship are cheated in internet, obtain internet finance data, financial relationship map is constructed using the building principle of knowledge mapping, on the basis of the financial relationship map of building, the group with similar behavior is excavated by clustering algorithm, it is analyzed by the composition to group, realizes the identification to fraud clique, complete excavation and investigation to deception clique's relationship.The present invention carries out profound excavation to the big data of magnanimity multidimensional, can not change from applicant, detect potentially to cheat clique in the operation behavior information that is difficult to avoid that.Meanwhile being analyzed by the composition to the fraud clique detected, provide the information such as fraud clique's potential risks grade.These information can also be used as into mould variable uses, can manually be verified with assisted verification personnel directly as air control rule, assist to carry out real-time prevention and control etc. on line.
Description
Technical field
The invention belongs to network technique fields, are related to internet financial field and data mining technology, are a kind of internet
The excavation and investigation method of middle fraud clique's relationship.
Background technique
In recent years, internet finance is developed rapidly, promote general favour financial development, promote financial service quality and
Efficiency meets diversification investment and financing demand etc. and has played positive effect, and it is latent to have shown the very big market space and development
Power.Internet finance also brings new challenge while injecting vigour into for financial circles development to our Financial Management,
Also some problems and risk hidden danger are exposed in fast development process.
Nowadays, internet fraud has become very professionalization and industrialization.For individual's fraud, personal letter is forged
Breath conceals refund wish, seeks the behaviors such as Zhu Dai mechanism help application and produce no small influence to mutual golden industry；And it is close
The clique's fraud to grow up in year a bit, harm more outclass personal fraud.This clique organize they have profession equipment, specially
The team of industry has special messenger to be responsible for writing scheme, and special messenger studies each mechanism air control loophole, and special messenger is responsible for that loan is helped to apply, special messenger is responsible for pin
Stolen goods, each link division of labor in whole process is clear, has formed complete industrial chain, has caused to internet financial industry huge
Challenge and loss.
Overwhelming majority internet financing corporation is still using traditional financial air control method as the core air control of company at present
Ability, mainly using Expert Rules, scorecard, these have preferably explanatory method.These modes, which limit, passes through technology
The promotion, such as more complex machine learning model, deep learning method etc. for developing bring air control effect, in Expert Rules and
It is extremely limited to the improvement of air control effect under scorecard mode.Therefore it based on traditional method, improves air control ability and needs to rely on
In the increase of data dimension and characteristic variable, to enrich the feature of Expert Rules and scorecard model, but this will lead to rule certainly
Then greatly increased with model complexity.In order to help to be promoted air control ability, existing part company uses oneself accumulation at present
Data construct relevant knowledge mapping, certain there are the incidence relation of potential risk and make related early warning for finding.But
That these maps usually contain all kinds of entities such as people, facility information, address information, application information, but regardless of be air control rule also
It is scorecard is judged according to the feature of people, so can be more lengthy and jumbled by the information that these maps are associated with out,
It is difficult to excavate out directly and apparent interpersonal co-related risks, need to feed back to after expert screened and assessed again
Air control rule or feature could be used as.But it is often difficult to obtain in this way comparatively ideal as a result, because will be from packet
Effectively rule is extracted in numerous and complicated incidence relation containing different entities and is characterized in highly difficult and is difficult to ensure theirs
Validity.
Summary of the invention
The problem to be solved in the present invention is, in internet financial field, traditional air control technology is difficult to promote effect, nothing
Method is effectively identified and is taken precautions against to clique's fraud.And the relation map in current internet finance is difficult to provide between men
Direct incidence relation can not also provide effective air control rule and feature.The present invention proposes one kind in internet financial scenario
Lower entity only includes the relation map of people, is provided by the description to clique's scale, clique's risk class, clique's compositing characteristic
Effective air control rule and feature, greatly promote traditional air control ability.
The technical solution of the present invention is as follows: cheating the excavation and investigation method of clique's relationship in internet, internet gold is obtained
Melt data, financial relationship map is constructed using the building principle of knowledge mapping, only with people when wherein financial relationship picture constructs
For entity, using interpersonal relationship as entity relationship, using the feature of people as entity attribute, in the financial relationship map of building
On the basis of, the group with similar behavior is excavated by clustering algorithm, is analyzed by the composition to group, is realized to taking advantage of
The identification of clique is cheated, excavation and investigation to deception clique's relationship are completed.
It is preferred that the building of entity relationship includes constructing relationship by contact address, passing through contact person or direct line
Relatives' information architecture relationship constructs relationship by facility information, constructs relationship by WIFI MAC Address and pass through geographical location
Information architecture relationship.
It is preferred that being standardized and polymerizeing to address during the building relationship of contact address, first will
Address information is specially divided according to administrative region, at the batch standardization of address step by step according to unified standardized format processing
After reason, address is polymerize based on LCS Longest Common Substring, the different practical identical addresses of literary style are polymerize；Equally,
Business Name is also polymerize with the same manner.
Further, entity attribute includes personal information, the facility information of personal smart machine and financial institution's storage
Overdue client's list, blacklist and personal collage-credit data, the facility information of personal smart machine pass through Software Development Kit
SDK is acquired, and personal smart machine establishes incidence relation by device-fingerprint technology and people.
Further, it on the basis of the financial relationship map of building, according to the information for having swindle individual, is calculated by cluster
Method, which excavates investigation, to be had the group of similar behavior and is identified, the clustering algorithm includes relation inference, Unsupervised clustering, corporations
It was found that algorithm, overlapping community's detection algorithm BigClam, LPA label propagation algorithm and figure insertion.
Further, the relation inference is based on user and its equipment behavior, first by user behavior and user
Equipment operation behavior is analyzed, and behavior pattern is obtained, in conjunction with expertise analyze, summary infer abnormal behaviour therein with
And potential homoplasy behind these behaviors, for identifying the group with identical behavior in financial relationship map.
Further, for the group excavated, the composition analysis of group is carried out to determine whether being fraud clique, specifically
To check by setting evaluation index to the resulting group of cluster, judge whether current group is fraud clique.
It is preferred that model is cheated using the evaluation index of setting as description information building clique, using RMF model
Mode to cluster gained group clique's risk of fraud carry out score output, set score threshold come to group carry out fraud sentence
It is disconnected.
The present invention also provides excavation and Check Systems that clique's relationship is cheated in a kind of internet, including database and service
Device, computer program is stored in server, and described program is performed the digging realized and cheat clique's relationship in above-mentioned internet
The method of pick and investigation, database are used to provide data call for the computer program in server.
The present invention carries out profound excavation to the big data of magnanimity multidimensional, can not change, be difficult to avoid that from applicant
It detects potentially to cheat clique in operation behavior information.Meanwhile being analyzed by the composition to the fraud clique detected,
Provide the information such as fraud clique's potential risks grade.These information can also be used as directly as air control rule into mould
Variable uses can manually be verified with assisted verification personnel, assist to carry out real-time prevention and control etc. on line.
Detailed description of the invention
Fig. 1 is financial relationship map example.
Fig. 2 is community discovery algorithm example.
The position Fig. 3 is overlapped community's detection algorithm example.
Fig. 4 is group clustering example of the present invention.
The embodiment schematic diagram of the position Fig. 5 clique's fraud digging system framework of the present invention.
Specific embodiment
The present invention program is specifically described below.
1, data acquisition
Excavation for clique's fraud relationship, it is necessary first to from the primary relationship constructed in mass data between entity,
It is then based on the relationship built and further excavates out wherein potential clique's risk of fraud.It is real in order to be established in mass data
Relationship between body needs to carry out a large amount of data cleansing and data standardization effort.During this, we have developed many
Algorithm is to complete these work.It is wherein main to have: Address Standardization, address cluster, Business Name matching.Below to these calculations
Method is sketched.
