WO2021254027A1

WO2021254027A1 - Method and apparatus for identifying suspicious community, and storage medium and computer device

Info

Publication number: WO2021254027A1
Application number: PCT/CN2021/092940
Authority: WO
Inventors: 陈泽瀛; 吴亚乾; 吴锐; 李欣刚; 陶森林
Original assignee: 银联商务股份有限公司
Priority date: 2020-06-16
Filing date: 2021-05-11
Publication date: 2021-12-23
Also published as: CN111709756A

Abstract

A method and apparatus for identifying a suspicious community, and a storage medium and a computer device. The method comprises: constructing a knowledge graph according to acquired network access information of a plurality of merchant nodes and correlation weight data between different merchant nodes (101); selecting newly added merchant nodes and adjacent merchant nodes of the newly added merchant nodes from the knowledge graph (102); according to association weight data between the newly added merchant nodes and the adjacent merchant nodes of the newly added merchant nodes, performing community detection on the newly added merchant nodes and the adjacent merchant nodes of the newly added merchant nodes, so as to determine a plurality of community groups (103); and according to a plurality of preset community indexes and a plurality of preset service indexes, determining a suspicious community from the plurality of community groups (104). Therefore, the identification efficiency of a suspicious community can be improved.

Description

Method, device, storage medium and computer equipment for identifying suspicious communities

Technical field

This application relates to the technical field of knowledge graphs, in particular to a method, device, storage medium and computer equipment for identifying suspicious communities.

Background technique

With the rapid development of mobile Internet and mobile payment, financial fraud models are also constantly enriched and developed. For example, a number of fraudulent applications, arbitrage, stealing, and gambling gang merchants have emerged in online channels such as self-service signing. Fraud is no longer limited to the individual model, but is carried out through an organized community model. These merchants use the same file information for centralized false network access applications and short-term centralized arbitrage. After arbitrage and arbitrage, it is likely to become Silence merchants or cancel merchants, this kind of fraud will often cause large financial losses due to its large size and short duration, and it is difficult to detect.

In related technologies, the process for new merchants to enter the network is mainly after manually registering the merchant's network entry information, and then manually verifying whether the entry information is true. If the entry information is true, the entry is passed. Since the network access information submitted by the merchants is legal, it is difficult to provide timely and effective early warnings for the above-mentioned suspicious organizations’ online fraud through traditional risk control rules and manual verification methods, resulting in the problem of low efficiency in identifying suspicious organizations.

Application content

In view of this, this application provides a method, device, storage medium and computer equipment for identifying suspicious communities, which can improve the efficiency of identifying suspicious communities.

On the one hand, an embodiment of the present application provides a method for identifying suspicious communities, including:

Construct a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes;

In the knowledge graph, the newly-added merchant node and neighboring merchant nodes of the newly-added merchant node are filtered out;

According to the correlation weight data between the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, perform community detection on the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, and determine multiple communities group;

According to preset multiple community indicators and preset multiple business indicators, a suspicious community is determined from the multiple community groups.

Optionally, before constructing a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes, the method includes:

Determine multiple merchant nodes and related elements between the multiple merchant nodes according to the obtained network access information of multiple merchants;

Different weights are set for different associated elements, and the associated weight data between different merchant nodes is determined according to the associated elements between multiple merchant nodes and the corresponding weight of each associated element, and the associated weight data includes different The sum of the weights corresponding to the related elements between the merchant nodes.

Optionally, the network access information includes network access time;

The filtering out the newly added merchant node and the neighboring merchant nodes of the newly added merchant node includes:

Determining the merchant node whose network access time is within a preset time period as the newly added merchant node;

The number of associated steps between each newly added merchant node and the historical merchant node is calculated, and the historical merchant node whose associated step number is less than the preset number of steps is determined as the neighboring merchant node.

Optionally, the community detection is performed on the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node according to the association weight data between the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node , Identified multiple community groups, including:

Obtain the correlation elements between each newly added merchant node and each neighboring merchant node;

According to the number of associated elements of each newly added merchant node and the corresponding weight of the associated elements, and the number of associated elements of each neighboring merchant node and the corresponding weight of the associated elements, multiple community groups are determined.

Optionally, the multiple preset community indicators include the number of nodes in the community, the number of black merchant nodes in the community, the number of edges in the community, the number of edges outside the community, the degree of aggregation of the community, the weight distribution of the edges in the community, and the importance of the merchant nodes Or the maximum weight of the connected edge of the merchant node.

