CN110046499A - The method, device and equipment that a kind of pair of risk subjects are identified - Google Patents
The method, device and equipment that a kind of pair of risk subjects are identified Download PDFInfo
- Publication number
- CN110046499A CN110046499A CN201811476791.XA CN201811476791A CN110046499A CN 110046499 A CN110046499 A CN 110046499A CN 201811476791 A CN201811476791 A CN 201811476791A CN 110046499 A CN110046499 A CN 110046499A
- Authority
- CN
- China
- Prior art keywords
- identified
- risk
- positive
- determining
- classification
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 38
- 239000013598 vector Substances 0.000 claims abstract description 55
- 238000010586 diagram Methods 0.000 abstract description 17
- 230000006870 function Effects 0.000 description 22
- 238000003066 decision tree Methods 0.000 description 9
- 238000003860 storage Methods 0.000 description 8
- 238000004590 computer program Methods 0.000 description 7
- 238000004422 calculation algorithm Methods 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 5
- 230000008569 process Effects 0.000 description 5
- 238000012545 processing Methods 0.000 description 4
- 230000000694 effects Effects 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 238000012935 Averaging Methods 0.000 description 1
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000004075 alteration Effects 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000005284 excitation Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 238000007477 logistic regression Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
- G06F18/2411—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on the proximity to a decision surface, e.g. support vector machines
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/29—Graphical models, e.g. Bayesian networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Artificial Intelligence (AREA)
- Software Systems (AREA)
- Computer Security & Cryptography (AREA)
- Life Sciences & Earth Sciences (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Computer Hardware Design (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Subject description discloses the method, device and equipments that a kind of pair of risk subjects are identified.This method comprises: obtaining diagram data, wherein include object to be identified in the diagram data, the object to be identified includes at least account or equipment；The feature vector for obtaining the object to be identified, the feature as the object to be identified；According to the feature of the object to be identified, risk subjects are determined.
Description
Technical Field
The present disclosure relates to the field of computer technologies, and in particular, to a method, an apparatus, and a device for identifying a risk object.
Background
The vigorous development of the internet technology brings convenient life to people. Meanwhile, a plurality of lawbreakers carry out lawbreaks such as fraud and the like by utilizing the rapidly developed internet technology, and a large amount of capital loss is brought to people. Through statistics, a large number of accounts may be registered in the same device, such as the same mobile phone or computer, and the accounts may be used for network fraud rather than normal accounts. Here, accounts are defined whether or not fraud is involved, as long as the account of abnormal usage is a potentially fraudulent account. At present, a great deal of fraud is paid through the potential fraud account. Of course, if a device registers multiple accounts, the ideal determination needs to be made according to the behaviors after the accounts, such as normal online and offline shopping and account transfer, which are non-potential fraudulent accounts. However, information for such a decision is often not available until several months later. The lawbreakers are likely to use the time period to conduct acts such as fraud and the like, and great loss is brought to the user funds.
In the prior art, the wind control for identifying potential fraud accounts more quickly is blank, and no system solution exists. Therefore, in the wind control system of the payment bank, the method for identifying and finding potential fraudulent account numbers more quickly has important significance in wind control safety.
Disclosure of Invention
The embodiment of the specification provides a method, a device and equipment for identifying risk objects. The problem of in the prior art to the wind accuse that recognizes potential fraud account number more quickly be blank, do not have the solution of system is solved.
In order to solve the above technical problem, the embodiments of the present specification are implemented as follows:
the method for identifying the risk object provided by the embodiment of the specification comprises the following steps:
acquiring graph data, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment;
acquiring a feature vector of the object to be identified as a feature of the object to be identified;
and determining a risk object according to the characteristics of the object to be identified.
The device for identifying the risk object provided by the embodiment of the specification comprises: the system comprises an image data acquisition module, a characteristic vector acquisition module and a risk object determination module;
the graph data acquisition module is used for acquiring graph data, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment;
the characteristic vector acquisition module is used for acquiring the characteristic vector of the object to be identified as the characteristic of the object to be identified;
and the risk object determining module is used for determining a risk object according to the characteristics of the object to be identified.