Address Standardization algorithm is to carry out stylistic be uniformly processed to address information data.The address date of separate sources
Quality is irregular, and fill request is different or artificially fill in habit it is different due to, the expression of address information is each
It is not identical.In order to facilitate later period use, it would be desirable to handle address information according to unified, specification format.The ground
Location standardized algorithm information according to contained in current address, by reasoning by its standard be unified address format, comprising save
The administrative regions such as urban district township, county and town street.For example, institute's made ground location is " McDonald by towards the Yangxi road great Wang subway station ", after standardization
For " Beijing, Chaoyang District, the road Xi great Wang, subway station side McDonald ".
After carrying out batch processing to address information by Address Standardization algorithm, it would be desirable to carry out polymerization behaviour to address
Make, i.e., is indicated using a unified address to filling in different but practical identical address.It is public that this method is based on LCS longest
The thought of substring altogether, adapts to the demand of Address Aggregation, can effectively polymerize the address after various standardization, even if difficulty is larger
The Address Aggregation algorithm can also complete well, such as:
It 1, can be by " Hubei Province, Wuhan City, Wuchang District, work main road, Wuhan University of Technology's mirror lake school district " system after Address Aggregation
One indicates:
Hubei Province, Wuhan City, Wuchang District, Polytechnics mirror lake school district Hai Wenshudian
Hubei Province, Wuhan City, Wuchang District, work main road, Wuhan University of Technology mirror lake school district Hai Wenshudian
Hubei Province, Wuhan City, Wuchang District, work main road, Wuhan University of Technology's mirror lake school district
It 2, can be by " Guangdong Province, Guangzhou, Baiyun District, Tian Xinxi raft Lu Yunda express delivery " unified representation after Address Aggregation:
Guangdong Province, Guangzhou, Baiyun District, Tian Xinxi raft Lu Yunda express delivery
Western raft Lu Yunda express delivery is enclosed with moral in Guangdong Province, Guangzhou, Baiyun District
Guangdong Province, Guangzhou, Baiyun District are reached with the street De Wei rhythm
For Business Name matching process, it is also based on the thought of LCS Longest Common Substring, it solves the problems, such as it is judgement
Whether two Business Names are consistent, i.e., whether two Business Names all point to same company.Due to public affairs that people fill in reality
Department is often incomplete, or even many is all abbreviation, therefore computer is difficult that as people, experience can be passed through and recognizes judgement
Whether they are consistent out.So the algorithm uses fuzzy matching algorithm and deep learning model, company name can be effectively identified
Whether claiming identical.For example, identifying that " Haidian industrial and commercial bank " is consistent with " the Haidian District, Beijing City Industrial and Commercial Bank of China ".
Above method is a part important in entire clique's fraud mining process, and the basis between entity is constructed for us
Relationship provides very important help.
2, the building of relationship
The basis that relationship constructs between entity is data, and so-called subfoundation determines superstructure, the magnitude and matter of data
Amount decides that the quantity and power for the entity relationship that we construct, more data, are more accurately marked dimension more abundant
Label, more timely data can preferably construct entity relationship abundant, provide for subsequent clique's clustering good
Basis.Internet finance has magnanimity, the data of various dimensions at present, and with the growth of the expansion of business and user volume, in a steady stream
Continuous data are also expanding underlying database, under the conditions of such a, carry out clique in big data and cheat relationship
Exploration and excavation.
The basis for establishing entity relationship is that have common feature between these entities, passes through the sieve to these common traits
Choosing and combination can establish out relationship between effective entity, so needing to find the feature that single entity is possessed, i.e. entity first
Attribute.
In general, these characteristic informations largely derive from the personal information that client fills in and acquire after client authorization
Facility information, in addition there are also overdue client's list, blacklist and personal collage-credit datas etc. inside financial institution.Wherein
The personal information of client is usually to fill in the stages such as register account number, applications, mainly includes name, identification card number, correspondent party
Formula, education experience, work experience, home address, emergency contact, E-mail address, social account etc..The acquisition of facility information is
Under user's authorization, the information of the currently used equipment of SDK (Software Development Kit) collected user, the dimension of this partial information
Degree is than more rich, and the behavioural habits, mode of operation, context of current device operator can be depicted in it better
Deng can be marked well to this equipment and track it in different phase in conjunction with the device-fingerprint technology of the prior art
Operation behavior；Primary fields include but is not limited in the facility information of acquisition: device identification, device model, device hardware letter
Breath, equipment application list, whether root/ escape from prison, network connection information, device geographical location etc..
After having information above, so that it may start to construct entity relationship map.The building of entity relationship map needs first
Data are cleaned and extracted.Then the information such as entity (node), relationship (side), entity attribute are determined according to demand, such as
Shown in Fig. 1, wherein the entity in the map that the present invention constructs is behaved；Relationship is the side between connecting node, and relationship of such as conversing turns
Account relationship etc.；Entity attribute indicates the feature of entity, the facility information as associated by the personal information of people, people, bank account letter
Breath etc..After confirming good above-mentioned entity, relationship, entity attribute, so that it may construct different entities in relation map, and can be right
The different weight of contextual definition is with the significance and importance of characterization of relation.Normally, pass through expertise and some statistical analysis
Method is defined weight.
In the following, just the building of some specific map relationships is illustrated:
1) relationship, is constructed by business address
The pairing of identification card number and business address is extracted according to the personal information that client fills in, in bulk by work
Unit address information carries out Address Standardization and address cluster operation, then these have been gathered to identity card corresponding to the address of class
Number carry out it is interrelated with graph of forming relations compose in ID-ID entity relationship.Wherein the setting of relationship weight is closed according to building
The power of system, for example, the relationship constructed after polymerizeing according to business address is stronger, is set as 3 come what is divided.In addition
, for example the connection established between identification card number according to the similarity degree of geographical location information is relatively weak, so that it may
It is 1 or 2 by its relationship weight setting.Specifically it can refer to following table (following Business Name is only for example use, non-genuine situation):
The information extraction that table 1.1 is filled according to user
The relationship that table 1.2 is associated with out
| Entity 1 | Entity 2 | Relationship weight |
| id1 | id2 | 3 |
| id1 | id7 | 3 |
| id2 | id7 | 3 |
| id3 | id4 | 3 |
2), pass through emergency contact or lineal relative's information architecture relationship
When client fills in application materials, it will usually it is required that client has to fill out emergency contact or lineal relative
Information.It is comparatively reliable effective because the people in the information can serve as the role of a guarantor indirectly
, it can at least guarantee there is stronger association between applicant and emergency contact.By this information, it can establish out and compare
Strong interpersonal relationship.Clique can preferably be found by the foundation of this relationship according further to our discovery
Between Personal the case where inter-guarantee and the case where Hei Chan intermediary is more people guarantee.Specific table presented below:
The relationship that table 2 is associated with out by emergency contact/lineal relative
| Entity 1 | Entity 2 | Relationship weight |
| id1 | id8 | 4 |
| id2 | id8 | 4 |
| id3 | id8 | 4 |
| id4 | id8 | 4 |
| id5 | id8 | 4 |
| id7 | id10 | 4 |
| id9 | id11 | 4 |
3) relationship, is constructed by facility information
For each equipment, a unique device identification can be distributed for each equipment by device-fingerprint technology.