Optionally, the multiple preset business indicators include the proportion of merchant nodes in an abnormal state, the number of revoked merchant nodes, or the number of verified merchant nodes.

Optionally, after the suspicious community is determined from the multiple community groups based on preset multiple community indicators and multiple preset business indicators, the method further includes:

Calculate the importance of each merchant node in the suspicious community through a centrality algorithm;

Sort the importance of each merchant node from high to low, and determine the top N merchant nodes as highly suspicious merchants.

On the other hand, an embodiment of the present application provides a suspicious community identification device, the device includes:

The building module is used to construct a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes;

The screening module is used for screening the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node in the knowledge graph;

The generating module is used to perform community detection on the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node according to the association weight data between the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node, Identify multiple community groups;

The determining module is used to determine the suspicious community from the multiple community groups based on multiple preset community indicators and multiple preset business indicators.

On the other hand, an embodiment of the present application provides a storage medium that includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned method for identifying a suspicious community.

On the other hand, an embodiment of the present application provides a computer device including a memory and a processor, the memory is used to store information including program instructions, the processor is used to control the execution of the program instructions, and the program instructions are processed. The device loads and executes the steps of the above method for identifying suspicious communities.

In the technical solution provided by the embodiments of the present application, a knowledge graph is constructed based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes, and in the knowledge graph, new merchant nodes and new merchants are screened out The neighboring merchant nodes of the node, based on the correlation weight data between the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, perform community detection on the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, and multiple communities are determined For groups, according to preset multiple community indicators and preset multiple business indicators, suspicious communities are determined from the multiple community groups, so that the efficiency of identifying suspicious communities can be improved.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the following will briefly introduce the drawings that need to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative labor, other drawings can be obtained from these drawings.

FIG. 1 is a flowchart of a method for identifying a suspicious community provided by an embodiment of the present application;

Figure 2 is a flowchart of a method for identifying suspicious communities provided by another embodiment of the present application;

FIG. 3 is a schematic diagram of the structure of merchant nodes and associated elements provided by an embodiment of the present application;

Fig. 4 is a schematic structural diagram of a knowledge graph provided by an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a newly added merchant node and neighboring merchant nodes provided by an embodiment of the present application;

Figure 6 is a schematic diagram of the structure of a community group provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a suspicious community identification device provided by an embodiment of the present application;

FIG. 8 is a schematic diagram of a computer device provided by an embodiment of this application.

detailed description

In order to better understand the technical solutions of the present application, the following describes the embodiments of the present application in detail with reference to the accompanying drawings.

It should be clear that the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms of "a", "the" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

It should be understood that the term "and/or" used in this article is only an association relationship describing related objects, which means that there can be three kinds of relationships. For example, A and/or B can mean that A and B, there are three cases of B alone. In addition, the character "/" in this text generally indicates that the associated objects before and after are in an "or" relationship.

Before introducing a method for identifying suspicious communities provided by the embodiments of this application, a brief introduction to the method for identifying fraudulent groups in related technologies is given:

In related technologies, methods for identifying suspicious communities mainly include manual verification when entering the network and risk control detection after entering the network.

In an implementation scheme, the way of manual verification when entering the network includes: for a new merchant that enters the network, the business personnel collect the network entry information of the merchant, where the network entry information includes business license information, legal person identity information, settlement account number, and region. , Bank account name, network access time and other information. After the business personnel have collected the network access information, they verify whether the information provided by the merchant is true and whether there are bad or illegal records in the industry and commerce or public security system, so as to assess the risk of the merchant applying for the network, and decide whether to allow the merchant to enter the network based on this. However, this method requires a high degree of reliance on business personnel's experience judgment and verification, which is not only inefficient, but also does not have the ability to detect multi-dimensional information.

In another implementation scheme, the method of risk control detection after entering the network includes: after the merchant enters the network, determine whether the merchant has suspicious improper transactions based on the transaction behavior that occurs at the merchant, and thereby determine whether the merchant is a suspicious merchant . However, the main shortcomings of the risk control detection method after entering the network are the high latency, which is highly dependent on the later transaction behavior, and the detection in the large data volume and multi-dimensional scenarios has the disadvantages of complex calculations, less coverage scenarios, and high time costs. .

In the above-mentioned fraudulent group identification method, manual verification is performed when entering the network. In addition to verifying the accuracy of the data, the reviewer needs to verify the information of other merchants that have the same file information as the merchant. For large data volume, multi-dimensional file information, and more The community information reviewer under the degree of association cannot perform manual verification, which causes the problem of high time cost, and the scheme in the related technology accurately divides the community group. The risk control detection after access to the network is a post-mortem detection of fraud, which relies heavily on the transaction information that occurs on the merchant, and cannot effectively detect the fraudulent access to the network in a timely manner.