An apparatus for identifying a risk object provided in an embodiment of the present specification includes: at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to:
acquiring graph data, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment;
acquiring a feature vector of the object to be identified as a feature of the object to be identified;
and determining a risk object according to the characteristics of the object to be identified.
The embodiment of the specification adopts at least one technical scheme which can achieve the following beneficial effects: compared with the prior art of manually identifying potential fraud account numbers, the method for identifying the risk object by using the graph calculation method is faster, and reduces the fund loss of normal users.
Drawings
In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only some embodiments described in the present specification, and for those skilled in the art, other drawings can be obtained according to the drawings without any creative effort.
Fig. 1 is a schematic flowchart of a method for identifying a risk object according to an embodiment of the present disclosure;
FIG. 2 is a schematic diagram of a decision tree provided in an embodiment of the present disclosure;
fig. 3 is a schematic structural diagram of an apparatus for identifying a risk object according to an embodiment of the present disclosure;
fig. 4 is a schematic structural diagram of an apparatus for identifying a risk object according to an embodiment of the present disclosure.
Detailed Description
The embodiment of the specification provides a method, a device and equipment for identifying risk objects.
In order to make those skilled in the art better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be clearly and completely described below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be obtained by a person skilled in the art without making any inventive step based on the embodiments of the present disclosure, shall fall within the scope of protection of the present application.
At present, in the period of time of obtaining the result of judging the potential fraud account, lawless persons carry out a large amount of fraud behaviors, and huge loss is brought to the user funds. Therefore, the technical scheme capable of identifying the potential fraud account in advance is provided, and the fund loss of the user is reduced. In the embodiment provided by the specification, the potential fraudulent account identification is carried out by utilizing a node vector representation method of a semi-supervised learning heterogeneous network graph (the nodes have different properties, for example, the nodes can represent a certain account or equipment). Compared with a supervised learning algorithm, the semi-supervised algorithm has better effect under the condition of small labeling quantity. The whole semi-supervised learning system is divided into two parts: A. unsupervised learning: generating vector representation of accounts and equipment as features by using an unsupervised graph node vector generation algorithm; B. and (3) supervision and learning: and performing supervised learning by using a GBDT (gradient Boosting decision Tree) classifier and combining unsupervised learning to generate good features.
Fig. 1 is a schematic flowchart of a method for identifying a risk object according to an embodiment of the present disclosure, where the schematic flowchart includes:
step 105, obtaining graph data, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment;
in the embodiment of the present specification, the unsupervised learning includes two steps: firstly, graph data is obtained, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment. In the present specification embodiment, the graph data is an account-device graph; the second is to learn the feature vector representation of the nodes (accounts, devices) in the graph as features.
It should be noted here that the object to be identified contains risk information.
The method comprises the steps of acquiring an account-device graph part in unsupervised learning, acquiring account registration conditions in the past period from a graph database and/or a distributed file system, and associating corresponding device information from the graph database and/or the distributed file system. If an account is registered from a device, an edge exists between the account and the device, and the edge represents that an association relationship exists between the account and the device, so that an account-device graph can be formed.
It should be noted that, in this embodiment of this specification, as an optional implementation manner, if a transfer account corresponding to the account or a friend account corresponding to the account is associated from a graph database and/or a distributed file system, an account-account graph is obtained. In the following part of the embodiment of the present specification, an account-device diagram is obtained as an example.
Step 110, obtaining a feature vector of the object to be identified as a feature of the object to be identified;
in the present specification embodiment, the feature vector representation of a node (account, device) in the account-device graph is learned as a feature for the unsupervised learning section. The account nodes and the equipment nodes are not distinguished, and the original account nodes and the original equipment nodes are represented by random vectors. As an optional implementation mode, random vectors of each node are mapped to the same vector space by using a loss function, and the relationship between the vectors is monitored to meet certain constraint. Specifically, we represent the problem as an optimization problem, which uses the value of the click operation of two vectors to represent the similarity, and a specific loss function, such as,
wherein L isGIs a loss function, T (w) is a neighbor node (the hop number does not exceed a certain set value) of the node w,is when node c' meets the expected value of the node probability distribution, E is the mathematical expectation, u (w) represents a point sample distribution for point w, σ is the excitation function of the neural network, λ is a settable hyper-parameter,it is shown that the node w is,representing node c. According to the formula, finally, the feature vector representation of each node can be obtained as the features of the account.