When user such as registers by equipment, logs in, applies at the operation, the user and device therefor can be associated.So
By the different latitude of analytical equipment information, individual can be associated by different dimensions.It is associated under general normal device
Number of users will not be very much, but for clique fraud for, intermediary application, group control device application often show multi-user pass
The case where joining identical equipment.Specific interrelational form can see the table below:
3.1 facility information of table extracts
| Device id | User | State |
| A | id1 | Application |
| B | id2 | Application |
| A | id3 | Registration |
| A | id4 | It withdraws deposit |
| A | id5 | It logs in |
| A | id6 | It logs in |
| C | id7 | It withdraws deposit |
Table 3.2 is associated with by facility information
| Entity 1 | Entity 2 | Relationship weight |
| id1 | id3 | 4 |
| id1 | id4 | 4 |
| id1 | id6 | 4 |
| id3 | id4 | 4 |
| id3 | id6 | 4 |
| id4 | id6 | 4 |
| id5 | id7 | 4 |
4) relationship, is constructed by WIFI MAC Address
All the whole world is unique and is difficult to be changed for the MAC Address of any equipment.Pass through the facility information of acquisition, Wo Menke
To extract the corresponding MAC Address of WIFI equipment that operation equipment is connected, therefore can be by WIFI MAC Address to operation
Equipment is associated, and then is associated with out the relationship of people corresponding to these equipment.Specific interrelational form can see the table below:
4.1 WIFI-MAC of table corresponds to facility information
| The address WIFI-MAC | Device id |
| MAC1 | A |
| MAC2 | B |
| MAC1 | C |
| MAC1 | D |
| MAC1 | E |
| MAC3 | F |
| MAC4 | G |
Table 4.2 is associated with by WIFI-MAC
| Entity 1 | Entity 2 | Relationship weight |
| A | C | 2 |
| A | D | 2 |
| A | E | 2 |
| C | D | 2 |
| C | E | 2 |
| D | E | 2 |
Subsequently through relationship associated between user and equipment, using it is above-mentioned 3) in method can be by the relationship between people
It is associated by equipment.
5) relationship, is constructed by geographical location information
Geographical location information in equipment information collection can help us to construct incidence relation between equipment, in turn
The relationship being associated with out between the people using these equipment.It is divided by longitude and latitude and geographic area, in conjunction with equipment in certain geography
Residence time section can deduce the incidence relation between equipment in range.For example, the geographical location of two equipment connects very much
Closely, and regularly, for a long time it all rests in identical geographic area, therefore we can close the two equipment
Connection.In clique's fraud, due to the aggregation of clique personnel, the operation of group control device, tend to close by geographical location information
Join large number of equipment out.Specific interrelational form can see the table below:
5.1 geographical location of table corresponds to facility information
| Equipment | Longitude | Latitude |
| A | 12.152 | 56.123 |
| B | 13.111 | 58.002 |
| C | 10.998 | 58.668 |
| D | 11.589 | 57.102 |
| E | 16.879 | 60.668 |
| F | 112.023 | 56.115 |
| G | 156.118 | 55.028 |
Table 5.2 passes through geographic location association
After finding the above equipment room relationship, the relationship between people can be got up by equipment using mode in 3).
The building of partial association relationship is illustrated above by citing, but under practical true financial scenario, in map
The relationship on side may be friend, emergency contact, colleague, shared device, transfer accounts, communicates, and close so building is interpersonal
The mode of system be it is numerous and complicated, the map constructed is also to contain incidence relation very rich.
3, the realization of group clustering
The target of clique's relation excavation is to find clique, and clique is characterized in that a group has the group of similar behavior.Therefore,
We need to find the group of similar behavior from the map relationship and existing individual information built and be identified.
In the realization of cluster, according to the characteristic of data with existing, the present invention attempts and has used different methods, including closes
It is reasoning, the Unsupervised clustering in machine learning, community discovery algorithm Fast Unfolding of Communities, overlapping
Community's detection algorithm BigClam, LPA label propagation algorithm, figure insertion Graph Embedding etc., different cluster modes can
To adapt to different applications.We introduce the practice of these algorithms below.
1), relation inference
Heretofore described relation inference is based on user and its equipment behavior, first by user behavior and user
Equipment operation behavior is analyzed, and behavior pattern is obtained, in conjunction with expertise analyze, summary infer abnormal behaviour therein with
And potential homoplasy behind these behaviors, for identifying the group with identical behavior in financial relationship map.Pass through
Mining analysis is carried out to the operating habit of user, application behavior and equipment operation record etc., in conjunction with relevant expertise,
It can summarize and infer potential homoplasy behind abnormal behaviour therein and these behaviors.For example, in equipment behavior level,
There is a large number of users to concentrate on the APP of certain mechanism carrying out collective's registration, login, apply, place an order in some shorter time window
Deng, their operation technique is similar, the operating time is extremely short, and may there is geographical location to concentrate, derive from identical WIFI equipment,
Phenomena such as Multi-Subscriber Number.For another example, in user behavior level, a large number of users initiates Shen to different institutions in certain time window
Please, they often (such as one week, half a month, January) carries out concentration Shen to a collection of mechanism within a shorter time cycle
Please.Here by analysis user application behavior, such as apply the number of time, application, the frequency of application, the mechanism of application
Type etc. can construct the application track of user.It compares and sorts out by the similarity degree to these application tracks again,
The identical application group of a large amount of behaviors can therefrom be excavated out.
2), machine learning
The machine learning algorithm being applied in group clustering is mainly Unsupervised clustering algorithm.It is first in order to use the algorithm
It first needs to construct corresponding feature to equipment, user.For example, we can go out for device build by equipment information collection
Following feature (exposition feature):
6.1 equipment character pair of table
| Equipment feature |
| The geographical location GPS |
| Whether root/ escapes from prison |
| Gyroscope angular speed |
| Charged state |
| Enliven number |
| Nearest active time |
| Whether agency is used |
| Place base station number |
| With the presence or absence of distorting software |
| Currently used applicating category |
By the application behavior of user, we can construct following features for user:
6.2 user's character pair of table
| User characteristics |
| Request times |
| Application time window |
| Apply for the frequency |
| The nearest application time |
| Registion time |
| Login time |
| Application time |
| Whether warping apparatus is used |
| Application organization's number |
| Whether in blacklist |
After having feature, we can use Unsupervised clustering K-Means algorithm to cluster equipment and user
It analyzes.Since K-Means algorithm needs to specify cluster centre number K in advance, thus we for K value selection carried out it is excellent
Change.One is to be set according to our data volume and experience to cluster classification number K, second is that according to SSE (square-error
With) with the curve that K value changes K value is selected, third is that being selected using K-Means++ optimization algorithm the position of cluster centre
It optimizes.By the Unsupervised clustering algorithm, we can find the similar group of feature from a large amount of equipment and user,
And subsequent investigation is unfolded to these groups.
3), community discovery algorithm Fast Unfolding of communities
Community discovery algorithm is a kind of nomography, is a kind of algorithm divided based on constructed good figure.In general,
Corporations or group are characterized in that internal connection is close, density is larger, contact between corporations sparse.The algorithm is using modularity to society
The internal tightness degree of group is measured, and is then passed through optimization module degree and is put into each node so that corporations are closer, mould
Lumpiness increases in most corporations, and the community division situation after certain iteration is illustrated such as Fig. 2.
Since the algorithm is accounted for from graph structure angle, i.e., how to divide corporations and make modularity bigger.Therefore,
If constructed when constructing original graph using relationship as strong as possible, the tightness degree of final resulting corporations' relationship and
Realistic meaning can be relatively higher.In addition, the result of each run has some differences, society since the algorithm is heuritic approach
Group's some points free, that incidence relation itself is weaker in periphery may belong to different corporations in result is run multiple times, but
It is for the cluster result of close main body corporations is very consistent.It, can be from original big figure by the community discovery algorithm
In mark off the corporations of close relation, analyzed and determined for subsequent.