Regarding the method for identifying fraudulent groups in related technologies, an identification method for suspicious organizations is provided in the embodiments of the present application to solve problems existing in related technologies.

Fig. 1 is a flowchart of a method for identifying a suspicious community provided by an embodiment of the application. As shown in Fig. 1, the method includes:

Step 101: Construct a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes.

In this embodiment of the application, the network access information may include network access information including business license information, legal person identity information, settlement account number, region to which it belongs, bank account name, network access time and other information. The merchant node is used to indicate the merchant entity. For example, if the network access information of the merchant A is obtained, the merchant A is used as the merchant node. The correlation element is used to indicate the same network access information among multiple merchant nodes. For example, if the legal person identity information of the merchant node A and the merchant node B is the same, the legal person identity information is the correlation element between the merchant node A and the merchant node B.

In the embodiment of the present application, the associated weight data includes the sum of weights corresponding to the associated elements between different merchant nodes. For details, please refer to the description of the following embodiments.

Step 102: In the knowledge graph, filter out the newly added merchant node and the neighboring merchant nodes of the newly added merchant node.

In the embodiment of the present application, the merchant node whose network access time is within the preset time period is determined as the newly added merchant node. The number of associated steps between each newly added merchant node and the historical merchant node is calculated, and the historical merchant node whose associated step number is less than the preset number of steps is determined as the neighboring merchant node.

Step 103: Perform community detection on the newly-added merchant node and neighboring merchant nodes of the newly-added merchant node according to the correlation weight data between the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node, and determine multiple community groups.

In the embodiment of the present application, the associated elements between each newly added merchant node and each neighboring merchant node are obtained, according to the number of associated elements of each newly added merchant node and the weight corresponding to the associated elements, and each neighboring merchant node The number of related elements and the corresponding weights of related elements determine multiple community groups.

Step 104: Determine a suspicious community from multiple community groups according to multiple preset community indicators and multiple preset business indicators.

In the embodiment of this application, the preset multiple community indicators include the number of nodes in the community, the number of black merchant nodes in the community, the number of edges in the community, the number of edges outside the community, the degree of community aggregation, the weight distribution of the edges in the community, and the importance of merchant nodes Or the maximum weight of the connected edge of the merchant node. The preset multiple business indicators include the proportion of merchant nodes in an abnormal state, the number of cancelled merchant nodes, or the number of verified merchant nodes.

In the technical solution provided by the embodiments of the present application, a knowledge graph is constructed based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes. In the knowledge graph, new merchant nodes and new merchants are screened out The neighboring merchant nodes of the node, based on the correlation weight data between the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, perform community detection on the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, and multiple communities are determined Groups, according to preset multiple community indicators and preset multiple business indicators, determine suspicious communities from multiple community groups, thereby improving the efficiency of identifying suspicious communities.

Fig. 2 is a flowchart of a method for identifying a suspicious community provided by another embodiment of this application. As shown in Fig. 2, the method includes:

Step 201: Determine multiple merchant nodes and related elements between multiple merchant nodes according to the obtained network access information of multiple merchants.

In the embodiment of the present application, in the process of performing step 201, the network access information of multiple merchants is processed in batches through the big data component, and the associated elements between the merchant node and the multiple merchant nodes are extracted from the network access information, so as to quickly establish The relationship between merchant nodes in order to build a knowledge graph in the subsequent steps. Among them, big data components can include Hive+Hadoop components. For example, as shown in Figure 3, merchant node 0, merchant node 1, merchant node 2, merchant node 3, merchant node 4, merchant node 5, merchant node 6 are extracted from the network access information. In addition, the network access information is also extracted The associated element between merchant node 0 and merchant node 1 is the business address, the associated element between merchant node 4 and merchant node 1, and merchant node 2 is corporate identity information, and the associated element between merchant node 4 and merchant node 3 For legal person identification information and business license information. The associated element between the merchant node 4, the merchant node 5, and the merchant node 6 is the settlement account number.

It should be noted that before step 201 is executed, it also includes performing data standardization processing and abnormal data filtering processing on the obtained network access information of multiple merchants. Since there are many sources of network access information, the network access information of merchants obtained includes structured information and unstructured information. Therefore, it is necessary to perform data standardization processing on all network access information, and perform information blending on the network access information of merchants and convert them into standard format. Secondly, because the original network access information has input errors, data type conversion abnormalities, etc., it is also necessary to filter abnormal data in the merchant’s network access information. The filter processing can include null value processing, special symbol processing, etc. The abnormal data filtering processing on the network access information can avoid the occurrence of abnormal association relationships between merchants.