As an optional implementation, the feature vector is a set of features of the account; wherein, in the present specification embodiment, the dimension of the feature vector is 100 dimensions. Each dimension of the feature vector is a feature of the account. One feature value is used in each dimension to represent the corresponding feature of the dimension.
And step 115, determining a risk object according to the characteristics of the object to be identified.
In the embodiment of the specification, the GBDT classifier is adopted in the supervision and learning part, the method has good accuracy, and the off-line algorithm with low speed requirement can obtain better accuracy which is better than the Logistic regression algorithm.
It should be noted that, before step 115 is executed, the GBDT classifier (prediction function) is trained. Inputting a group of characteristics of a sample with a label into a prediction function with adjustable parameters, and calculating a positive and negative category probability by the prediction function; the probability and the label of the sample are substituted into the loss function to obtain a value (real number); this value will adjust the parameters of this prediction function. In the prediction process, after a group of characteristics of an unlabeled sample is input into a prediction function with fixed parameters, the prediction function can calculate a positive and negative class probability. First we label pre-define the nodes in the graph data structure. The node (account node or device node) is represented by 0 as a potential fraudulent account number, and the node (account node or device node) is represented by 1 as a normal account number, thus forming a two-classification problem. Specifically, the method comprises the following steps:
at the same time, useAnd (4) representing the label predicted value (positive and negative category probability) of the account number i predicted by the model. This value is one [0,1 ]]The real number of (2). Here we present a generalized loss function, first defining a derivable functionGenerally, its specific mathematical expression may be a decision tree (of course, a Logistic model, etc. may also be used). As shown in FIG. 2, is a simple decision tree, such asSatisfying a certain condition x in the root node<3, it will go to the left, otherwise it will go to the right. In a similar manner, go all the way. The effect of a single decision tree is often poor, but after a forest is formed by a plurality of trees, the classification effect is greatly improved, and the core of GBDT is to form the decision trees into the forest, specifically, a loss function is utilized
Where L is the penalty function of the GBDT classifier, uiVector representation representing the account number i, f is an arithmetic function, common such as averaging, used to sum the results obtained for each block to form a total score, Ω (f) is a regularization term to prevent overfitting, giAnd hiRespectively representThe first and second derivatives of (a) and (b),is a derivable function, ziA value representing a predefined tag is indicated,a label prediction value (positive and negative category probability) representing the account number i predicted by the model, specifically, obtaining a value (real number); this value will adjust the parameters of the prediction function to obtain a fixed-parameter prediction function (GBDT classifier).
Calculating to obtain the positive and negative class probability of the object to be recognized by utilizing a trained GBDT classifier according to a group of characteristics of the object to be recognized; and determining whether the object to be recognized belongs to the positive classification or the negative classification according to the positive and negative classification probabilities of the object to be recognized. And if the positive and negative category probability is smaller than the preset probability value, determining that the account belongs to the negative category and has a potential fraud account number. And if the real number is greater than or equal to the preset probability value, determining that the account belongs to the positive classification and has a normal account number. It should be noted that the positive classification and the negative classification in the embodiment of the present specification represent two classification results of the GBDT classifier. And if the output of the GBDT classifier is a real number which is greater than or equal to the preset probability value 0.5, determining that the classification result is a positive classification. And if the output of the GBDT classifier is a real number smaller than the preset probability value 0.5, determining that the classification result is a negative classification. Further, in this embodiment of the present specification, if the trained GBDT classifier is used to classify the account number three according to the feature value 2 of the first dimension of the feature vector of the account number three, so as to obtain a real number 0.4, which is smaller than the preset probability value 0.5, it is determined that the account number three belongs to the negative classification, and the account number three has a potential fraud account number.