4), it is overlapped community's detection algorithm BigClam
The individual for being mainly characterized by detect while belonging to while dividing corporations multiple corporations of the algorithm, i.e.,
Lap between corporations.This usual group that partly overlaps can be considered the go-between of the community connection Liang Ge, take advantage of finance is counter
Swindleness field, for this group that partly overlaps, according to the feature of this partial mass and performance judge they whether be Hei Chan intermediary,
Zhu Dai mechanism, fraud gang member etc., and then judge the degree of danger of multiple corporations associated by it.Fig. 3 is BigClam division
Corporations' result example.
5), LPA label propagation algorithm
The figure relationship that the basis of label propagation algorithm constructs before being, it is known by being marked in existing figure relationship
Destination node, then in each iterative process, labeled destination node can be by itself label according to institute's link in figure
Diameter is broadcast to neighbor node, itself label can be continued to blaze abroad by labeled neighbor node in iteration next time.In
After final iteration, all nodes can all be labeled corresponding label, the consistent node of label therefrom be found, them
It is considered as a community or group.The reason of similar " one takes on the colour of one's company " on the whole.
6), figure insertion Graph Embedding
Figure insertion is a kind of based on deep learning, is difficult to carry out the scheme of complicated figure reasoning to solve super large network.Cause
For with the accumulation of data, the figure that we construct may include tens node and side, carried out on the figure of this super large
Complicated calculating and reasoning is more intractable.So, it would be desirable to the vector of low-dimensional can be used to go to indicate node, it is subsequent to facilitate
Processing, and guarantee that similar node is also wanted similar in the expression of low-dimensional in original graph as far as possible.Therefore, which uses for reference
The thought of word2vec (is indicated the cooccurrence relation between word and word by the sequence of sentence in corpus, and then learns to arrive in NLP
The expression of word), word is made into figure interior joint analogy, by the incidence relation analogy between node write words the co-occurrence between word close
System, constructs enough sequence nodes by way of random walk, and the sequence of word, then passes through deep learning in similar sentence
These sequence nodes of model learning and the vector expression for exporting respective nodes.These vectors expression be provided to it is subsequent classification,
Cluster task.In concrete practice, we carry out random walk to each node on the figure having had been built up, and use sequence node
It indicates the cooccurrence relation between egress and node, then these sequence node relationships is put into the skip-gram of word2vec
The low-dimensional vector for being trained to obtain node in model indicates.In this way, the node in super large figure can by low-dimensional to
Amount more efficiently shows, and the cooccurrence relation between node and node can be also maintained, and pass through machine again later
Learning algorithm clusters it to obtain group.
4, the excavation of clique is cheated
By above-mentioned relation building and group clustering after, the good group of available a large amount of polymerizations, as shown in figure 4, this
A little group's some include that individual amount is more, and some includes that individual amount is few, generally require rule of thumb, demand and mark off group
The case where body, limits number of individuals contained by single group.And whether these groups are that this property of clique can not directly lead to
It crosses current cluster result to obtain, us is needed to carry out analyzing later judgement to the composition of group.
The important evidence that analysis is judgement fraud clique is carried out to the composition of group, therefore the present invention proposes that expert is combined to pass through
It tests with service definition index of correlation and group is described and is assessed, the group obtained to cluster carries out screening investigation.Under
Face selected section index carries out brief introduction:
After being analyzed according to structure of the above index to group, one can be carried out to group and described well, then
According to these description informations, it can lay down a regulation to judge whether current group is fraud clique, on the other hand also utilize these
Clique's fraud model is constructed to the description information of group.
It is a kind of effective mode that fraud clique is found by laying down a regulation, it will usually in conjunction with business to different
The different threshold value of target setting, once some group, which meets requirements above, will be delimited to cheat clique.Lift a simple example
The judge index of son, setting fraud clique is as follows: blacklist accounting is more than or equal to 10% in group, and gray list accounting is greater than
25%, number of breaking one's promise accounting is greater than 15%, and overdue number accounting is greater than 20%.Refer to if the description of certain group meets the above items
Mark, then the group will be judged as fraud clique.
On the other hand, on this basis further, The invention also achieves export clique's fraud point by model to weigh
A possibility that clique is is cheated by certain group is measured, due to having certain difficulty to the judgement of fraud clique in actual scene, so being difficult
It is collected into whether group is fraud this label of clique to be modeled, therefore the present invention uses the mode of RMF model to group
Clique's risk of fraud carry out score output, delimit score threshold then to carry out fraud judgement to group, realize fraud clique
Fast automatic judgement in relation excavation investigation.Firstly, the selected target variable for preparing to use.This usual step is needed by warp
It tests and is selected, for example the information such as blacklist accounting, gray list accounting, number of breaking one's promise accounting in upper table are that we need to select
's.Next, needing to analyze distribution situation of the group under selected index, and selected index is become according to actual distribution situation
Amount is handled；Finally, carrying out the setting of weighted value according to its importance degree to different variable indexs and exporting score.In
In this model, score is higher, and a possibility that representing group as fraud clique, is higher, and the lower group that represents of score is fraud clique
A possibility that it is lower.
By both the above mode, first is that fraud clique can be fast and effeciently found from all groups marked off,
Second is that can be preferably to be measured a possibility that cheating clique to group by clique's risk of fraud value.
5, the Application Example with investigation method is excavated in clique's fraud of the present invention
The discovery of the present invention program clique fraud can be used in many business scenarios, we are mainly from following several here
A embodiment illustrates implementation of the invention:
One, by visualization interface, clique's incidence relation and risk indicator information are shown, expert is assisted manually to be examined
Core.In visualization interface, according to the query node of input, system can show current associated by the node in graph form
Member in clique and the incidence relation between them, and corresponding risk indicator information can be provided, for example, current clique is black
List accounting, overdue number accounting, number of breaking one's promise accounting etc..The displaying of this range of information can help instead to cheat expert more preferable
Ground judges whether applicant possesses clique's risk of fraud.
Two, real-time clique's risk of fraud is carried out to applicant to detect.In general, clique's fraud relational graph can offline, daily
Ground is updated, and then can be stored into the figure in database for using on line.For applying in real time on a line, we
Can be according to the incidence relation of his itself institute's band of the information searching of the applicant, then clique that he is inserted into us in real time takes advantage of
It cheats in relational graph, to generate the report of accessment and test to the applicant clique risk of fraud.And this new relation being inserted into real time
It can remain into current clique's fraud relational graph, be supplied to next inquiry business and use.
Three, frequent item set mining is carried out to batch applicant, and relational graph is cheated by real time correlation clique.Batch is applied
Behavior, the present invention can be often same in this crowd of people by finding to applicant's progress frequent item set mining in a certain short period
When apply same mechanism group, then identify the applicant in these groups and on line business issue early warning, with assist
It is taken precautions against in real time on line.Meanwhile the suspicious group in this part can be also inserted into real time to clique's fraud relational graph and be associated point
Analysis exports clique's risk of fraud.