Step 202: Set different weights for different associated elements, and determine the associated weight data between different merchant nodes according to the associated elements between multiple merchant nodes and the corresponding weight of each associated element, and the associated weight data includes The sum of the weights corresponding to the related elements between different merchant nodes.

Before performing step 202, it should be noted that the method for identifying suspicious communities provided by this application can be applied to systems that cannot handle heterogeneous graphs (different types of nodes). Therefore, before constructing a knowledge graph (isomorphic graph) , It is necessary to perform aggregation operations on different related elements in order to complete the conversion of a heterogeneous map to a homogeneous map (the same type of node). For the specific conversion method, please refer to the description of step 203 below. In the embodiments of this application, because the importance of different related elements is different, when aggregating different related elements, it is necessary to assign different weights to different related elements, so as to be able to complete the conversion from a heterogeneous map to a homogeneous map. In addition, , Assigning different weights to different related elements can further improve the accuracy of the identification of suspicious communities.

In the embodiments of this application, because the importance of different related elements is different, for example, the importance of business license information is greater than the importance of legal person identity information, so when setting the weight of related elements, the weight of business license information is more important than legal person identity The weight of the information. Specifically, by performing step 202, the subsequent step 203 can convert the above-mentioned heterogeneous map of FIG. 3 to construct the isomorphic map of FIG. 4, as shown in FIG. 4, for example, between merchant node 0 and merchant node 1. The weight of the business address is w4, and the associated weight data between merchant node 0 and merchant node 1 is w4. The weight of the corporate identity information between the merchant node 4 and the merchant node 3 is w1 and the weight of the business license information is w2, then the correlation weight data between the merchant node 4 and the merchant node 3 is w1+w2, regarding the heterogeneous map conversion For the process to the isomorphic map, refer to the description of step 203 below.

Step 203: Construct a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes.

In the embodiments of this application, before constructing the knowledge graph (isomorphic graph), the process of transforming heterogeneous graphs (different types of nodes) into isomorphic graphs (same type of nodes) is briefly introduced:

For example, as shown in Figure 3, merchant node 0, merchant node 1, merchant node 2, merchant node 3, merchant node 4, merchant node 5, merchant node 6, business address 1, business license 1, legal person are extracted from the network access information Identity information 1 and settlement account number 1, that is, the heterogeneous graph of FIG. 3 includes multiple types of nodes, including merchant nodes, business address nodes, business license nodes, legal person identity information nodes, and settlement account nodes.

Because in the subsequent identification process of suspicious communities, a knowledge graph (isomorphic graph) needs to be constructed. Since the isomorphic map can more intuitively see the relationship between the merchant nodes, and at the same time, because the importance of different related elements is different, when different related elements are aggregated, different related elements are given different weights. Therefore, in the process of transforming heterogeneous graphs (different types of nodes) into isomorphic graphs (same type of nodes), while aggregating different related elements into a homogeneous edge, it is also necessary to carry out the weighting of different related elements. Sum, determine the correlation weight data between different merchant nodes, so that the heterogeneous map can be converted into a homogeneous map. Specifically, as shown in FIG. 3, the weight of the business address between the merchant node 0 and the merchant node 1 is w4, and as shown in FIG. 4, the correlation weight data between the merchant node 0 and the merchant node 1 is w4. As shown in Figure 3, the weight of the corporate identity information between the merchant node 4 and the merchant node 3 is w1 and the weight of the business license information is w2, then as shown in Figure 4, the association between the merchant node 4 and the merchant node 3 The weight data is w1+w2 to convert other types of nodes, so that only the merchant node is included in Figure 4, thereby completing the conversion from a heterogeneous map to a homogeneous map. As shown in Figure 4, Figure 4 includes 7 merchant nodes, and each merchant node has an associated weight data between the historical merchant node, and the associated weight data includes the correlation element correspondence between the merchant node and the historical merchant node The sum of the weights. It should be noted that the knowledge map of this application is the converted isomorphic map.

It should be noted that in an optional solution, before the knowledge graph is constructed, if the correlation weight data between different merchant nodes is lower than the preset value, there is no need to construct the knowledge graph based on these merchant nodes, which can reduce the construction of the knowledge graph. The calculation time of the knowledge graph reduces the amount of calculation for subsequent identification of suspicious communities.