Here, if the trained GBDT classifier is used to classify account three according to the feature value 2 of the first dimension of the feature vector of account three, a classification result cannot be obtained. As shown in the decision tree of fig. 2, since the feature value 2 of the first dimension of the feature vector of account number three is less than 3, go to the left. And classifying the account number III according to the characteristic value 3 of the second dimension of the characteristic vector of the account number III, so that a classification result cannot be obtained. As shown in the decision tree of fig. 2, since the feature value 3 of the second dimension of the feature vector of account three is greater than 2, the user walks to the right. By analogy, if the classification result cannot be obtained, the method can move on according to the trend of the decision tree according to the feature value of each dimension of the feature vector of account number three until the classification result is obtained.
It is also noted herein that the above-mentioned methods for determining positive and negative classifications include, but are not limited to, the above-mentioned methods. In the embodiment of the present specification, positive and negative category probabilities are arranged from high to low, 1000 objects to be identified with low positive and negative category probabilities are determined to belong to a negative classification, and 1000 objects to be identified with high positive and negative category probabilities are determined to belong to a positive classification.
The embodiment of the specification adopts at least one technical scheme which can achieve the following beneficial effects: compared with the prior art of manually identifying potential fraudulent account numbers, the method for calculating the graph is used for identifying the potential fraudulent account numbers more quickly, and the fund loss of normal users is reduced.
Fig. 3 is a schematic structural diagram of an apparatus for identifying a risk object according to an embodiment of the present disclosure, where the schematic structural diagram includes: a graph data acquisition module 305, a feature vector acquisition module 310, and a risk object determination module 315;
the graph data acquiring module 305 is configured to acquire graph data, where the graph data includes an object to be identified, and the object to be identified at least includes an account or a device;
the feature vector obtaining module 310 is configured to obtain a feature vector of the object to be identified, as a feature of the object to be identified;
the risk object determining module 315 is configured to determine a risk object according to the feature of the object to be identified.
Optionally, the feature vector is a set of features of the object to be recognized, and is used for classifying the object to be recognized; wherein each dimension of a feature vector is a feature of the object to be identified.
Optionally, the risk object determining module is specifically configured to classify the object to be identified according to a group of features of the object to be identified; and under the condition that the object to be identified is in the negative classification, the object to be identified is a risk object.
Optionally, the classifying the object to be recognized according to the set of features of the object to be recognized includes:
calculating the positive and negative category probability of any object to be identified according to a group of characteristics of the object to be identified;
and determining whether the object to be identified belongs to the positive classification or the negative classification according to the positive and negative classification probabilities of the object to be identified.
Optionally, the feature vector obtaining module is specifically configured to perform click operation on random vectors of any two objects to be identified in the graph data to obtain similarity between the two objects to be identified; and determining a feature vector of the object to be recognized according to the similarity of the two objects to be recognized, wherein the feature vector is used as the feature of the object to be recognized.
Optionally, the determining that the object to be recognized belongs to the positive classification or the negative classification according to the positive and negative classification probabilities of the object to be recognized includes: determining the object to be identified with the positive and negative class probability smaller than the preset probability value as a negative classification; and/or determining the object to be identified with the positive and negative class probability greater than or equal to the preset probability value as the positive classification.
Fig. 4 is a schematic structural diagram of an apparatus for identifying a risk object according to an embodiment of the present disclosure, where the apparatus includes:
at least one processor 405; and the number of the first and second groups,
a memory 410 communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to:
acquiring graph data, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment;
acquiring a feature vector of the object to be identified as a feature of the object to be identified;
and determining a risk object according to the characteristics of the object to be identified.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in the process, method, article, or apparatus that comprises the element.
The above description is only an example of the present specification, and is not intended to limit the present specification. Various modifications and alterations to this description will become apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification should be included in the scope of the claims of the present specification.
Claims (13)
1. A method of identifying a risk object, the method comprising:
acquiring graph data, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment;
acquiring a feature vector of the object to be identified as a feature of the object to be identified;
and determining a risk object according to the characteristics of the object to be identified.
2. The method of identifying risk objects of claim 1 wherein the feature vector is a set of features of the object to be identified for classifying the object to be identified; wherein each dimension of a feature vector is a feature of the object to be identified.