Four, it is found using the clique that seed user carries out auto correlation.The scene is intended to excavate pending user and seed is used
Clique's fraud relationship that may be present between family.Firstly, it is necessary to user first upload the own seed user of a batch (it is often overdue or
Have record of bad behavior), several subgraphs are obtained for being associated in financial relationship map.Then, need will be pending by user
Whether user, which is put into obtained subgraph, is associated discovery, judge current pending user between own seed user
Constitute clique's risk of fraud.This association analysis mode can take precautions against clique's fraud for certain mechanism well.One silver
Row client provides 5,000 pending user and 5000 fraud seed users, is found wherein more than 970 by the relation map
A doubtful clique's fraudulent user of user.Confirm through the authority checks, 90% application user exists in the clique's fraudulent user being associated with out
It can be rejected in anti-fraud air control strategy before borrowing, 10% successfully applies for that the overdue risk of user is 2.5 times of average risk.Thus
It can be seen that can effectively identify potential risks user by carrying out auto correlation in the relation map, overdue rate is reduced.
Five, association clique's fraud information forms variable, carries out regular judgement for decision-making level, variable enters mould.By that will apply
Person is put into clique's fraud relational graph and is associated to obtain index of correlation variable, then feeds back these target variables to air control and determines
Plan layer holds risk with aid decision making layer in real time, ensures the validity of Real-time Decision.Meanwhile these target variables can also enter mould
Type, to help model more fully to measure the degree of risk of applicant.From the point of view of the feedback used according to company air control expert, clique
Scale and grade are able to ascend air control model KS absolute value 1%+ after entering mould as variable, enhance differentiation of the model to fine or not client
Ability.In addition, this field of grade is cheated as air control rule by clique, the reject rate to bad client is generally improved, is effectively dropped
Low bad credit rate.It wherein, is 50% bad credit rate feelings in entirety in the discovery in actual use of certain Chi Pai consumer finance company
Under condition, the part bad credit rate that clique's fraud grade reaches 7 or more reaches 95%, and promotion degree reaches 90% or so, helps the mechanism
Substantially reduce overdue rate.
6, system architecture of the invention
Finally introduce hardware realization of the invention.The present invention is realized by the collaborative work of server and database, is passed through
Hardware structure realizes the operation of computer program, and then realizes aforementioned excavate in investigation method.In order to carry out the digging of fraud clique
Pick not only needs magnanimity, the support of the big data of multidimensional, it is also necessary to which reliable system architecture is answered from data processing to algorithm to ensure
With, then to result storage, finally provide the effective operating for servicing this process.So the framework of system is very important one
Part.The present invention provides system architecture one embodiment as shown in figure 5, being summarized as follows:
The bottom is our large-scale distributed cluster, includes server and High Performance Computing Cluster, for all upper layers
Storage, calculate, using etc. business reliable performance and prolongable memory space are provided.Up one layer is our bottom data
Library, mainly Distributed Data Warehouse Hive and database Mysql, they provide reliable storage sky for our mass data
Between, while the data flowed into real time from Flume, Kafka are accepted, these data are by Storm and Spark Streaming's
Database is written into after processing.In tool layer, because data volume is huge, we all employ distributed tool and platform is grasped
Make, for example, distributed machines learning platform, distributed figure computing platform.In algorithm layer, we used relation inference, without prison
It superintends and directs clustering algorithm, corporations' detection algorithm, figure embedded mobile GIS etc. and excavates potential fraud clique from massive relation.This layer it
Upper is outbound data layer, this layer of service-oriented stores me using Hbase distributed memory system and chart database Neo4j
Clique fraud result and to api layer provide data support.
Claims (9)
1. the excavation and investigation method of clique's relationship are cheated in internet, it is characterized in that internet finance data is obtained, using knowing
The building principle for knowing map constructs financial relationship map, with only taking human as entity when wherein financial relationship picture constructs, with people with
Relationship between people is entity relationship, using the feature of people as entity attribute, on the basis of the financial relationship map of building, by poly-
Class algorithm excavates the group with similar behavior, is analyzed by the composition to group, realizes the identification to fraud clique,
Complete the excavation and investigation to deception clique's relationship.
2. the excavation and investigation method of clique's relationship are cheated in internet according to claim 1, it is characterized in that entity closes
The building of system includes constructing relationship by contact address, believing by contact person or lineal relative's information architecture relationship, by equipment
Breath building relationship constructs relationship by the address WIFIMAC and constructs relationship by geographical location information.
3. the excavation and investigation method of clique's relationship are cheated in internet according to claim 2, it is characterized in that contacting
During address building relationship, address is standardized and is polymerize, first by address information according to unified standardized format
Processing, specially divides according to administrative region step by step, after the batch standardization of address, is based on LCS Longest Common Substring pair
Address is polymerize, and the different practical identical addresses of literary style are polymerize；Equally, Business Name is also carried out with the same manner
Polymerization.
4. the excavation and investigation method of clique's relationship are cheated in internet according to claim 1, it is characterized in that entity category
Property include personal information, overdue client's list of the facility information of personal smart machine and financial institution's storage, blacklist and
The facility information of personal collage-credit data, personal smart machine is acquired by Software Development Kit SDK, personal smart machine
Incidence relation is established by device-fingerprint technology and people.
5. the excavation and investigation method of clique's relationship are cheated in internet according to claim 1, it is characterized in that constructing
Financial relationship map on the basis of, according to the information for having swindle individual, excavating investigation by clustering algorithm has similar commit theft
Group is simultaneously identified that the clustering algorithm includes relation inference, Unsupervised clustering, community discovery algorithm, the detection of overlapping community
Algorithm BigClam, LPA label propagation algorithm and figure insertion.
6. the excavation and investigation method of clique's relationship are cheated in internet according to claim 6, it is characterized in that the pass
It is that reasoning is based on user and its equipment behavior, is analyzed, obtained by the equipment operation behavior to user behavior and user first
It to behavior pattern, is analyzed in conjunction with expertise, summary infers potentially to become behind abnormal behaviour therein and these behaviors
The same sex, for identifying the group with identical behavior in financial relationship map.
7. the excavation and investigation method of clique are cheated in internet according to claim 1, it is characterized in that for excavating
Group, carry out group composition analysis to determine whether be fraud clique, specifically by setting evaluation index come to cluster
Resulting group is checked, and judges whether current group is fraud clique.
8. the excavation and investigation method of clique's relationship are cheated in internet according to claim 7, it is characterized in that will setting
Evaluation index as description information building clique cheat model, by the way of RMF model to cluster gained group clique
Risk of fraud carries out score output, sets score threshold to carry out fraud judgement to group.