It should be noted that in the process of constructing the knowledge graph, multiple merchant nodes and the associated weight data between different merchant nodes can be imported into the graph database, and the merchant nodes are converted into vertices through the graph database, and the different merchant nodes The associated weight data of is transformed into edges to complete the construction of the knowledge graph. The graph database that can be used in the process of constructing the knowledge graph in the embodiment of the present application includes Neo4j, and the graph database can facilitate data query and data modification.

Step 204: In the knowledge graph, filter the newly added merchant node and the neighboring merchant nodes of the newly added merchant node.

In this embodiment of the application, before step 204 is performed, it also includes: when a new merchant node is connected to the network, the network access information of multiple new merchant nodes and the associated weights between multiple new merchant nodes and other merchant nodes need to be added The data is added to the existing knowledge graph. Among them, the correlation weight data between multiple newly added merchant nodes and other merchant nodes may include the correlation weight data between multiple newly added merchant nodes, and the newly added merchant nodes and historical merchants Association weight data between nodes. Therefore, when the complete knowledge graph is used to identify suspicious communities, due to the continuous accumulation of data, not only requires extremely high time consumption, but also requires relatively high resource requirements for single-node servers. In addition, since the non-neighboring historical merchant node and the newly-added merchant node are relatively far from each other, and the correlation is not strong, the embodiment of the present application performs step 204 to select the newly-added merchant node in the knowledge graph by performing step 204 before the identification of the suspicious community And the neighboring merchant node of the newly added merchant node, which can greatly reduce the amount of data and reduce the response time.

In the embodiment of the present application, step 204 may specifically include:

Step 2041, a merchant node whose network access time is within a preset time period is determined as a new merchant node.

In the embodiment of the present application, the network access information of the merchant node includes the network access time. The preset time period can be set according to the needs. For example, taking 1 month as the preset time period, the merchant nodes within May and before May are already in the knowledge graph, so the merchants who will be online within 6 months The node is determined to be a new merchant node.

Step 2042, calculate the number of associated steps between each newly added merchant node and the historical merchant node, and determine the historical merchant node whose associated step number is less than the preset number of steps as neighboring merchant nodes.

In the embodiment of the present application, the number of associated steps is used to indicate the number of edges in the knowledge graph, and the preset number of steps can be set according to requirements, for example, the preset number of steps includes 3 steps.

In an alternative solution, for example, as shown in Fig. 5, merchant node 7 and merchant node 8 are newly-added merchant nodes. Taking merchant node 7 as an example, the number of associated steps between merchant node 7 and merchant node 5 Is 1 step, the number of associated steps between merchant node 7 and merchant node 6 is 2 steps, the number of associated steps between merchant node 7 and merchant node 4 is 2 steps, and the number of associated steps between merchant node 7 and merchant node 3 The number is 3 steps, the number of associated steps between merchant node 7 and merchant node 2 is 3, and the number of associated steps between merchant node 7 and merchant node 1 is 3 steps, therefore, merchant nodes 1-6 are merchant nodes 7 neighboring merchant nodes.

It should be noted that if the new merchant includes multiple new merchant nodes, only the number of associated steps between any new merchant node and the historical merchant node is less than the preset number of steps. For example, as shown in Figure 5, merchant node 7 and merchant node 8 in Figure 5 are new merchant nodes, and merchant nodes 1-6 are all neighboring merchant nodes of merchant node 7, so merchant nodes 1-6 are merchant nodes 8 neighboring merchant nodes.

In the embodiment of this application, through step 204, in the knowledge graph, the newly added merchant nodes and the neighboring merchant nodes of the newly added merchant nodes are screened out, which can greatly reduce the time cost of calculating suspicious communities, and it is necessary to process the newly added merchant nodes regularly in a short period of time. The network access information of the merchant node, so that the time delay is relatively low, and the risk warning response is relatively timely.

Step 205: Obtain the associated elements between each newly added merchant node and each neighboring merchant node.

In the embodiment of the present application, the execution process of step 205 can be referred to step 201 above. The difference is that step 201 is to determine multiple merchant nodes and related elements between multiple merchant nodes based on the obtained network access information of multiple merchants. And step 205 is to determine multiple newly-added merchant nodes and the associated elements between each newly-added merchant node and each neighboring merchant node according to the acquired network access information of the newly-added merchant.

Step 206: Determine a plurality of community groups according to the number of associated elements of each newly added merchant node and the corresponding weight of the associated elements, and the number of associated elements of each neighboring merchant node and the corresponding weight of the associated elements.