3. The method for identifying risk objects according to claim 2, wherein the determining risk objects according to the characteristics of the object to be identified comprises:
classifying the object to be recognized according to a group of characteristics of the object to be recognized;
and under the condition that the object to be identified is in the negative classification, the object to be identified is a risk object.
4. The method of claim 3, wherein the classifying the object to be identified according to a set of features of the object to be identified comprises:
calculating the positive and negative category probability of any object to be identified according to a group of characteristics of the object to be identified;
and determining whether the object to be identified belongs to the positive classification or the negative classification according to the positive and negative classification probabilities of the object to be identified.
5. The method for identifying a risk object according to claim 1, wherein the obtaining the feature vector of the object to be identified as the feature of the object to be identified comprises:
performing click operation on random vectors of any two objects to be identified in the graph data to obtain the similarity of the two objects to be identified;
and determining a feature vector of the object to be recognized according to the similarity of the two objects to be recognized, wherein the feature vector is used as the feature of the object to be recognized.
6. The method for identifying risk objects according to claim 4, wherein the determining that the object to be identified belongs to the positive classification or the negative classification according to the positive and negative class probabilities of the object to be identified comprises: determining the object to be identified with the positive and negative class probability smaller than the preset probability value as a negative classification; and/or determining the object to be identified with the positive and negative class probability greater than or equal to the preset probability value as the positive classification.
7. An apparatus for identifying a risk object, the apparatus comprising: the system comprises an image data acquisition module, a characteristic vector acquisition module and a risk object determination module;
the graph data acquisition module is used for acquiring graph data, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment;
the characteristic vector acquisition module is used for acquiring the characteristic vector of the object to be identified as the characteristic of the object to be identified;
and the risk object determining module is used for determining a risk object according to the characteristics of the object to be identified.
8. The apparatus for identifying risk objects of claim 7, wherein the feature vector is a set of features of the object to be identified for classifying the object to be identified; wherein each dimension of a feature vector is a feature of the object to be identified.
9. The apparatus for identifying at risk objects according to claim 8, wherein the risk object determining module is specifically configured to classify the object to be identified according to a set of features of the object to be identified; and under the condition that the object to be identified is in the negative classification, the object to be identified is a risk object.
10. The apparatus for identifying risk objects according to claim 9, wherein the classifying the object to be identified according to the set of features of the object to be identified comprises:
calculating the positive and negative category probability of any object to be identified according to a group of characteristics of the object to be identified;
and determining whether the object to be identified belongs to the positive classification or the negative classification according to the positive and negative classification probabilities of the object to be identified.
11. The device for identifying risk objects according to claim 7, wherein the feature vector obtaining module is specifically configured to perform click operation on random vectors of any two objects to be identified in graph data to obtain similarity between the two objects to be identified; and determining a feature vector of the object to be recognized according to the similarity of the two objects to be recognized, wherein the feature vector is used as the feature of the object to be recognized.
12. The apparatus for identifying risk objects according to claim 10, wherein the determining that the object to be identified belongs to the positive classification or the negative classification according to the positive and negative classification probabilities of the object to be identified comprises: determining the object to be identified with the positive and negative class probability smaller than the preset probability value as a negative classification; and/or determining the object to be identified with the positive and negative class probability greater than or equal to the preset probability value as the positive classification.