9. excavation and the Check System of clique's relationship are cheated in a kind of internet, it is characterized in that including database and server, clothes
Computer program is stored in business device, described program is performed in the realization described in any item internets claim 1-8 and takes advantage of
The excavation and investigation method of clique's relationship are cheated, database is used to provide data call for the computer program in server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910660468.6A CN110413707A (en) | 2019-07-22 | 2019-07-22 | The excavation of clique's relationship is cheated in internet and checks method and its system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910660468.6A CN110413707A (en) | 2019-07-22 | 2019-07-22 | The excavation of clique's relationship is cheated in internet and checks method and its system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110413707A true CN110413707A (en) | 2019-11-05 |
Family
ID=68362253
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910660468.6A Pending CN110413707A (en) | 2019-07-22 | 2019-07-22 | The excavation of clique's relationship is cheated in internet and checks method and its system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110413707A (en) |
Cited By (45)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110795574A (en) * | 2019-11-07 | 2020-02-14 | 北京集奥聚合科技有限公司 | Knowledge graph construction method based on finance anti-fraud |
| CN110852895A (en) * | 2019-11-13 | 2020-02-28 | 易联众信息技术股份有限公司 | Medical security cheat-insurance behavior discovery method based on knowledge graph |
| CN110941664A (en) * | 2019-12-11 | 2020-03-31 | 北京百度网讯科技有限公司 | Knowledge graph construction method, detection method, device, equipment and storage medium |
| CN111062642A (en) * | 2019-12-27 | 2020-04-24 | 南京三百云信息科技有限公司 | Method and device for identifying industrial risk degree of object and electronic equipment |
| CN111182533A (en) * | 2019-12-06 | 2020-05-19 | 武汉极意网络科技有限公司 | Internet attack group positioning method and system |
| CN111198967A (en) * | 2019-12-20 | 2020-05-26 | 北京淇瑀信息科技有限公司 | User grouping method and device based on relational graph and electronic equipment |
| CN111372242A (en) * | 2020-01-16 | 2020-07-03 | 深圳市随手商业保理有限公司 | Fraud identification method, device, server and storage medium |
| CN111428217A (en) * | 2020-04-12 | 2020-07-17 | 中信银行股份有限公司 | Method and device for identifying cheat group, electronic equipment and computer readable storage medium |
| CN111476653A (en) * | 2019-12-24 | 2020-07-31 | 马上消费金融股份有限公司 | Risk information identification, determination and model training method and device |
| CN111489168A (en) * | 2020-04-17 | 2020-08-04 | 支付宝(杭州)信息技术有限公司 | Target object risk identification method and device and processing equipment |
| CN111538869A (en) * | 2020-04-29 | 2020-08-14 | 支付宝(杭州)信息技术有限公司 | Method, device and equipment for detecting transaction abnormal group |
| CN111667026A (en) * | 2020-06-30 | 2020-09-15 | 成都新潮传媒集团有限公司 | Debugging method and device for geographic position of multimedia equipment |
| CN111694969A (en) * | 2020-06-18 | 2020-09-22 | 拉卡拉支付股份有限公司 | User identity identification method and device |
| CN111738628A (en) * | 2020-08-14 | 2020-10-02 | 支付宝(杭州)信息技术有限公司 | Risk group identification method and device |
| CN111798325A (en) * | 2020-07-17 | 2020-10-20 | 杭州海康威视系统技术有限公司 | Medical security cheating and insurance behavior supervision system and method |
| CN111861733A (en) * | 2020-07-31 | 2020-10-30 | 重庆富民银行股份有限公司 | Fraud prevention and control system and method based on address fuzzy matching |
| CN111861756A (en) * | 2020-08-05 | 2020-10-30 | 哈尔滨工业大学（威海） | Group partner detection method based on financial transaction network and implementation device thereof |
| CN111986034A (en) * | 2020-08-14 | 2020-11-24 | 江苏云脑数据科技有限公司 | Medical insurance group fraud monitoring method, system and storage medium |
| CN111984831A (en) * | 2020-08-21 | 2020-11-24 | 北京明略软件系统有限公司 | Method and apparatus for theft event information mining |
| CN112069964A (en) * | 2020-08-31 | 2020-12-11 | 天津大学 | Abnormal person relation network mining method based on image recognition technology |
| CN112115981A (en) * | 2020-08-26 | 2020-12-22 | 微梦创科网络科技（中国）有限公司 | Embedding evaluation method and system for social network bloggers |
| CN112163096A (en) * | 2020-09-18 | 2021-01-01 | 中国建设银行股份有限公司 | Malicious group determination method and device, electronic equipment and storage medium |
| CN112182410A (en) * | 2020-11-05 | 2021-01-05 | 西南交通大学 | User travel mode mining method based on space-time trajectory knowledge graph |
| CN112231486A (en) * | 2020-09-04 | 2021-01-15 | 苏宁金融科技(南京)有限公司 | Target database construction method, target applicant identification method, device and system |
| CN112287039A (en) * | 2020-10-30 | 2021-01-29 | 税友软件集团股份有限公司 | Group partner identification method and related device |
| CN112291374A (en) * | 2020-12-29 | 2021-01-29 | 支付宝(杭州)信息技术有限公司 | Method and device for acquiring characteristics of Internet of things equipment |
| CN112559639A (en) * | 2020-11-30 | 2021-03-26 | 武汉烽火众智数字技术有限责任公司 | Cross-border tissue analysis method based on map structure |
| CN112801837A (en) * | 2019-11-13 | 2021-05-14 | 腾讯科技（深圳）有限公司 | Device clustering method and device, storage medium and electronic device |
| CN112819056A (en) * | 2021-01-25 | 2021-05-18 | 百果园技术(新加坡)有限公司 | Group control account mining method, device, equipment and storage medium |
| CN112926991A (en) * | 2021-03-30 | 2021-06-08 | 顶象科技有限公司 | Cascade group severity grade dividing method and system |
| CN112950357A (en) * | 2021-03-22 | 2021-06-11 | 工银科技有限公司 | Transaction abnormal group partner identification method and device |
| CN112968870A (en) * | 2021-01-29 | 2021-06-15 | 国家计算机网络与信息安全管理中心 | Network group discovery method based on frequent itemset |
| CN113011990A (en) * | 2021-02-01 | 2021-06-22 | 深圳无域科技技术有限公司 | Virtual connection network system and information acquisition method thereof |
| CN113129010A (en) * | 2020-01-10 | 2021-07-16 | 联洋国融(北京)科技有限公司 | Fraud group mining system and method based on complex network model |
| CN113596806A (en) * | 2021-07-09 | 2021-11-02 | 北京达佳互联信息技术有限公司 | Terminal source determining method and device, electronic equipment and storage medium |
| CN113641827A (en) * | 2021-06-29 | 2021-11-12 | 武汉众智数字技术有限公司 | Phishing network identification method and system based on knowledge graph |
| CN113657902A (en) * | 2021-08-03 | 2021-11-16 | 浙江创邻科技有限公司 | Financial security management method, system and storage medium based on graph database |
| CN113706181A (en) * | 2021-10-30 | 2021-11-26 | 杭银消费金融股份有限公司 | Service processing detection method and system based on user behavior characteristics |
| CN113706180A (en) * | 2021-10-29 | 2021-11-26 | 杭银消费金融股份有限公司 | Method and system for identifying cheating communities |
| CN114124576A (en) * | 2022-01-24 | 2022-03-01 | 成都无糖信息技术有限公司 | Knowledge graph-based fraud website association method and system |
| CN114169458A (en) * | 2021-12-13 | 2022-03-11 | 平安科技（深圳）有限公司 | Method and device for identifying cheater, storage medium and computer equipment |
| CN114692785A (en) * | 2022-05-26 | 2022-07-01 | 中国平安财产保险股份有限公司 | Behavior classification method, device, equipment and storage medium |
| CN115099924A (en) * | 2022-05-20 | 2022-09-23 | 北京结慧科技有限公司 | Financial wind control management method and system, equipment and storage medium |