In the embodiments of this application, the process of determining multiple community groups can be achieved by using a label propagation algorithm (Label Propagation Algorithm, LPA for short). LPA detects community groups through a network structure, thereby eliminating the need for pre-defined objective functions or prior information , The merchant nodes with the higher the degree of aggregation and the merchant nodes with the greater number of associated weights are determined as the same community group, and the merchant nodes in the same community group are pre-marked with the same community label so that LPA can be semi-supervised Run to improve accuracy.

In a possible implementation scheme, for example, as shown in FIG. 6, by performing step 206, it is determined that the merchant node 1, the merchant node 2, the merchant node 3, and the merchant node 4 are the same community group, that is, the community 1. Merchant node 5, merchant node 6, merchant node 7, and merchant node 8 are the same community group, namely community 2.

Step 207: Determine the suspicious community from the multiple community groups according to multiple preset community indicators and multiple preset business indicators.

In the embodiment of this application, the preset multiple community indicators include the number of nodes in the community, the number of black merchant nodes in the community, the number of edges in the community, the number of edges outside the community, the degree of aggregation of the community, the weight distribution of the edges in the community, and the importance of the merchant nodes. Or the maximum weight of the connected edge of the merchant node. Among them, the community index is used to measure the degree of community aggregation of the community group, the number of nodes in the community is used to indicate the number of merchant nodes in each community group, and the number of black merchant nodes in the community is used to indicate the trigger risk in each community group Cases and the number of black merchant nodes. The number of edges in the community is used to indicate the number of associated edges between merchant nodes within the community group, and the number of edges outside the community is used to indicate the number of connected edges between the community group and external community groups, and the degree of community aggregation Used to indicate the level of community aggregation, that is, the ratio of the number of edges in the community to the theoretical maximum number of edges. The maximum theoretical number of edges in the community group is calculated from the number of nodes in the community, that is, for a community with n nodes, the maximum two-way theory The number of edges is:

The maximum number of one-way theoretical edges is:

The weight distribution of the inner edge of the community is used to indicate the distribution of the weight of the inner edge of the statistical community group among the partitions. The maximum weight of the connected edge of a merchant node is used for the largest weight among all connected edges of each merchant node, that is, the largest weight among all the associated elements of each merchant node.

In the embodiment of this application, the business indicators include multiple business indicators preset by calculating relevant indicators from the perspective of business rules, including the proportion of merchant nodes in an abnormal state, the number of merchant nodes that are cancelled, or the number of merchant nodes that are verified. In addition, you can also Including other parameters, this application does not limit it.

In the embodiment of this application, after multiple community groups are determined through step 206, not every community group is a suspicious community. Therefore, step 207 needs to be performed according to preset multiple community indicators and preset multiple business indicators. , Filter the results of all associations to filter out suspicious associations, which can improve the accuracy of the identification of suspicious associations.

Step 208: Calculate the importance of each merchant node in the suspicious community through the centrality algorithm.

In this embodiment of the application, by calculating the importance of each merchant node in the suspicious community, in addition to being used as the preset community indicator in step 207, it can also facilitate the subsequent steps to screen out highly suspicious merchants and output high Suspicious merchants for review by reviewers. In addition, the PageRank algorithm can also be used to calculate the importance of each merchant node in the suspicious community. The PageRank algorithm can measure the transfer effect of merchant nodes. Often this merchant node is more important and suspicious, so it needs to be a priority check object.

Step 209: Sort the importance of each merchant node from high to low, and determine the top N merchant nodes as highly suspicious merchants.

In the embodiments of this application, the value of N can be set according to requirements, which is not limited in this application. By performing step 209, the top N merchant nodes are determined as highly suspicious merchants, so that the auditor can check whether the highly suspicious merchants are fraudulent merchants.

This application provides a method for detecting online fraud by merchant groups based on knowledge graphs. The file information provided by the merchants when they enter the network is extracted through data standardization processing, data filtering and other processes, and different weights are set for different file information. In this way, it is compatible with file information of different dimensions and constructs a knowledge graph of business association relationships. On the basis of the established knowledge graph of merchant association relations, and in view of the weaker relationship between distant relative merchant nodes and new merchants, this method reduces the data volume and calculation cost by sampling the data of the neighbors of the new merchants. The sampled merchant network runs LPA and PageRank for unsupervised weighted community detection and importance calculation. Finally, for the community detection results, this method calculates community indicators and business indicators, and screens out suspicious communities (suspicious fraud groups) based on the calculated indicators, and outputs the community results and related calculation indicators.