13. An apparatus for identifying a risk object, comprising:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to:
acquiring graph data, wherein the graph data comprises an object to be identified, and the object to be identified at least comprises an account or equipment;
acquiring a feature vector of the object to be identified as a feature of the object to be identified;
and determining a risk object according to the characteristics of the object to be identified.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811476791.XA CN110046499A (en) | 2018-12-05 | 2018-12-05 | The method, device and equipment that a kind of pair of risk subjects are identified |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811476791.XA CN110046499A (en) | 2018-12-05 | 2018-12-05 | The method, device and equipment that a kind of pair of risk subjects are identified |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110046499A true CN110046499A (en) | 2019-07-23 |
Family
ID=67273635
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811476791.XA Pending CN110046499A (en) | 2018-12-05 | 2018-12-05 | The method, device and equipment that a kind of pair of risk subjects are identified |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110046499A (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106355405A (en) * | 2015-07-14 | 2017-01-25 | 阿里巴巴集团控股有限公司 | Method and device for identifying risks and system for preventing and controlling same |
| US20170124464A1 (en) * | 2015-10-28 | 2017-05-04 | Fractal Industries, Inc. | Rapid predictive analysis of very large data sets using the distributed computational graph |
| CN106656981A (en) * | 2016-10-21 | 2017-05-10 | 东软集团股份有限公司 | Network intrusion detection method and device |
| CN108418825A (en) * | 2018-03-16 | 2018-08-17 | 阿里巴巴集团控股有限公司 | Risk model training, rubbish account detection method, device and equipment |
-
2018
- 2018-12-05 CN CN201811476791.XA patent/CN110046499A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106355405A (en) * | 2015-07-14 | 2017-01-25 | 阿里巴巴集团控股有限公司 | Method and device for identifying risks and system for preventing and controlling same |
| US20170124464A1 (en) * | 2015-10-28 | 2017-05-04 | Fractal Industries, Inc. | Rapid predictive analysis of very large data sets using the distributed computational graph |
| CN106656981A (en) * | 2016-10-21 | 2017-05-10 | 东软集团股份有限公司 | Network intrusion detection method and device |
| CN108418825A (en) * | 2018-03-16 | 2018-08-17 | 阿里巴巴集团控股有限公司 | Risk model training, rubbish account detection method, device and equipment |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Wang et al. | Deep neural networks for choice analysis: Extracting complete economic information for interpretation | |
| CN108418825B (en) | Risk model training and junk account detection methods, devices and equipment | |
| CN110348580B (en) | Method and device for constructing GBDT model, and prediction method and device | |
| TWI631518B (en) | Computer server system having one or more computing devices and computer-implemented method of training and event classifier model | |
| CN110084374A (en) | Construct method, apparatus and prediction technique, device based on the PU model learnt | |
| US20200286095A1 (en) | Method, apparatus and computer programs for generating a machine-learning system and for classifying a transaction as either fraudulent or genuine | |
| Koshiyama et al. | Algorithms in future capital markets | |
| Yu et al. | A comparative study on data mining algorithms for individual credit risk evaluation | |
| CN112015909B (en) | Knowledge graph construction method and device, electronic equipment and storage medium | |
| Tayebi et al. | Hyperparameter optimization using genetic algorithms to detect frauds transactions | |
| Di Martino et al. | Tweets analysis with big data technology and machine learning to evaluate smart and sustainable urban mobility actions in Barcelona | |
| Hamsagayathri et al. | Machine learning algorithms to empower Indian women entrepreneur in E-commerce clothing | |
| CN111709225A (en) | Event cause and effect relationship judging method and device and computer readable storage medium | |
| Chen et al. | Sample prior guided robust model learning to suppress noisy labels | |
| Lang et al. | On hyperbolic embeddings in object detection | |
| Mousa et al. | TI-capsule: capsule network for stock exchange prediction | |
| Aparicio et al. | Predicting Bitcoin prices: The effect of interest rate, search on the internet, and energy prices | |
| Jung et al. | A novel on automatic K value for efficiency improvement of K-means clustering | |
| Barbalau et al. | A generic and model-agnostic exemplar synthetization framework for explainable AI | |
| Xiang | Deep Learning Framework Study for Twitter Sentiment Analysis | |
| CN110046499A (en) | The method, device and equipment that a kind of pair of risk subjects are identified | |
| Wang et al. | Leveraging ai in service automation modeling: From classical ai through deep learning to combination models | |
| Maniatopoulos et al. | Technical analysis forecasting and evaluation of stock markets: the probabilistic recovery neural network approach | |
| Burgard et al. | Mixed-Integer Linear Optimization for Semi-Supervised Optimal Classification Trees | |
| Arnaiz-Rodriguez et al. | FairShap: A Data Re-weighting Approach for Algorithmic Fairness based on Shapley Values |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20201013 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant before: Advanced innovation technology Co.,Ltd. Effective date of registration: 20201013 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. |
|
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190723 |