| CN116823274A (en) * | 2023-08-30 | 2023-09-29 | 杭银消费金融股份有限公司 | Fraud risk assessment method and device applied to financial terminal |
| CN117035082A (en) * | 2023-10-10 | 2023-11-10 | 北京江融信科技有限公司 | Knowledge graph real-time operation method and system for identifying fraudulent party |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160210631A1 (en) * | 2015-01-15 | 2016-07-21 | Wipro Limited | Systems and methods for flagging potential fraudulent activities in an organization |
| CN108009915A (en) * | 2017-12-21 | 2018-05-08 | 连连银通电子支付有限公司 | A kind of labeling method and relevant apparatus of fraudulent user community |
| CN108492173A (en) * | 2018-03-23 | 2018-09-04 | 上海氪信信息技术有限公司 | A kind of anti-Fraud Prediction method of credit card based on dual-mode network figure mining algorithm |
| CN108764917A (en) * | 2018-05-04 | 2018-11-06 | 阿里巴巴集团控股有限公司 | It is a kind of fraud clique recognition methods and device |
| CN109064318A (en) * | 2018-08-24 | 2018-12-21 | 苏宁消费金融有限公司 | A kind of internet financial risks monitoring system of knowledge based map |
| CN109978538A (en) * | 2017-12-28 | 2019-07-05 | 阿里巴巴集团控股有限公司 | Determine fraudulent user, training pattern, the method and device for identifying risk of fraud |
-
2019
- 2019-07-22 CN CN201910660468.6A patent/CN110413707A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160210631A1 (en) * | 2015-01-15 | 2016-07-21 | Wipro Limited | Systems and methods for flagging potential fraudulent activities in an organization |
| CN108009915A (en) * | 2017-12-21 | 2018-05-08 | 连连银通电子支付有限公司 | A kind of labeling method and relevant apparatus of fraudulent user community |
| CN109978538A (en) * | 2017-12-28 | 2019-07-05 | 阿里巴巴集团控股有限公司 | Determine fraudulent user, training pattern, the method and device for identifying risk of fraud |
| CN108492173A (en) * | 2018-03-23 | 2018-09-04 | 上海氪信信息技术有限公司 | A kind of anti-Fraud Prediction method of credit card based on dual-mode network figure mining algorithm |
| CN108764917A (en) * | 2018-05-04 | 2018-11-06 | 阿里巴巴集团控股有限公司 | It is a kind of fraud clique recognition methods and device |
| CN109064318A (en) * | 2018-08-24 | 2018-12-21 | 苏宁消费金融有限公司 | A kind of internet financial risks monitoring system of knowledge based map |
Cited By (68)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110795574A (en) * | 2019-11-07 | 2020-02-14 | 北京集奥聚合科技有限公司 | Knowledge graph construction method based on finance anti-fraud |
| CN110852895A (en) * | 2019-11-13 | 2020-02-28 | 易联众信息技术股份有限公司 | Medical security cheat-insurance behavior discovery method based on knowledge graph |
| CN112801837A (en) * | 2019-11-13 | 2021-05-14 | 腾讯科技（深圳）有限公司 | Device clustering method and device, storage medium and electronic device |
| CN112801837B (en) * | 2019-11-13 | 2023-12-29 | 腾讯科技（深圳）有限公司 | Equipment clustering method and device, storage medium and electronic equipment |
| CN111182533B (en) * | 2019-12-06 | 2023-09-08 | 武汉极意网络科技有限公司 | Positioning method and system for Internet attack group partner |
| CN111182533A (en) * | 2019-12-06 | 2020-05-19 | 武汉极意网络科技有限公司 | Internet attack group positioning method and system |
| CN110941664A (en) * | 2019-12-11 | 2020-03-31 | 北京百度网讯科技有限公司 | Knowledge graph construction method, detection method, device, equipment and storage medium |
| CN110941664B (en) * | 2019-12-11 | 2024-01-09 | 北京百度网讯科技有限公司 | Knowledge graph construction method, knowledge graph detection method, knowledge graph construction device, knowledge graph detection equipment and storage medium |
| CN111198967A (en) * | 2019-12-20 | 2020-05-26 | 北京淇瑀信息科技有限公司 | User grouping method and device based on relational graph and electronic equipment |
| CN111198967B (en) * | 2019-12-20 | 2024-03-08 | 北京淇瑀信息科技有限公司 | User grouping method and device based on relationship graph and electronic equipment |
| CN111476653A (en) * | 2019-12-24 | 2020-07-31 | 马上消费金融股份有限公司 | Risk information identification, determination and model training method and device |
| CN111062642A (en) * | 2019-12-27 | 2020-04-24 | 南京三百云信息科技有限公司 | Method and device for identifying industrial risk degree of object and electronic equipment |
| CN113129010A (en) * | 2020-01-10 | 2021-07-16 | 联洋国融(北京)科技有限公司 | Fraud group mining system and method based on complex network model |
| CN111372242B (en) * | 2020-01-16 | 2023-10-03 | 深圳市卡牛科技有限公司 | Fraud identification method, fraud identification device, server and storage medium |
| CN111372242A (en) * | 2020-01-16 | 2020-07-03 | 深圳市随手商业保理有限公司 | Fraud identification method, device, server and storage medium |
| CN111428217A (en) * | 2020-04-12 | 2020-07-17 | 中信银行股份有限公司 | Method and device for identifying cheat group, electronic equipment and computer readable storage medium |
| CN111489168A (en) * | 2020-04-17 | 2020-08-04 | 支付宝(杭州)信息技术有限公司 | Target object risk identification method and device and processing equipment |
| CN111538869A (en) * | 2020-04-29 | 2020-08-14 | 支付宝(杭州)信息技术有限公司 | Method, device and equipment for detecting transaction abnormal group |
| CN111538869B (en) * | 2020-04-29 | 2023-05-26 | 支付宝(杭州)信息技术有限公司 | Transaction abnormal group detection method, device and equipment |
| CN111694969A (en) * | 2020-06-18 | 2020-09-22 | 拉卡拉支付股份有限公司 | User identity identification method and device |
| CN111667026B (en) * | 2020-06-30 | 2022-11-25 | 成都新潮传媒集团有限公司 | Debugging method and device for geographic position of multimedia equipment |
| CN111667026A (en) * | 2020-06-30 | 2020-09-15 | 成都新潮传媒集团有限公司 | Debugging method and device for geographic position of multimedia equipment |
| CN111798325A (en) * | 2020-07-17 | 2020-10-20 | 杭州海康威视系统技术有限公司 | Medical security cheating and insurance behavior supervision system and method |
| CN111861733A (en) * | 2020-07-31 | 2020-10-30 | 重庆富民银行股份有限公司 | Fraud prevention and control system and method based on address fuzzy matching |
| CN111861733B (en) * | 2020-07-31 | 2023-09-15 | 重庆富民银行股份有限公司 | Fraud prevention and control system and method based on address fuzzy matching |
| CN111861756B (en) * | 2020-08-05 | 2024-05-03 | 哈尔滨工业大学（威海） | Group partner detection method based on financial transaction network and realization device thereof |
| CN111861756A (en) * | 2020-08-05 | 2020-10-30 | 哈尔滨工业大学（威海） | Group partner detection method based on financial transaction network and implementation device thereof |
| CN111986034A (en) * | 2020-08-14 | 2020-11-24 | 江苏云脑数据科技有限公司 | Medical insurance group fraud monitoring method, system and storage medium |
| CN111738628A (en) * | 2020-08-14 | 2020-10-02 | 支付宝(杭州)信息技术有限公司 | Risk group identification method and device |
| CN111986034B (en) * | 2020-08-14 | 2022-05-10 | 江苏云脑数据科技有限公司 | Medical insurance group fraud monitoring method, system and storage medium |
| CN111984831A (en) * | 2020-08-21 | 2020-11-24 | 北京明略软件系统有限公司 | Method and apparatus for theft event information mining |
| CN112115981B (en) * | 2020-08-26 | 2024-05-03 | 微梦创科网络科技（中国）有限公司 | Embedding evaluation method and embedding evaluation system for social network bloggers |
| CN112115981A (en) * | 2020-08-26 | 2020-12-22 | 微梦创科网络科技（中国）有限公司 | Embedding evaluation method and system for social network bloggers |
| CN112069964A (en) * | 2020-08-31 | 2020-12-11 | 天津大学 | Abnormal person relation network mining method based on image recognition technology |
| CN112231486A (en) * | 2020-09-04 | 2021-01-15 | 苏宁金融科技(南京)有限公司 | Target database construction method, target applicant identification method, device and system |