In the technical solution provided by the embodiments of the present application, a knowledge graph is constructed based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes, and in the knowledge graph, new merchant nodes and new merchants are screened out The neighboring merchant nodes of the node, based on the correlation weight data between the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, perform community detection on the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, and multiple communities are determined Groups, according to preset multiple community indicators and preset multiple business indicators, determine suspicious communities from multiple community groups, thereby improving the efficiency of identifying suspicious communities.

FIG. 7 is a schematic structural diagram of a suspicious community identification device provided by an embodiment of the present application. As shown in FIG. 7, the device includes: a construction module 11, a screening module 12, a generation module 13, and a determination module 14.

The construction module 11 is used to construct a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes.

The screening module 12 is used for screening the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node in the knowledge graph.

The generating module 13 is configured to perform community detection on the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node according to the correlation weight data between the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node, Identify multiple community groups.

The determining module 14 is configured to determine a suspicious community from the multiple community groups based on multiple preset community indicators and multiple preset business indicators.

In the embodiment of the present application, the device further includes:

The determining module 14 is also used to determine multiple merchant nodes and the associated elements between the multiple merchant nodes according to the obtained network access information of multiple merchants; set different weights for different associated elements, and set different weights according to the multiple The correlation elements between the merchant nodes and the weight corresponding to each correlation element determine the correlation weight data between the different merchant nodes, and the correlation weight data includes the sum of the weights corresponding to the correlation elements between the different merchant nodes.

In the embodiment of the present application, the network access information includes the network access time; the screening module 12 of the device specifically includes: a determination sub-module 121 and a calculation sub-module 122.

The determining submodule 121 is configured to determine a merchant node whose network access time is within a preset time period as the newly added merchant node.

The calculation sub-module 122 calculates the number of associated steps between each newly added merchant node and the historical merchant node.

The determining submodule 121 is further configured to determine a historical merchant node whose associated number of steps is less than a preset number of steps as the neighboring merchant node.

In the embodiment of the present application, the generating module 13 of the device specifically includes: an obtaining sub-module 131 and a determining sub-module 132.

The acquiring sub-module 131 is used to acquire the associated elements between each newly added merchant node and each neighboring merchant node.

The determining sub-module 132 is used to determine a plurality of community groups according to the number of associated elements of each newly added merchant node and the corresponding weight of the associated elements, and the number of associated elements of each neighboring merchant node and the corresponding weight of the associated elements.

In the embodiment of this application, the multiple preset community indicators include the number of nodes in the community, the number of black merchant nodes in the community, the number of edges in the community, the number of edges outside the community, the degree of community aggregation, the weight distribution of the edges in the community, and the number of merchant nodes. The degree of importance or the maximum weight of the connected edge of the merchant node.

In this embodiment of the application, the multiple preset business indicators include the proportion of merchant nodes in an abnormal state, the number of revoked merchant nodes, or the number of verified merchant nodes.

In the embodiment of the present application, the device further includes: a calculation module 15.

The calculation module 15 is used to calculate the importance of each merchant node in the suspicious community through a centrality algorithm.

The determining module 14 is also used to rank the importance of each merchant node from high to low, and determine the top N merchant nodes as highly suspicious merchants.

The embodiment of the present application provides a storage medium, the storage medium includes a stored program, where the device where the storage medium is located is controlled to execute each step of the above-mentioned suspicious community identification method when the program is running. For specific description, please refer to the above-mentioned suspicious community Examples of identification methods.

The embodiment of the present application provides a computer device including a memory and a processor, the memory is used to store information including program instructions, the processor is used to control the execution of the program instructions, and the program instructions are loaded and executed by the processor to realize the above suspicious community Identify the steps of the method. For specific description, please refer to the above-mentioned embodiment of the method for identifying suspicious communities.

FIG. 8 is a schematic diagram of a computer device provided by an embodiment of this application. As shown in FIG. 8, the computer device 4 of this embodiment includes: a processor 41, a memory 42, and a computer program 43 that is stored in the storage 42 and can run on the processor 41. When the computer program 43 is executed by the processor 41, In order to avoid repetition, the method for identifying the suspicious community in the implementation embodiment will not be repeated here. Or, when the computer program is executed by the processor 41, the function of each model/unit in the device for identifying suspicious communities in the embodiment is realized. To avoid repetition, it will not be repeated here.

The computer device 4 includes, but is not limited to, a processor 41 and a memory 42. Those skilled in the art can understand that FIG. 8 is only an example of the computer device 4, and does not constitute a limitation on the computer device 4. It may include more or less components than those shown in the figure, or a combination of certain components, or different components. For example, the computer device 4 may also include input and output devices, network access devices, buses, and so on.

The so-called processor 41 may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

The memory 42 may be an internal storage unit of the computer device 4, such as a hard disk or a memory of the computer device 4. The memory 42 may also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, and a flash memory card (Flash). Card) and so on. Further, the memory 42 may also include both an internal storage unit of the computer device 4 and an external storage device. The memory 42 is used to store computer programs and other programs and data required by the computer device 4. The memory 42 can also be used to temporarily store data that has been output or will be output.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional units.

The above-mentioned integrated unit implemented in the form of a software functional unit may be stored in a computer readable storage medium. The above-mentioned software functional unit is stored in a storage medium, and includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (Processor) execute the method described in each embodiment of the present application. Part of the steps. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

The above descriptions are only preferred embodiments of this application, and are not intended to limit this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in this application Within the scope of protection.

Claims

A method of identifying suspicious associations, including:

Construct a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes;

In the knowledge graph, the newly-added merchant node and neighboring merchant nodes of the newly-added merchant node are filtered out;

According to the correlation weight data between the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, perform community detection on the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, and determine multiple communities group;

According to preset multiple community indicators and preset multiple business indicators, a suspicious community is determined from the multiple community groups.
The method according to claim 1, before said constructing a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes, comprising:

Determine multiple merchant nodes and related elements between the multiple merchant nodes according to the obtained network access information of multiple merchants;

Different weights are set for different associated elements, and the associated weight data between different merchant nodes is determined according to the associated elements between multiple merchant nodes and the corresponding weight of each associated element, and the associated weight data includes different The sum of the weights corresponding to the related elements between the merchant nodes.
The method according to claim 1, wherein the network access information includes network access time;

The filtering out the newly added merchant node and the neighboring merchant nodes of the newly added merchant node includes:

Determining the merchant node whose network access time is within a preset time period as the newly added merchant node;

The number of associated steps between each newly added merchant node and the historical merchant node is calculated, and the historical merchant node whose associated step number is less than the preset number of steps is determined as the neighboring merchant node.
The method according to claim 2, wherein according to the correlation weight data between the newly added merchant node and the neighboring merchant nodes of the newly added merchant node, the neighboring of the newly added merchant node and the newly added merchant node Merchant nodes conduct community detection and identify multiple community groups, including:

Obtain the correlation elements between each newly added merchant node and each neighboring merchant node;

According to the number of associated elements of each newly added merchant node and the corresponding weight of the associated elements, and the number of associated elements of each neighboring merchant node and the corresponding weight of the associated elements, multiple community groups are determined.
The method according to claim 1, wherein the plurality of preset community indicators include the number of nodes in the community, the number of black merchant nodes in the community, the number of edges in the community, the number of edges outside the community, the degree of community aggregation, the weight distribution of the edges in the community, The importance of the merchant node or the maximum weight of the connected edge of the merchant node.
The method according to claim 1, wherein the plurality of preset business indicators include the proportion of merchant nodes in an abnormal state, the number of revoked merchant nodes, or the number of verified merchant nodes.
The method according to claim 1, after determining a suspicious community from the multiple community groups based on the multiple preset community indicators and the multiple preset business indicators, the method further comprises:

Calculate the importance of each merchant node in the suspicious community through a centrality algorithm;

Sort the importance of each merchant node from high to low, and determine the top N merchant nodes as highly suspicious merchants.
A device for identifying suspicious associations, including:

The building module is used to construct a knowledge graph based on the obtained network access information of multiple merchant nodes and the associated weight data between different merchant nodes;

The screening module is used for screening the newly added merchant node and the neighboring merchant nodes of the newly added merchant node in the knowledge graph;

The generating module is used to perform community detection on the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node according to the association weight data between the newly-added merchant node and the neighboring merchant nodes of the newly-added merchant node, Identify multiple community groups;

The determining module is used to determine the suspicious community from the multiple community groups based on multiple preset community indicators and multiple preset business indicators.
A storage medium, the storage medium includes a stored program, wherein the device where the storage medium is located is controlled to execute the method for identifying a suspicious community according to any one of claims 1 to 7 when the program is running.
A computer device comprising a memory and a processor, the memory is used to store information including program instructions, the processor is used to control the execution of the program instructions, and the program instructions are loaded and executed by the processor to implement claims 1 to 7 Steps of the method for identifying suspicious communities as described in any one of them.