| CN112163096A (en) * | 2020-09-18 | 2021-01-01 | 中国建设银行股份有限公司 | Malicious group determination method and device, electronic equipment and storage medium |
| CN112287039A (en) * | 2020-10-30 | 2021-01-29 | 税友软件集团股份有限公司 | Group partner identification method and related device |
| CN112182410B (en) * | 2020-11-05 | 2023-04-21 | 西南交通大学 | User travel mode mining method based on space-time track knowledge graph |
| CN112182410A (en) * | 2020-11-05 | 2021-01-05 | 西南交通大学 | User travel mode mining method based on space-time trajectory knowledge graph |
| CN112559639B (en) * | 2020-11-30 | 2022-08-19 | 武汉烽火众智数字技术有限责任公司 | Cross-border tissue analysis method based on map structure |
| CN112559639A (en) * | 2020-11-30 | 2021-03-26 | 武汉烽火众智数字技术有限责任公司 | Cross-border tissue analysis method based on map structure |
| CN112291374B (en) * | 2020-12-29 | 2021-03-23 | 支付宝(杭州)信息技术有限公司 | Method and device for acquiring characteristics of Internet of things equipment |
| CN112291374A (en) * | 2020-12-29 | 2021-01-29 | 支付宝(杭州)信息技术有限公司 | Method and device for acquiring characteristics of Internet of things equipment |
| WO2022156720A1 (en) * | 2021-01-25 | 2022-07-28 | 百果园技术(新加坡)有限公司 | Method and apparatus for group control account excavation, device, and storage medium |
| CN112819056A (en) * | 2021-01-25 | 2021-05-18 | 百果园技术(新加坡)有限公司 | Group control account mining method, device, equipment and storage medium |
| CN112968870A (en) * | 2021-01-29 | 2021-06-15 | 国家计算机网络与信息安全管理中心 | Network group discovery method based on frequent itemset |
| CN113011990A (en) * | 2021-02-01 | 2021-06-22 | 深圳无域科技技术有限公司 | Virtual connection network system and information acquisition method thereof |
| CN112950357B (en) * | 2021-03-22 | 2024-03-15 | 工银科技有限公司 | Transaction abnormal group identification method and device |
| CN112950357A (en) * | 2021-03-22 | 2021-06-11 | 工银科技有限公司 | Transaction abnormal group partner identification method and device |
| CN112926991A (en) * | 2021-03-30 | 2021-06-08 | 顶象科技有限公司 | Cascade group severity grade dividing method and system |
| CN112926991B (en) * | 2021-03-30 | 2024-04-30 | 中国银联股份有限公司 | Method and system for grading severity level of cash-out group |
| CN113641827A (en) * | 2021-06-29 | 2021-11-12 | 武汉众智数字技术有限公司 | Phishing network identification method and system based on knowledge graph |
| CN113596806A (en) * | 2021-07-09 | 2021-11-02 | 北京达佳互联信息技术有限公司 | Terminal source determining method and device, electronic equipment and storage medium |
| CN113596806B (en) * | 2021-07-09 | 2022-10-28 | 北京达佳互联信息技术有限公司 | Terminal source determining method and device, electronic equipment and storage medium |
| CN113657902B (en) * | 2021-08-03 | 2024-03-22 | 浙江创邻科技有限公司 | Financial security management method, system and storage medium based on graph database |
| CN113657902A (en) * | 2021-08-03 | 2021-11-16 | 浙江创邻科技有限公司 | Financial security management method, system and storage medium based on graph database |
| CN113706180A (en) * | 2021-10-29 | 2021-11-26 | 杭银消费金融股份有限公司 | Method and system for identifying cheating communities |
| CN113706180B (en) * | 2021-10-29 | 2022-02-08 | 杭银消费金融股份有限公司 | Method and system for identifying cheating communities |
| CN113706181A (en) * | 2021-10-30 | 2021-11-26 | 杭银消费金融股份有限公司 | Service processing detection method and system based on user behavior characteristics |
| CN113706181B (en) * | 2021-10-30 | 2022-02-08 | 杭银消费金融股份有限公司 | Service processing detection method and system based on user behavior characteristics |
| CN114169458A (en) * | 2021-12-13 | 2022-03-11 | 平安科技（深圳）有限公司 | Method and device for identifying cheater, storage medium and computer equipment |
| CN114124576B (en) * | 2022-01-24 | 2022-04-22 | 成都无糖信息技术有限公司 | Knowledge graph-based fraud website association method and system |
| CN114124576A (en) * | 2022-01-24 | 2022-03-01 | 成都无糖信息技术有限公司 | Knowledge graph-based fraud website association method and system |
| CN115099924A (en) * | 2022-05-20 | 2022-09-23 | 北京结慧科技有限公司 | Financial wind control management method and system, equipment and storage medium |
| CN114692785A (en) * | 2022-05-26 | 2022-07-01 | 中国平安财产保险股份有限公司 | Behavior classification method, device, equipment and storage medium |
| CN116823274B (en) * | 2023-08-30 | 2024-01-09 | 杭银消费金融股份有限公司 | Fraud risk assessment method and device applied to financial terminal |
| CN116823274A (en) * | 2023-08-30 | 2023-09-29 | 杭银消费金融股份有限公司 | Fraud risk assessment method and device applied to financial terminal |
| CN117035082A (en) * | 2023-10-10 | 2023-11-10 | 北京江融信科技有限公司 | Knowledge graph real-time operation method and system for identifying fraudulent party |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110413707A (en) | The excavation of clique's relationship is cheated in internet and checks method and its system | |
| CN110223168B (en) | Label propagation anti-fraud detection method and system based on enterprise relationship map | |
| CN108492173A (en) | A kind of anti-Fraud Prediction method of credit card based on dual-mode network figure mining algorithm | |
| CN109918511A (en) | A kind of knowledge mapping based on BFS and LPA is counter to cheat feature extracting method | |
| CN106651603A (en) | Risk evaluation method and apparatus based on position service | |
| CN109685647A (en) | The training method of credit fraud detection method and its model, device and server | |
| CN110781308B (en) | Anti-fraud system for constructing knowledge graph based on big data | |
| CN110555455A (en) | Online transaction fraud detection method based on entity relationship | |
| CN106530078A (en) | Loan risk early warning method and system based on multi-industry data | |
| CN107657536A (en) | The recognition methods of social security fraud and device | |
| CN109918452A (en) | A kind of method, apparatus of data processing, computer storage medium and terminal | |
| CN109166030A (en) | A kind of anti-fraud solution and system | |
| CN107729519B (en) | Multi-source multi-dimensional data-based evaluation method and device, and terminal | |
| CN106131017A (en) | Cloud computing information security visualization system based on trust computing | |
| CN109754258A (en) | It is a kind of based on individual behavior modeling towards online trading fraud detection method | |
| CN109472626B (en) | Intelligent financial risk control method and system for mobile phone leasing service | |
| CN110457404A (en) | Social media account-classification method based on complex heterogeneous network | |
| CN107016042B (en) | Address information verification system based on user position log | |
| CN109325845A (en) | A kind of financial product intelligent recommendation method and system | |
| CN112053222A (en) | Knowledge graph-based internet financial group fraud detection method | |
| CN107729939A (en) | A kind of CIM extended method and device towards newly-increased power network resources | |
| Ramaki et al. | Credit card fraud detection based on ontology graph | |
| Yu et al. | Characterizing the spatial-functional network of regional industrial agglomerations: A data-driven case study in China's greater bay area | |
| CN113469755B (en) | Intelligent accurate marketing management system based on advertisement pushing | |
| CN109947817A (en) | A kind of Six Degrees relationship analysis method and system based on association map |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20191105 |